UniFi Identity Enterprise - Managing Devices Enrolled in MDM

Upon receiving the Lock Device command, the Mac will lock and can only be unlocked using the 6-digit PIN set by the workspace admins. The behavior varies based on hardware and macOS version. See the details below.

• Installed with Apple silicon

  • macOS 11.5 or earlier: PIN is not supported. The Mac will lock and reboot to macOS Recovery upon receiving the command and will require authentication and activation.
  • macOS 11.5 or later: The Mac will reboot and lock upon receiving the command, and can be unlocked using the set PIN.

• Installed with Intel processor running any supported macOS version
  The device will reboot and lock upon receiving the command and can be unlocked using the set PIN.

Upon receiving the Lock Screen command, the Windows PC’s screen will lock and can be unlocked using the device's password.

Admins can choose to show a phone number and customized lock message for an iPhone. Upon receiving the Lock Screen command, the iPhone screen will promptly lock, showing the message and phone number. Users can unlock the device using their current passcode, Face ID, or Touch ID. People who find a lost iPhone can easily contact the information shown on the screen.

The behavior varies based on hardware and macOS version. See the details below.

• Installed with Apple silicon (PIN is not supported)
  • macOS 12 or earlier: Upon receiving the command, all data and configurations of the Mac will be erased.
  • macOS 12 or later: Upon receiving the command, all data and configurations of the Mac will be erased. If the Erase All Content and Settings (EACS) process fails, the Mac will automatically switch to the erase behavior, and macOS will require a reinstall.
• Installed with Intel T1 or Intel T2 running macOS 12 or later
  Upon receiving the Reset to Factory Defaults command, the Mac will execute the Erase All Content and Settings (EACS) process, and a PIN is required for the next sign-in. If EACS fails, all data and configurations will be erased, and macOS will require a reinstall.

Upon receiving the Reset to Factory Defaults command, all data and configurations of the Windows PC will be erased.

Upon receiving the Reset to Factory Defaults command, the iPhone will execute the Erase All Content and Settings (EACS) process. The iPhone will reboot and will present the Setup Assistant. iOS 17 supports selecting Use Return to Service option when erasing a device, allowing the process of resetting and re-enrolling iPhone to be fully automated and much faster.

Upon receiving the Reset to Factory Defaults command, the Apple TV will reboot and will present the Setup Assistant. It is important to note that this is not a full system restore, and the device will not be updated to the latest version.

• macOS 10.15 or later.
• Identity Enterprise Desktop Agent 0.70.4 or later. The Desktop Agent will be automatically installed on an MDM-enrolled Mac.

1. Identify the software’s Bundle ID and App Name. If a process that matches the Bundle ID is found to be running, it will be blocked. Learn more about Bundle ID identification
2. Create a .mobileconfig file. Here we take blocking Slack and the Identity Enterprise apps for example. You can change the app name and BundleIdentifier in the example below to block other apps.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>AppsRestrictions</key>
<array>
<dict>
<key>name</key>
<string>Slack</string>
<key>BundleIdentifier</key>
<string>com.tinyspeck.slackmacgap</string>
</dict>
<dict>
<key>name</key>
<string>Identity Enterprise</string>
<key>BundleIdentifier</key>
<string>com.ui.uid.desktop</string>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Apps Restrictions</string>
<key>PayloadIdentifier</key>
<string>com.ui.uid.mdm.agent.apps-restrictions.43E00489-36CE-40FC-A369-8752536EB127</string>
<key>PayloadType</key>
<string>com.ui.uid.mdm.agent.apps-restrictions</string>
<key>PayloadUUID</key>
<string>46E3D5F7-8639-4A16-9004-2290F654CA82</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>MDM Agent Apps Restrictions Configuration</string>
<key>PayloadIdentifier</key>
<string>com.ui.uid.mdm.agent.apps-restrictions</string>
<key>PayloadOrganization</key>
<string>Ubiquiti Networks, INC.</string>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>CC5C0E2C-C6C1-4D53-A370-8E5DAB29871F</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

1. Go to your Identity Enterprise Manager > Trusted Devices > MDM Settings > MDM Policy > Mac.
2. Select an existing policy or create a new policy.
3. Specify the required information, go to Custom Profile File, and click Add Custom Profile File. Learn more about MDM policy 
4. Once the MDM policy is applied and the profile is sent to applied users’ Macs, the restricted app cannot be opened or downloaded.

WDAC can control what runs on your Windows devices by setting policies that specify whether a driver or application is trusted. WDAC policies apply to the managed computer as a whole and affect all device users. WDAC rules can be defined based on:

• Attributes of the codesigning certificate(s) used to sign an app and its binaries.
• Attributes of the app's binaries that come from the signed metadata for the files, such as the Original Filename and version, or the hash of the file.
• The reputation of the app is determined by Microsoft's Intelligent Security Graph.
• The identity of the process that initiated the app installation and its binaries (managed installer).
• The path from which the app or file is launched (beginning with Windows 10 version 1903).
• The process that launched the app or binary.

ConvertFrom-CIPolicy -XmlFilePath {existing .xml file path} -BinaryFilePath {.bin format file path to save}

<Add>
  <CmdID>1</CmdID>
  <Item>
    <Target>
      <LocURI>./Vendor/MSFT/ApplicationControl/Policies/{PolicyID}/Policy</LocURI>
    </Target>
    <Meta>
      <Format xmlns="syncml:metinf">b64</Format>
    </Meta>
    <Data>
{base64 data}
    </Data>
  </Item>
</Add>