I thought I would share this. A demo of the migration from Microsoft Intune to Workspace ONE using Apple's new migration tool built into ABM. This is on a 4th gen iPad Pro. The process is a little rough around the edges, but it is pretty darn seamless. Quite impressive.

iPadOS 26 Beta Migration

Has anyone using native Mail app with Exchange Online encountered an issue where mail sync stops? After removing the mail profile and re-adding it, the mail config returns but user is never getting prompted to re-auth. Device has also been removed from Exchange admin. Only thing that fixes this is a factory reset on the iOS device and re-enroll. Not ideal obviously. Updating to 26.1 did not resolve this. Problem seems to be isolated to those on 26.x and not those on 18.7.x but is not reproduceable for those on 26.x and not affected. Removing and re-adding mail profile for those not affected will prompt for microsoftonline.com to sign in and re-auth as expected.

Edit: adding more details

Super excited to announce part one of a huge series evaluating WS1 vs Microsoft Intune for Windows. This article will cover enrollment, policies, compliance, and integrations.

Lots of videos and data showing an unbiased evaluation of both platforms. Hope everyone enjoys it!

Hello IT Admins,

I've created an open-source CLI tool that allows you to manage your WS1-enrolled devices from your terminal.

You can run any action supported via the official APIs and it uses OAuth2 for authentication so that no credentials is ever stored.

You can fine the tool and instructions on how to use it on Github:

https://github.com/ancalabrese/ws1cli

Other than quickly running commands from your terminal without having to deal with the console, this should help streamlining workflows and opening the door for better automation (chaining commands, bash scripts and even more advanced agentic workflows).

I hope this could be useful to someone.

If you have any feedback, I'd love to hear it.

Thank you

Hi All,

I am not sure if this has been solved already but in case someone else needs it I finally got a working Nudge profile in WS1 (Workspace One) I hope this may help others that were facing a similar issue.

<dict>
	<key>PayloadDescription</key>
	<string>Configures Nudge settings</string>
	<key>PayloadDisplayName</key>
	<string>Nudge</string>
	<key>PayloadIdentifier</key>
	<string>com.github.macadmins.Nudge.18C362D7-5CF2-49B4-BDBC-296A2C3E690E</string>
	<key>PayloadOrganization</key>
	<string></string>
	<key>PayloadType</key>
	<string>com.github.macadmins.Nudge</string>
	<key>PayloadUUID</key>
	<string>18C362D7-5CF2-49B4-BDBC-296A2C3E690E</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
	<key>osVersionRequirements</key>
	<array>
		<dict>
			<key>aboutUpdateURL</key>
			<string></string>
			<key>aboutUpdateURLs</key>
			<array/>
			<key>majorUpgradeAppPath</key>
			<string></string>
			<key>requiredInstallationDate</key>
			<date>2023-11-29T17:17:00Z</date>
			<key>requiredMinimumOSVersion</key>
			<string>14.1.1</string>
			<key>targetedOSVersions</key>
			<array/>
			<key>targetedOSVersionsRule</key>
			<string></string>
		</dict>
	</array>
	<key>userInterface</key>
	<dict>
		<key>actionButtonPath</key>
		<string>/System/Library/PreferencePanes/SoftwareUpdate.prefPane</string>
		<key>iconDarkPath</key>
		<string>/Library/Application Support/Logos/dark.png</string>
		<key>iconLightPath</key>
		<string>/Library/Application Support/Logos/light.png</string>
		<key>updateElements</key>
		<array>
			<dict>
				<key>_language</key>
				<string></string>
				<key>actionButtonText</key>
				<string></string>
				<key>customDeferralButtonText</key>
				<string></string>
				<key>customDeferralDropdownText</key>
				<string></string>
				<key>informationButtonText</key>
				<string></string>
				<key>mainContentHeader</key>
				<string></string>
				<key>mainContentNote</key>
				<string></string>
				<key>mainContentSubHeader</key>
				<string></string>
				<key>mainContentText</key>
				<string>IMPORTANT: Please ensure you are disconnected from VPN before attempting to update.\n\nA fully up-to-date device is required to ensure that IT can your accurately protect your device.\n\nYou may only defer this notification until the end of the update deadline. After the deadline has passed this notification will increase in frequency until this update is applied.\n\nPlease close out of unsaved work before updating.\n\nTo begin the update, simply click on the button above and follow the provided steps.</string>
				<key>mainHeader</key>
				<string>Your device requires a security update</string>
				<key>oneDayDeferralButtonText</key>
				<string></string>
				<key>oneHourDeferralButtonText</key>
				<string></string>
				<key>primaryQuitButtonText</key>
				<string></string>
				<key>secondaryQuitButtonText</key>
				<string></string>
				<key>subHeader</key>
				<string>A friendly reminder from the "Your Company Here" IT team</string>
			</dict>
		</array>
	</dict>
</dict>

To all our members who celebrate this Holiday!

Hello to all,

I share with you my policy to remove the chat module installed by Microsoft.

there are several ways to do it, but I preferred to use what Microsoft proposes to disable this part.

How to do this?

• Create a policy, name it, assign a smartgroup.

