macOS 11 Big Sur and later profiles require MDM

PriorBefore tomacOS 11 Big Sur, configuration profiles could be installed on macOS devices in multipleseveral ways, including:ways:

• Opening a profile locally in System Preferences
• Command line tools
• Via MDM to devices that are MDM enrolled

FileWave had the ability tocould use either ofcommand-line theinstallation latteror twoMDM, options,and defaultingwould default to MDM ifwhen the device werewas MDM enrolled at the time ofit receivingreceived the association.

AsStarting ofwith macOS 11 Big Sur, Apple madeno alonger fundamentalallows change, denying the abilityadministrators to add configuration profiles usingwith command command-line tools;tools, theyalthough profiles may still be removed though.that way. ThisFor leavesmacOS MDM as the only manageable option in11 Big Sur onwardsand later, MDM is the supported path for managed profile installation..

FileWave wastracks requiredhow to remember the method ofeach profile installation:was viainstalled: through the FileWave Client app or viathrough MDM. Each of theseThose methods uses ause different channeldelivery tochannels. instalTo change the profile;channel, to change channel requires removingremove the profile association and re-installingassociate it.it Noteso though,the profile installs through the new channel. Profile updates continue through the original channel where Apple allows that updating profiles alone could still be achieved and will use the same method of delivery without consequence where allowed.update.

Example:

• Associate a Dock profile to a non-MDM enrolled device and Update Model
• ProfileThe willprofile instalinstalls using the FileWave Client Appapp
• Subsequently MDM enrolEnroll the device into MDM later
• Update the dock profile and Update Model
• The profile update of the profile will continuecontinues to be handled usinguse the FileWave Client Appapp delivery channel
• Newly associated profiles would though be handled by MDM.
• Remove the association of the Dock profile, Update Model
• Once removed, re-associate the Dock profile and Update Model
• SinceBecause the device is now MDM enrolled, the profile willand befuture updates are delivered usingthrough MDM, as will any updates to this profileMDM

Note that not every type of change that a profile makes can be cleanly undone simply by removing the profile. One example would be if you add a printer via profile and then remove the profile the printer will remain. Always test adding and take a look at what happens when removing a setting. 

Impact

ConsequencesThis can therefore occurmatters when devices are upgraded to macOS 11 Big Sur or higher.later.

IfBe devicescareful relywith uponprofiles profiles,that for example providingprovide network connectivity,access, andcertificates, VPN settings, or other connectivity requirements. If you remove a profile that keeps the profiledevice is removed to be re-installed,online, the network will be lost and the newreplacement profile willmay nevernot become installedinstall until the device ishas backnetwork online.access As such,again. FileWave willdoes not attemptautomatically to changeswitch the delivery channel offor deliveryexisting ofprofiles these profiles, but careful consideration should be contemplated when manually attempting to usefor this process.  Other examples could include profiles containing certificates, VPN, etc.reason.

Devices not MDM enrolled

Where devices are not MDM enrolled:

• Any associated profile would have been installed using the FileWave Client Appapp prior tobefore Big Sur
• After upgrading to Big Sur, profiles would remain installed
• OnceAfter the device is on Big Sur anyor attempt to make changes to thelater, profile willupdates resultfail inif athey failurestill todepend deliveron theclient-side updateprofile installation
• Once on Big Sur any new profile associations will also fail
• Disassociation of a profile will remove the profile

Device MDM enrolled after profile installation

WhenThe notsame client-installed profile concern applies before MDM enrolled,enrollment. After the abovedevice would still be of consideration.  However afteris MDM enrolled:

• Any new profile association willinstalls instal viathrough MDM
• Removing anthe association, allowing the device to remove the profileprofile, and then re-associating the profile willinstalls thenit instal the profile usingthrough MDM

This is the same impact even if not upgraded to Big Sur

Resolution

Management ofManaging profiles on macOS 11 Big Sur reliesand uponlater devices beingrequires MDM enrolled.enrollment. IfWithout notMDM, theyprofiles may notfail beto installedinstall or updated.  As such devices must be MDM enrolledupdate.

Where profiles were installed not using MDM, the only way for these profiles to become managed is by removing the association, allowing the device to remove the profile and then creating a new association.

As highlighted above, take great care in the choice ofPlan profile removal ifcarefully youwhen havea profile controls network relianceaccess, oncertificates, installedor profiles.VPN. ThisThose willtransitions requiremay someneed a manual methodor ofstaged transitionpath whereso thisdevices isdo not lose the case.network they need to receive the replacement profile.

Additional Information

If the Client Info of a Device does not haveshow a 'Command History'History tab, it should imply that the device is likely not MDM enrolled. In thisthat instance,state, only the FileWave Client Appapp maycan instalinstall Filesets of any type.  NoteFilesets. Apple's VPP workflows also requiresrequire MDM.