Meraki Systems Manager EOL Migration

Apple MDM Push Certificate 

Since the Apple Push Notification service (APNs) certificate is signed with Cisco Meraki’s certificate signing request (CSR), you will need to create a new APNs certificate with the new MDM vendor (signed by their CSR). It is not necessary to back up the current Cisco Meraki APNs certificate, as this certificate is only applicable within Systems Manager. However, this is a good opportunity to confirm that you still have access to an administrator’s identity.apple.com/pushcert account. In the new MDM platform, a new Apple Push Certificate will have to be created. For more information, please see the new MDM vendor’s documentation.  

Apple VPP token 

It is not necessary to back up the current VPP token, as a new one can be redownloaded from your Apple Business Manager or Apple School Manager portal anytime. The new MDM vendor should be able to do this, so revoking licenses is not a necessary step.  

Note: VPP device assigned licenses will remain assigned based on the SM network’s app scope. A new MDM vendor will be able to revoke and re-assign these. However, if you would like to revoke the licenses from Meraki SM as part of the migration then you may optionally revoke any currently assigned VPP device assigned licenses. 

Android Enterprise account 

Keep the administrator Android Enterprise account bound in play.google.com/work until you are ready to re-connect it to a new MDM. At that point, you can delete the binding from play.google.com/work and connect it to a new MDM. Alternatively you may use an entirely different Google administrator Android Enterprise login account for the new MDM.  

ChromeOS Google Admin Console account 

It is not necessary to unbind Google Chrome. However, if you would like to unbind this before removal of SM, you can do so in Organization > MDM > Chrome OS device management > Disable.  

Apple Automated Device Enrollment (ADE)  

Please review the offical Apple documentation for how to migrate from one MDM to another MDM here.  

Devices not part of ADE will need to follow the migrate user-owned endpoints section.  

iOS/iPadOS/macOS/tvOS: 

1. Add ADE token to new MDM. This will allow you to sync the devices into the new MDM to pre-stage an enrollment into this new MDM.  

2. Assign ADE settings in the new MDM to the devices.

3. Stage the devices into the new MDM (steps below).

Android Device Owner (with Zero Touch Enrollment) 

1. Change the DPC extras configuration assignment for devices in the Android Zero Touch customer portal to match the settings required for the new MDM.  

2. Issue a factory reset from SM. Optional: delete the device from Meraki Systems Manager network(s) -- this will simply remove the record of this device within Cisco Meraki. 

3. When devices go through their initial setup, they will start enrolling into the new MDM platform with the newly assigned DPC extras Zero Touch Enrollment settings.  

Android Device Owner (without Android Zero Touch) 

Android devices enrolled in Device Owner mode but without Android Zero Touch will be required to manually re-enroll into the new MDM. From Meraki SM, the last action can be a factory reset which will reset it back into factory device setup so the device can be ready to re-enroll in Device Owner mode within the new MDM.  

Windows 

1. Uninstall the agent and profile by performing the steps in this guide.  

2. Optional: delete the device from Meraki Systems Manager network(s) -- this will simply remove the record of this device within Cisco Meraki. 

3. Re-enroll the Windows device based on the user/BYOD enrollment strategy for the new MDM product. Please see the new MDM’s documentation for instructions on enrollment. For company-owned Windows devices (if supported by the new MDM) leverage Windows Autopilot to automatically enroll during initial setup. 

ChromeOS

The ChromeOS devices will need to be unenrolled from Meraki SM to re-enrolled into the new MDM. This can be done by toggling off the Organization > MDM > ChromeOS API setup and then setting ChromeOS up in the new MDM. Please see the ChromeOS enrollment steps for more information.  

iOS/iPadOS/tvOS: 

Tap on the Remove Management inside Settings > General > Profiles & Device Management > Meraki Management. 

macOS:  

Tap on the Remove Management inside System Settings > Privacy & Security > Profiles > Meraki Management.  

Android Work Profile:  

Delete the Work Profile enrollment on the Android devices. The work profile can be deleted from Android Settings > Accounts > Users & accounts > Work > Remove work profile. The official Google documentation also shows how to remove this locally from the device. 

Alternatively, the “Erase Device” command from Dashboard can be used to remove the Work Profile from devices in bulk:

• Optional: delete the device from Meraki Systems Manager network(s).  

• Re-enroll the Android device based on the user/BYOD enrollment strategy for the new MDM product. Please see the new MDM’s documentation for instructions on enrollment.  

Windows: 

• Uninstall the agent and profile by performing the steps in this guide.  

• Optional: delete the device from Meraki Systems Manager network(s).  

• Re-enroll the Windows device based on the user/BYOD enrollment strategy for the new MDM product. Please see the new MDM’s documentation for instructions on enrollment.