macOS Migration does not create notification in notification center after migration dialog closes

[willmayhone88]

Fleet version: Fleet 4.50.2

Web browser and operating system: Safari 17.5 on macOS 14.5

---

💥  Actual behavior

macOS Migration did not prompt until roughly 35 mins after device was migrated to Fleet server in ABM. After selecting "Turn on MDM" on my device page, no "Device Enrollment" notification is available in the notification center to finish the migration.

🧑‍💻  Steps to reproduce

1. Ensure mac is on Sonoma 14.5
2. Have mac enrolled in another MDM
3. Turn on "Forced" migration and then migrate device in ABM to Fleet server
4. Wait until "Migrate to Fleet" screen pops up and select "Start"
5. After my device page pops up, select "Turn on MDM"

🕯️ More info (optional)

This was verified on an M1 Macbook Air, running Sonoma 14.5. Will downgrade device to Ventura and test again.

🛠️ To fix

Product changes: Figma link

[willmayhone88]

Adding orbit.stderr.log to this. orbit.stderr.log
Device migrated in ABM at 4:54pm and did not receive migration workflow until 5:22, no notification
ever appeared and roughly every 20 minutes I receive the "Migrate to Fleet" screen.

[willmayhone88]

Testing on macOS 14.4:
Migration workflow showed after 22 minutes. But resulted in a different error, logs attached. Was able to manually enroll, but no notification in notification center ever appeared. Device is a personal device that was added to ABM via Apple Configurator.
orbit.stderr 4.log
fleet-desktop.log

[marko-lisica]

Follow up on what we discussed today. @gillespi314 @noahtalerman

We want the same experience as we have today on macOS < 14. Run a job (every 15 minutes assuming that's how often it runs currently) that will trigger a command to popup new "Remote Management" dialog.

We want to change instructions on my device page for macOS hosts above 14.0. I'll have the wireframes ready tomorrow.

[roperzh]

@marko-lisica @noahtalerman the way this currently works is:

1. we show our own (swiftDialog) modal that takes over the screen every 15 minutes.
2. we run the sudo profiles renew --type enrollment command every 1 hour.
   1. In macOS < 14 this shows the notification
   2. In macOS > 14 this opens the native UI that takes over the screen

are you saying that we should run sudo profiles renew --type enrollment after the user clicks our swiftDialog modal so the macOS UI appears afterwards? or are you saying that for macOS > 14 we should just show the native UI instead?

cc: @gillespi314

[marko-lisica]

are you saying that we should run sudo profiles renew --type enrollment after the user clicks our swiftDialog modal so the macOS UI appears afterwards?

@roperzh Sorry if I confused you with the previous message. We want to keep it the same way it is today. Fleet dialog won't trigger sudo profiles renew --type enrollment.

• We should trigger the command as we do currently, by running the job (just fix the way we call it so it actually works).
• Additionally we want to improve copy and have it different for hosts with macOS > 14.

I filed a feature request to track the improvement of that flow so possibly it appears when the user clicks a button in the Fleet dialog or on My device page.

cc @gillespi314

[marko-lisica]

@gillespi314 I just added wireframes to "To fix" section in the bug description.

I relied a lot on this article that describes a new experience, could you double-check that everything described in the wireframes is what end-user will actually experience. More specifically:

• Apple's dialog appears and after user hit Not now it's triggered by Fleet every hour, after 8 hours user can't dismiss it anymore and Not now button is not available
• Workflow where user enrolls host using System Settings > Enroll in Remote Menagement sidebar menu item

@noahtalerman Could you take another look on the copy?

[noahtalerman]

Hey @marko-lisica do you know what this step is? Is it enabled by default? And how does the IT admin enable/disable it? Automatic enrollment (DEP) profile?

If it's not enabled by default I think we can cut this step 4 for now. But we should understand how the IT admin enables/disables it.

@gillespi314 when you get the chance, can you please confirm whether this step doesn't appear by default? Thanks :)

[gillespi314]

@marko-lisica

Apple's dialog appears and after user hit Not now it's triggered by Fleet every hour, after 8 hours user can't dismiss it anymore and Not now button is not available

I have confirmed that it is triggered by Fleet every hour. Later today, I should be able to confirm what happens at the 8 hour mark.

Workflow where user enrolls host using System Settings > Enroll in Remote Menagement sidebar menu item

The screenshots all track with what I've experienced. Regarding Noah's question above, that specific screen doesn't appear with our workflow. Rather the user would see the IdP and EULA screens (same as if it were a new device in the out-of-the-box ADE flow).

[noahtalerman]

Regarding Noah's question above, that specific screen doesn't appear with our workflow. Rather the user would see the IdP and EULA screens (same as if it were a new device in the out-of-the-box ADE flow).

Thanks @gillespi314!

What if I (IT admin) don't have the IdP or EULA configured? Do my end users still see the "Please enter your credentials..." screen?

For now, I think let's update step (4) in the copy for macOS >= 14 (from Figma here):

Also, I added this dev note to track the TODO for understanding how/when that "Please enter your credentials..." screen above shows up.

@marko-lisica when you're back online, can you please take that research?

[marko-lisica]

What if I (IT admin) don't have the IdP or EULA configured? Do my end users still see the "Please enter your credentials..." screen?

@noahtalerman I couldn't find exactly why this appears, but I think it's one of the ways to authenticate with your organization's account. In our case I believe web view with IdP login will appear. After login it will start downloading enrollment profile.

[nonpunctual]

@noahtalerman @marko-lisica unless this is something in new in Sonoma (I was enrolling lots of Sonoma computers not that long ago) I don't think we should be seeing a prompt for credentials there. I am wondering if somehow we are using a user enrollment workflow instead of a fully automated workflow for enrollment? https://it-training.apple.com/tutorials/deployment/dm130

[noahtalerman]

Hey @nonpunctual just to clarify, we (Fleet) haven't seen that "Enter your credentials.." prompt yet. We found it in Kevin Cox's article here.

We're trying to learn when/how it shows up.

it's one of the ways to authenticate with your organization's account

It could also be their local account? "your credentials" isn't giving us a lot of leads..

I did a quick search through the DEP profile developer docs (where we configure the configuration_web_url if the IT admin wants to require end user auth w/ their IdP) and I don't see anything else related to authentication/credentials.

Let me reach out to Kevin in the Mac Admins Slack.

[PezHub]

QA Notes:
Confirmed I'm seeing the banner in Fleetd and the notifcation in system settings now during the migration flow

Device enrolled in Fleet (from another MDM) successfully.

I also ran thru clicking not now and Enroll to ensure those work as well.

Things are looking good

We did discover a recent change requires a fix before moving this to ready for release so I will track #19812 then retest to ensure all is good

[georgekarrv]

@zayhanlon This may take another day or two to fix fully and test. Would you like to hold the release for this or push this fix into next weeks release?

[zayhanlon]

for audit trail purposes - discussed with alex m and we want to hold until thursday @georgekarrv
https://fleetdm.slack.com/archives/C062D0THVV1/p1718727279910679

[PezHub]

All blockers have been fixed and the migration workflow succeeded for both my MBair and Mac mini devices.
https://www.loom.com/share/37cdd0e31da14ebb936da4bce031c1da?sid=aeca33ae-e292-4fd4-83ef-18c1fe40e21e

[fleet-release]

Migration in silence,
Fleet lights the path to progress,
Mac finds its new home.