Part 2: Customize your onboarding experience with Jamf Setup Manager

In the first part of this blog, I explored the new Automated Device Enrollment (ADE) feature for Packages and Profiles released in Jamf School. If you’re unfamiliar with ADE or how we leverage packages and profiles to deploy critical apps during the Initial Setup phase take a moment to read that and rejoin us to discover how to use Jamf Setup Manager to supercharge your onboarding experience through customization.

But before we delve right in, let’s take a moment to discuss onboarding tools that have been or might even continue to be part of your onboarding workflows.

Legacy onboarding tools

An all-too-common scenario during the onboarding phase is to hold the end-user at a screen until all the apps, configurations and settings they need are installed. While it’s important to ensure that the system is “fully built” according to the user’s needs, the amount of time the process takes could leave users in limbo while everything gets baked in. How much time depends on variable factors like:

• Number and size of apps deployed
• Speed of the internet connection
• Response times to prompts requiring input

Simply put: a lengthy onboarding process plus little to no status feedback provided to the user equates to a less-than-stellar onboarding experience. Furthermore, without any information as to what’s happening, users may be prone to contacting IT for support or erroneously quitting a process believed to be stalled before it’s completed, leading to potentially greater delays.

To tackle this problem, many solutions for MacAdmins exist to give feedback to users while onboarding. For a long time, DEPNotify was the tool commonly used by MacAdmins. In fact, Jamf Connect even has an "onboarder" capability that can be configured if you really want to dig deep into the configuration. More recently, the tool of choice became swiftDialog, as it's a bit more configurable and built using the modern programming language, Swift. 

Typically, these tools require the user to log in before holding them at a display screen explaining what is being configured, installed, or set up. While certainly a step in the right direction, the reality is that by the time a user logs in, they expect to be able to get to work right away. 

Wouldn’t it be ideal if the onboarding process occurred before users were even asked to complete the Setup Assistant?

For that to happen though, we'd need to deploy the tool during enrollment. For example, at the Remote Management screen. Well, we know that with ADE Packages and Profiles, admins can do precisely that. From there, we'd need a tool that can run at Setup Assistant.

Enter Jamf Setup Manager.

What is Jamf Setup Manager?

Jamf Setup Manager (JSM) is a native Swift app designed to specifically to simplify the macOS onboarding workflow. It runs right after the Remote Management screen but before a user interacts with any Setup Assistant panes.

JSM is easy to deploy, with just a single package, and is completely controlled by a configuration profile. Almost every element can be customized – from icons and backgrounds to text and apps being monitored.

Jamf Setup Manager is part of Jamf Concepts, featuring tools developed and designed by Jamf employees. Each of these tools acts as a plugin that’s useful across the Jamf ecosystem. The collection of useful solutions includes:

• Admins tools
• End-user tools for macOS and iOS
• Data integrations
• Security enhancements

From a Jamf School point of view, JSM can perform many actions, such as:

• Install apps using Installomator (which is built into Jamf Setup Manager)
• Check to see if a file exists in a file path (known as a watch path)
• Present a user with a wait tile for a given time with customized text and icons

Each action is completed before moving on to the next action in a sequence, complete with a progress bar, displaying visual feedback as to the status of a process.

Install apps using Installomator

Installomator is a popular app in the MacAdmin community. The app is simply a script (although the script itself is far from simple) that can be run in the command line. When run, it downloads and installs an ever-growing catalog of apps directly from the respective developer’s website. To maintain app integrity, checks are in place to ensure that the pkg downloaded from the vendor has not been tampered with.

Scripting made simple

The tool is easy to use – even if you have little to no experience with scripts or the command line – you’ll find it lends itself naturally to scripting.

But that’s not all!

The best part of JSM is that it takes away any need to work with scripts or the command line, making it even more accessible for Jamf School admins. It achieves this by utilizing something that is much more familiar and easier to deploy: configuration profiles. The Jamf Setup Manager tool performs all the heavy lifting by interacting directly with Installomator. Admins simply need to list the apps they wish to install.

Trigger actions with Watchpath

A Watchpath action checks to see if a given item (such as an app) exists in a given file path. If it does not, it waits for a predetermined time before checking again. This process is repeated until the item exists or it times out and moves on to the next action.

This is perfect for checking apps that are delivered via VPP, Jamf Schools in-house macOS apps or those delivered by App Installer. Since these types of deployments are based on the MDM framework, an admin is not able to trigger the installation at a certain point or wait until a desired app is installed to then trigger the next one.

Instead, a Watchpath checks if that app has already been installed by its mechanism. It's important to note that, unlike an Installomator action, JSM is not installing apps – only providing the user feedback that a given app is ready to go or currently installing. If an app fails, the usual troubleshooting steps for that method apply.

Watchpaths are not limited to just apps. Since it simply looks to see if an item exists in any specified path – be it a PDF, JPG or hidden TXT file. For example, let’s say an admin wants to display a wallpaper with the school’s branding and the JPG is delivered in a pkg using "in-house macOS apps," they can use Watchpath to check that this JPG is on the device before users log in for the first time.

Freeze time with Wait Tile

A Wait Tile, well....waits! It’s a tile that displays a custom icon and text, and stays as the active action for a time chosen by the admin. As an example, I enjoy using a Wait Tile to inform users that apps are going to be installed before using the Installomator action and then again afterward to inform the user that the next steps in the workflow are to check on App Store installations. I set them for a few seconds before moving on to the next action. The Wait Tile itself does not perform any action, simply hold the UI for a set amount of time.

To review in-depth user and configuration guidance, be sure to view the user guide on the Jamf Setup Manager GitHub. The developer that created JSM also discusses use case examples, and at the end of the post, you’ll be able to see an end-to-end user experience of using Jamf Setup Manager, Jamf School and Automated Device Enrollment Packages and Profiles.

