Customer Spotlight: XING’s Move To SimpleMDM

Last updated April 10, 2019

The goal of our Customer Spotlight series is to share the unique strategies our customers are using for their Mac deployments and to provide insight into the different ways that Mac Admins are solving common problems.

David Schöfberger & Christopher Maack of XING SE

XING SE is a premier social network company that focuses on business networking, career search, and other business/career-related services. XING was founded in 2003 in Hamburg, Germany and currently has over 1500 employees and serves upwards of 15 million members, primarily in Europe.

David and Christopher are both IT System Administrators at XING, located in Vienna and Hamburg respectively. Together they are responsible for the management of in-house Macs and many more iOS devices. David was nice enough to share XING’s internal processes and configurations currently being used.

Their Goals

• Migrate from an older system that required many manual processes to a more scalable, automated solution
• Unify the deployment system across all company locations
• Reduce the time necessary to deploy/configure a new Mac

Tools Used

• SimpleMDM
• Apple DEP
• Apple VPP
• Nagios & Icinga
• Munki
• Microsoft Active Directory

The Move To SimpleMDM

David and Christopher were in search of a future-proof solution that they could deploy across multiple locations. When they came across SimpleMDM, they were confident that it could effectively manage a large number of Mac and iOS devices in a unified manner.

Though working towards a touchless deployment, XING currently involves an on-site IT technician in the setup process to handle a few quick tasks for reasons relating to macOS reliability, such as ensuring FileVault encryption was successful. XING plans to move toward a zero-touch deployment in time.

From Purchase To User Delivery

XING purchases Macs from their vendor, who is responsible for adding the devices to their DEP account. Once the Macs are received, they are unboxed, connected to the internet, and activated using DEP. The technician proceeds through the DEP-customized Setup Assistant screens and the device is enrolled into it a default device group. This group only applies a few basic profiles and certificates.

After the initial enrollment is complete, the technician renames the device and re-assigns it to the destination group via the SimpleMDM interface. The destination group applies additional configuration profiles, some of which are based on the office location and employee’s role. The native profiles include:

• FileVault profile
• Firmware Password profile
• Privacy Preferences profile to automatically configure permissions for certain software
• Kernel Extensions profile to automatically permit certain kernel extensions

Several custom configuration profiles are also applied via the destination group:

• Region-specific Active Directory profiles for binding accounts. this allows users to log in with known credentials.
• One or more profiles for each required Munki catalog.
• A profile to configure the Dock on macOS.
• A Google Chrome profile that enables integrated authentication with a web proxy.
• A Login Window profile that hides the “Guest” login option and displays the full name of user accounts.

When the login window is displayed, the technician logs in to the admin account that was auto-created during enrollment with DEP. They confirm that Munki – Managed Software Center is installed and showing in the Dock. The technician then logs out of the admin account, is prompted to enable FileVault and does so, then reboots the device. The reboot kicks off a script that runs to ensure the Managed Software Center automatically installs all required software. After logging out of the admin account, the option to log in with an Active Directory user is shown. They log in to Active Director with new user credentials and set the secure token for FileVault. The device is then passed off to the user. After logging in, the user can reset their own password for the account.

Prior to using SimpleMDM, David states that the deployment process took more than 30 minutes. With SimpleMDM, the time has been cut down to less than 10.

API & Webhook Integrations

David and Christopher have created a handful of custom integrations. To help with their migration process onto SimpleMDM, they used a script deployed via Munki to check if the SimpleMDM management profile was installed on their Macs, and if one was not present, Munki would install the enrollment profile which added the device to their default group.

Additionally, David and Christopher use the SimpleMDM API to send information to Nagios and Icinga, the internal systems they use for reporting. These integrations allow them to: check for certificate expiration dates and send notifications, monitor their usage of device licenses in MDM, and ensuring their users’ Macs are assigned to the appropriate device groups.

David and Christopher are also writing integrations that utilize SimpleMDM’s webhooks to send custom notifications based on events, such as new device enrollments. These integrations help their device administrators keep a closer eye on their deployment and stay on top of any potential issues before they arise.

Have a question about this deployment? Leave a comment below and we’ll do our best to address it.