Migrating from Meraki to Casper

Congrats, I moved from Meraki to Casper as well two years ago. I take it you need to migrate:

1. OS X devices enrolled in the Meraki MDM, since they have the Meraki MDM profile installed enrolling a computer by running the default QuickAdd will fail
2. Apps for Managed Distribution

For migrating existing devices, I downloaded the QuickAdd from the JSS and opened it in Composer. I then added the following preinstall command:

profiles -D

This may be a good time to get a Developer Installer certificate from Apple (Via the Apple Developer Program, $99/year), so you can sign your PKG and not cause Gatekeeper red flags. This preinstall command will remove all existing profiles before the QuickAdd runs, then it will successfully enroll the computer in your JSS. You could try pushing this out with Meraki, I just sent the co-workers a self enroll download link.

For managed distribution of apps with VPP, you can log into deploy.apple.com and revoke the VPP token the Meraki server has. Create a new token and set it up in your JSS. Then, recreate your users and app scope on the JSS. With VPP Apple ID distribution, your users won't lose their apps immediately and the transition shouldn't be noticed. Hopefully someone with some hands on experience can chime in though.

Sorry, I should have clarified. We are trying to migrate IOS devices (iPads).

They are shared devices so we are wanting to revoke all apps, then deploy them to the new machines.

Or are we in too deep?

It is just easier to continue to use Meraki?

You'll want to revoke all apps on the Meraki side, move your VPP token to the JSS, add your users to the JSS (The Users pane, not Settings > JSS Users), and then scope the apps to the users on the JSS.

Might need to double check the Meraki manual since the link I posted is a blog post and they love to change what features different tiers of customers can use.

Sorry meant to also say, since apps don't immediately remove themselves when you remove an Apple ID from scope, the users will probably be unaffected.

@adamcodega Thanks for sharing! Just what I need.

@adamcodega Any chance you're able to assist in some issues I'm having with the command you stated? We, too, are running Meraki SM and we're going to be migrating to JAMF Pro. I created a QuickAdd.pkg and then added the command you stated (and also tried sudo /usr/bin/profiles -D) and while the .pkg app installs successfully, it doesn't actually remove any of the installed profiles. Am I missing something or do you have a suggestion or another solution? Thanks for any help you're able to offer!

In Meraki, did you use DEP and enforce the "Make profile unremovable" feature?

@adamcodega Some of our computers (most?) are enrolled via DEP but we've used the Meraki Agent as part of our image up until now. Also, we manually re-install the profiles since not all of our computers are DEP and we bypass the user account setup screen as part of our post-image process.

We have a password required for removal of our "Managed Settings" profile, but the "Meraki Management" profile that gets pushed/installed by default is removable. I don't even think there is a way to make this non-removable without having it pushed via DEP. Very few of our computers have their DEP enrollment pushed, most of them have empty enrollments because we skip that step during the initial setup.

Ross

@adamcodega in your first post where you said you ran profiles -D before composer did you mean you ran the command in terminal first and then ran the quick add package? Did you do the migration via network?

For migrating existing devices, I downloaded the QuickAdd from the JSS and opened it in Composer. I then added the following preinstall command:

In pkgs (and in Composer) you can run preinstall commands which will be run when you initially run the pkg installer and before the pkg begins installing files.