Can a Policy Trigger Running a Script on the MDM?

[mschroder]

Dear Experts,

I wonder whether it is possible to have a policy run a script on the MDM instead of the client. We have a script on the MDM that extracts some information from an external database and fills some extension attributes. We run that script via cron on the node hosting MDM (but it could also live elsewhere) to keep the information in sync. This script checks for every device whether the information is up to date, so it takes some time to do its job.

We want to make sure the EAs in question get updated directly when the enrollment is finished, so it would be nice if we could trigger running this script with a device ID as argument (to avoid it has to loop over all devices) whenever a device was enrolled. Is that possible?

Thanks in advance for your valuable comments.

[Look · Accepted solution]

Why not just have a JSS smart group of newly enrolled devices missing a required EA.
Have the script download that list of devices in the group and populate the EA's for it and ensure the the required one is populayed, this will automatically remove them from the smart group and exclude them from future runs.
Alternatively if your after periodic updates just have an EA popluated by the script of the date it was updated and create a smart group based on that information for the device run list.

[mschroder]

Using the missing EA as a criteria for the smart group is an excellent idea. I already had a smart group with recent enrollments in mind, but was not too happy since the criteria does not allow something like 'within the last hour', and I found the minimum 'within one day' a bit loose. But also checking the missing EA might be a good work-around.

[mschroder]

I needed to modify my script to adapt for the data structure for computer groups, which is quite different from the list of all computers, but the new script is now in testing.

Thanks for the good idea.