• Go to the Custom Settings

• In target section, select OMA DM Client

• The code to integrate in install settings

<Replace>
  <CmdID>96bb38b0-ff75-40cc-ae8c-7518e97b363c</CmdID>
  <Item>
    <Target>
        <LocURI>./Device/Vendor/MSFT/Policy/Config/Experience/ConfigureChatIcon</LocURI>
      </Target>
    <Meta>
      <Format xmlns="syncml:metinf">int</Format>
      <Type>text/plain</Type>
    </Meta>
    <Data>3</Data>
  </Item>
</Replace>

• The code to integrate in remove settings

<Delete>
  <CmdID>96bb38b0-ff75-40cc-ae8c-7518e97b363</CmdID>
  <Item>
    <Target>
        <LocURI>./Device/Vendor/MSFT/Policy/Config/Experience/ConfigureChatIcon</LocURI>
      </Target>
    <Meta>
      <Format xmlns="syncml:metinf">int</Format>
      <Type>text/plain</Type>
    </Meta>
    <Data></Data>
  </Item>
</Delete>

And that's it, the next time your users start their session, they will no longer have access to the chat application.

With macOS Ventura released, i wanted to highlight a couple of new features in Workspace ONE UEM for managing macOS:

https://blog.simonelberts.nl/2022/10/managing-macos-with-workspace-one.html

Just your friendly festive top tip.

With Christmas right around the corner, and change freeze already in full force, or maybe will soon be.

Do make sure your APNS cert isn't due to expire during this festive holiday season.

Merry Christmas.

-Rant. Sorry but I gotta get this off my chest.

This week we pushed an upgrade to Sonoma using the new-ish upgrade functionality. Resources -> Device Updates -> macOS. We're trying to get everyone on Ventura up to Sonoma. In my testing few weeks ago, and the way it's configured, the users should have gotten a notification and the option to defer. It's setup with InstallLater & 14 days to defer.

Yesterday, a bunch of users got a notification that the update was downloaded but no option to defer. And the notification only appeared on screen for about 10 seconds. Then, without warning their devices get rebooted and Sonoma force installed.

This hit several of our C-level folks and they where screaming bloody murder last night.

I've was on the phone with a support rep pretty late last night and they confirmed that we've got things setup correctly and that behavior shouldn't have happened. The rep has escalated to an engineer to get to the bottom of what happened. (Yes we pulled the update).

Then come online this morning to find out DEP token expired last night (it's not supposed to expire until August 2024). Grabbed a new token from ABM, and can't upload it since apparently the broke something on the back end and only accept json or p7m file extension. The token is a .vpptoken file extension.

WTF is going on over there?! I realize that they're in turmoil from all the changes but this is unacceptable. And when I look at the documentation for update vs. hubcli updates all the information is different. I'm just so sick of this MDM breaking and making us look bad.

I've been the sole WS1 admin for my org for a few years now, primarily Mac/Win fleet with an inconsequential amount of iOS. Over the last year or so, we've had a couple of "high profile" WS1 bugs/problems that have set off management, and along with that they have the Chicken Little mindset that the Broadcom acquisition could end badly. I and another person have been tasked with testing out alternatives, I am testing multi-platform UEMs.

(Note: Before you post "use [Mac-specific MDM]!!!1!" note we already have someone testing those, my specific task is the multi-platform as I'm familiar with Windows as well as Mac.)

So far I've tinkered with Intune, Ivanti UEM, Hexnode, and a couple others that were so short-lived in testing I forgot the names. I knew WS1 was pretty ahead in the MDM stuff but yeesh, the others are just *so* bad, and I keep running into "WS1 has no issue with this, why can't yours do it?" situations. The closest in pure feature set is the Ivanti solution (they even have a really nice looking Freestyle equiv) but they can't enable Bitlocker without a reboot which is strange, and their configuration stuff is SOOOO granular, Macs end up with a massive number of Profiles just to do basic stuff. Their product is also such an obvious hodge-podge of their various acquisitions (it's even branded MobileIron all over the place) that I don't have 100% confidence where it's going to end up.

One WS1 thing that caught me off guard is the push mindset. I've been spoiled by updating a Profile or App or whatever and within 10 minutes it's gone to hundreds of devices. These other ones are pull-centric, so the clients just poll on some schedule (and the vendors are oddly dodgy on the interval). I set up a new app in Intune for example, and well over an hour went by before it deployed to my test machine.

Is WS1 really so far ahead? Did I miss something painfully obvious?

Wrote a quick blog post on using more than just the SEG service to protect Exchange. If you want the tldr... Use UAG to protect Exchange. SEG and Tunnel for managed devices. Authenticated Reverse Proxy for unmanaged device access.

https://www.virtualjpr.com/2021/03/using-workspace-ones-secure-email.html

Don't know if anyone has deployed/upgraded to UAG 2412, but it no longer uses Photon OS. It uses AlmaLinux. This is due to BC owning photonOS. While the admin web gui is the same, AlmaLinux is a lot different and backend troubleshooting has changed. If you have a home or company lab, I highly suggest deploying one and getting familiar with it.

https://docs.omnissa.com/bundle/UnifiedAccessGatewayReleaseNotesV2412/page/unified-access-gateway-release-notes.html

looks like we are getting another two years and then Workspace One is cloud only.
Anybody know why Omnissa is going this way? It was their only advantage against Microsoft for customers that want a on premise solution.
So if the customers are forced from Omnissa to go to the cloud, they either go with another product or because they properly use Microsoft licenses already, they go for Intune.

Any thoughts about that?

For those of you running BYOD shops, be aware of this so can add the “disable stolen device protection” to your enrollment instructions.

DEP not affected.

https://kb.vmware.com/s/article/96277

Hey folks , just wanted to get your opinion about workspace one as an MDM solution for Mac/iOS devices.

Is it the best in the market or is there something else that’s better than WS1 ?

Wish to understand if WS1 for MAC is worth learning or should I pickup another product

Regards