Parameter Transition

Action required

If you are currently using any of the Parameters listed below and want to enforce these controls on macOS Big Sur and later versions of macOS, you will need to migrate to the new Library Item or alternative control equivalent of the Parameter. 

Even if you have not transitioned your environment to Big Sur and later, we recommend migrating as soon as possible, as the Library Items will work for macOS Ventura, macOS Monterey, macOS Big Sur, and previous versions of macOS. You are not required to enable both the Parameter and Library Item to support multiple macOS versions in a single Blueprint.

How to migrate

In most cases, there is a direct Library Item equivalent to transitioned Parameters. Migrating to Library Item Parameter equivalents is straightforward, as macOS can usually have multiple of the same configuration profile installed at a time (although there are exceptions).

To migrate, add the new Library Item to your Library and match the settings you have configured with Parameters in your Blueprints. Once you have these settings matched, assign the Library Item to the Blueprint. Once you have confirmed that the Library Item has successfully deployed to the bulk of your devices, you can disable the Parameter. 

March 2022 - Transitioned Parameters

Understand which Parameters are being transitioned and which Library Items you should leverage to replace them. Many of these new Library Items have additional new benefits, such as rotating the FileVault Key automatically.

macOS 12.3 considerations 

Mac computers that upgrade to macOS 12.3 prior to March 23, 2022, will not have any Parameters enforced by the Kandji Agent, due to compatibility issues. On March 23, 2022, all non-transitioned Parameters will begin being enforced once again.

October 2020 - Transitioned Parameters

Understand which Parameters are being transitioned and which Library Items you should leverage to replace them. Many of these new Library Items have additional new benefits, such as rotating the FileVault Key automatically.

Why are these Parameters being transitioned?

With macOS Big Sur and later, Apple has introduced security improvements that require profiles to be installed by a user through System Preferences or by the MDM server the device is enrolled into. This change improves security and prevents privileged processes from installing configuration profiles silently.

For a minority of Parameters, the Kandji Agent installs configuration profiles to apply and enforce settings. In order to support the changes in macOS Big Sur and later, we have transitioned these Parameters to new Library Items where the configuration profile portions of the control are installed via MDM. 

Additionally, for some Library Items such as FileVault and Firewall, the agent logic has been improved to work alongside profiles when these Library Items are configured and continue to enforce settings beyond what configuration profiles can currently achieve. Examples include regenerating FileVault Recovery Keys for previously encrypted macOS devices, setting extended logging options for the macOS Firewall, or re-enabling the Firewall if manually disabled by a local administrator.

What to expect

Learn what to expect when devices upgrade to macOS Big Sur and later.

For your devices that are already enrolled into Kandji and upgrade to macOS Big Sur and later: 

The profiles installed by the Kandji Agent will not be removed until you disable the Parameter as part of migrating to the new Library Item equivalent. However, remediations will fail on macOS Big Sur, and later if the profile is removed as the Kandji Agent will not be able to reinstall the profile via the Parameter. 

For devices running Big Sur and later that are enrolled into Kandji:
The Kandji Agent will report these Parameters that install configuration profiles as Incompatible and will not install the configuration profile.

Special consideration for migrating to the FileVault Library Item

When migrating to the new FileVault Library Item, special consideration needs to be made, as macOS can only have one FileVault Escrow profile installed at a time. 

1. You will need to first disable both FileVault Parameters and wait roughly 15-30 minutes for the majority of your devices to check in and for the Kandji Agent to uninstall the manually installed configuration profiles. 
2. After this, you will assign your new FileVault Library Item to the Blueprint being migrated. No end user interaction/disturbance will occur as long as a FileVault key was previously escrowed. 
3. Disabling the legacy FileVault Parameter(s) will NOT delete any currently escrowed FileVault Recovery Keys.

In the event that a device is not online for the Kandji Agent to uninstall the manually installed FileVault profiles prior to deploying the new Library Item, you may see the new Library Item initially fail to install due to macOS only allowing one of these profile types at a time. This error will self-correct at the next daily MDM check-in if the Kandji Agent has since removed the manually installed profile.

To initiate this remediation process manually, you can run the following commands locally. 

This command will force a check-in and will remove the FileVault profile (if the Parameter has been disabled).

sudo kandji run 

This command will force daily MDM check-in commands to run, triggering an install of the new FileVault Library Item. 

sudo kandji update-mdm