Update on End User Notifications (App Installers)

[Mariusz]

We introduced a notification capability for App Installers deployments in September 2022 and have continued to refine these notifications since that time. The original intent was to present a notification to the end users that as closely resembled the particular app that was being updated as possible. Unfortunately, we were unable to present a consistent notification experience which has led to end user confusion.

Issues with the current process:

• Notification icons – For some applications we can show an original app icon, while for others we need to replace it with a generic “exclamation mark” icon. This may be confusing for the end user.
• BundleID for additional configuration profiles – If the Install supporting configuration profiles checkbox is selected, apps with a BundleID different than com.jamf.appinstallers.notify are configured to show permanent notifications (Alerts alert type). Because this setting is forced by the configuration profile, an end user cannot turn it off. As a result, notifications from these apps (e.g., Discord) are present and persistent in the Notifications Center.

Upcoming changes to improve the end user experience:

Starting 1 June, we will begin a transition to update all new versions of the apps from the Jamf App Catalog to use the Self Service icon and Bundle ID for end user notifications. The entire process is expected to take no longer than six weeks. The goal of this change is to unify and improve the end user experience when it comes to receiving notifications coming from App Installers updates.

Benefits of this change include:

• Fewer configuration profiles needed  - a single profile to enable notifications for com.jamfsoftware.selfservice.mac is enough to enable notifications for all apps in Jamf App Catalog
• Supporting configuration profiles will only be sent to suppress built-in auto-updates.
• The notification from App Installers is now completely separated from the behavior of the software titles’ own notifications.
• Notifications will automatically be enabled for all apps deployed via App Installers, as long as the Jamf management framework and Self Service checkbox is selected in Settings>Computer management>Security

Do admins need to do anything?

Short answer: No. You do not need to do anything specific. However, we recommend navigating to Settings>Computer management>Security and ensure the Jamf management framework and Self Service checkbox is enabled.

Notifications before change (example):

 

Notifications after change (example):

 

[Tribruin]

Is the Self Service icon the default icon or the custom Self Service icon, if the user sets this. 

It would be very confusing to users to see an unfamiliar icon. At least if we use our custom Self Service icon, users will know the prompt is likely from our IT.  

[JustinC]

@Tribruin we are using the bundleID of Self Service as a parameter for the notification. If you have branded your Self Service icon, that is the icon that will be used in the notification from App Installers.

[jamf-42]

Supporting configuration profiles will only be sent to suppress built-in auto-updates.

How can we see what this config profile is doing? It would be beneficial to see this prior to deployment.

[PrzemekS]

@jamf-42 you can create a test deployment for Chrome, Slack or Zoom to see what is the content of "App Installers - APP_NAME" profile. I've added more details in my last post in https://community.jamf.com/t5/jamf-pro/app-installers-distribution-method-missing/m-p/293380

[PrzemekS]

The exact content of a config profile that disables built-in auto-update is shared on this page: https://learn.jamf.com/bundle/technical-articles/page/Disabling_Developer_Auto_Updatesfor_App_Instal...

[ITIRUserSupport]

@JustinC Regarding this prompt, does this prompt only come up if the software is installed and active on the machine? I would assume so. Reason - I want to scope the software to all computers and then just toss it into the category of my choice. I would prefer not every user gets this prompt "unless" they have it installed which is what I would assume its intended for. Any input is greatly appreciated. Thank you. 

[PrzemekS]

Yes, you are right. This notification is only displayed if given app is installed and currently running. Otherwise the latest version is installed silently.

[ITIRUserSupport]

Example below.

[Shaun]

And what about completely disabling Notifications for a given App Installer? 

This seems like a pretty obvious toggle to have right there, even better having the ability to toggle off different levels of notifications.

As an end user experience it's outrageous to receive more than 1 notification for an update that automatically installs.

I also have a specific need to have updates done silently where users can't actually quit an application, such as the case of Cloudflare Warp. Ideally I would like to have no notifications at all, or only a single one to say that the app has been updated.

[JustinC]

@Shaun there is the ability to completely disable notifications for a given App Installer deployment. There is a suppress preference key available that can be set with a config profile. The documentation for creating your own profile to set this key is covered here https://learn.jamf.com/bundle/technical-articles/page/Configuring_End_User_Notifications_for_App_Ins...

Are you able to provide a little more context to your comment "As an end user experience it's outrageous to receive more than 1 notification for an update that automatically installs."? If the application is not currently running when the installation runs, there isn't a notification. It just performs the upgrade in the background.

[Shaun]

@JustinC you know I was right in there looking for exactly this yesterday and must have looked for every word other than suppress and then didn't see it being right at the bottom.

Thanks! This makes a huge difference, but really would stilll like to see it in the future as a simple toggle in the UI rather than a dedicated Config Profile. 

Out of interest CloudFlare Warp isn't in that list yet but I presume I should use a Bundle ID like 

com.cloudflare.1dot1dot1dot1.macos.AppInstaller? 

[duncan_mccracke]

Hey Shaun, yes the correct custom preference domain is:

com.cloudflare.1dot1dot1dot1.macos.AppInstaller

[JustinC]

@Shaun you may be pleased to see that with the release of Jamf Pro 11.4 we have added a 'Suppressing notifications' option in the end user experience settings so there is no longer a need for you to maintain your own profile to control this setting.

https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/App_Installers.html

[Shaun]

Sorry to answer the second question, we have Cloudflare Warp setup so that a user cannot Quit the application and therefore it is always running and hence using Appinstaller for it pretty much always fires off notifications.

But I think being able to suppress them entirely will sort that right out.

[duncan_mccracke]

Hey Shaun, suppressing the notifications will prevent them from displaying, however you may also want to additionally set the deadline key otherwise the App Installer will be queued in the background indefinitely with no notifications.
Note: When using a custom profile for App Installer settings you will also need to disable any 'End User Experience' settings in the App Installer deployment, otherwise you may get a profile conflict.

[Shaun]

Excellent, that is exactly the behaviour I was picking up so glad you answered that question already.

[Shaun]

@JustinC @Mariusz does Jamf leave a "receipt" for a given AppInstaller or how does it figure a given app is installed on the machine? 

Reason I ask is in testing the notifications for CloudFlare Warp I've actively uninstalled the entire application but Jamf still thinks it's installed and therefore doesn't try to install it with an automatic policy.

Interestingly if I install and older version then it does pick it up. 

Would be useful to know how Jamf determines this to sort out any future issues where an application isn't updating or installing for whatever reason.

[PrzemekS]

Hey @Shaun, the process is described in the documentation: https://learn.jamf.com/bundle/jamf-pro-documentation-11.2.0/page/App_Installers.html

In short, it sends "InstalledApplicationList" MDM command and waits for the response. Based on that, it sees which app and which version is installed and if it needs an update.

If the app is already marked as "Installed" in Jamf Pro, then it is no longer monitored until one of these events happen:

• The App Installer deployment is toggled off and back on.
• A new version of the software title is added to the Jamf App Catalog.
• The target computer is removed from the scoped smart group and then re-added to the smart group.