Creating a workflow for Jamf Setup Manager

Before we dig in here, let’s consider what we are trying to accomplish:

• Have the user power on a Mac device
• Go through the welcome screen
• Connect to Wi-Fi
• Enroll the device into Jamf School
• Jamf Setup Manager takes the user through onboarding
• User arrives at the Jamf Connect login screen and authenticates using IdP credentials
• User arrives at the Desktop with all apps and configurations necessary to get to work

Jamf Connect

Jamf Connect is still in the mix here. In the first part of the blog, we saw how to configure Jamf Connect in the ADE Packages and Profiles section. Given that we can add up to five packages and profiles, do we simply add the JSM pkg and profile, as well as all the Jamf Connect configurations? As the admin, you certainly could do that. But remember that Jamf’s guidance for developing a seamless onboarding workflow recommends that “ADE packages should be reserved for critical items needed for the next step in the onboarding workflow, and they should be lightweight enough that they do install fast and before the device is released from the Remote Management screen."

Bearing this in mind, we’d place Jamf Setup Manager as the first ADE Package, which would, in turn, be used by the workflow to install Jamf Connect as one of its actions during onboarding.

Other apps and items

When creating a workflow for Jamf Setup Manager, it's important to think about all of the actions that you want to perform and to remember that JSM does not install all items. It is a good idea to make a list of apps that will be installed via Installomator (via JSM) and the other things you want to monitor.

Jamf Setup Manager is controlled via a configuration profile, which is where you add the actions. Take the example of checking if Apple Pages has been installed as an action. Pages is a VPP application, so is not installed by Installomator, therefore we would use a Watchpath action.

Since Watchpath will only check to see if /Library/Applications/Pages.app exists, we must install Pages the conventional way by scoping the content to a group within Jamf School. This is also the case with in-house macOS apps or App Installers deployments. Understanding that just because you've added an action to the configuration profile doesn't mean that JSM is actually installing the item. As such, take the time to understand what you want to display to the user and scope apps and pkgs via Jamf School, as needed.

Configuration Profiles

As above, configuration profiles should be scoped to devices via Jamf School JSM is in no way responsible for delivering or checking these. When creating the workflow, it is important to ensure your device group delivers the correct configurations to the target devices in the same way you would if you were not using Jamf Setup Manager.

How to configure a JSM workflow with Jamf School

Much like with the Jamf Connect workflow previously discussed, there was a workflow available to install Jamf Setup Manager in Jamf School before now, however, it was overly complicated.

Now that Jamf School can install packages and profiles at enrollment, this process is much simpler and robust for admins while providing a better experience for the end user.

Before an admin can configure a workflow in Jamf School, they must first obtain the JSM app and create the configuration profile that will control its behavior.

Deploying the Jamf Setup Manager app

To get the latest version of Jamf Setup Manager, visit the Releases page of the Jamf Setup Manager GitHub. Once you have the pkg, it needs to be uploaded to Jamf School as an "in-house macOS app,” which can be done by:

1. Log onto Jamf School.
2. Go to Apps | Inventory.
3. Click on the “+” to add app.
4. Select “Add in-house macOS Package.”
5. Navigate to the downloaded Jamf Setup Manager Package and drag it into the window.
6. Once uploaded, click Save (no need to scope anything at this point).

Creating the JSM Configuration Profile

The Jamf Setup Manager configuration profile will be different for each use case and should be built to suit the unique needs of your workflow.

There are many actions and configurable items available for Jamf Setup Manager, which are well documented within the Configuration Profile page.

Note: There are a number of actions that can be performed that are only available for Jamf Pro, these are clearly labeled in the documentation.

To help you get started on creating a configuration profile, there is a sample profile that an admin can download from GitHub. This sample profile can be edited using the text editor of your choice. If you'd prefer to maintain the formatting of the .mobileconfig file, iMazing Profile Editor has a community-created payload specifically for Jamf Setup Manager which enables you to create a profile using a user-friendly GUI.

Once you have customized the configuration profile with your desired actions, it can be uploaded to Jamf School by performing the following actions:

1. Profiles | Overview | Click on +Create Profile.
2. Click Upload Custom Profile, then locate the configuration profile on your system and drag it to the window. Then click Next to upload it.
3. Give the profile a name and a description of what it does, then click Next to proceed.
4. Click Finish to complete the profile creation.
5. Finally, click Save (no need to scope anything at this point).

Create a new ADE profile

Rather than adding a new workflow to a known good setup, it is recommended that you create a new flow in parallel. Therefore, we create a new ADE profile by:

1. Navigating to Profiles | Automated Device Enrolment Profiles | Click +macOS.
2. Fill out the profile as required for your deployment, but do not check the Enable Zero-Touch Setup box.
3. Click Add under profiles and select your Jamf Setup Manager Configuration Profile from the drop-down menu.
4. Click Add under packages and select the Jamf Setup Manager package from the drop-down menu.
5. Next, click Save.
6. The last but crucial step is to scope the ADE profile to the target devices.

Scoping other elements

As discussed above, be sure to scope all other elements to your devices in the regular way which will include profiles and apps included in the JSM profile.

ProTip: Don’t forget to include apps that are still required and any on-demand items that are not included in the JSM profile. If they aren’t scoped, they won’t deploy.

With everything in place, you are ready to enroll a device using your new onboarding workflow.

One more thing…

In basic psychology, the concept of cognitive consistency refers to the idea that people feel more comfortable with what they know because our brains naturally prefer the sense of familiarity as opposed to conflicting information. 

How this applies to your onboarding experience relates to everything we’ve discussed here today: your users feel comfort in things that know (i.e., how long before I can log in to my new MacBook and be productive) versus the unknown (i.e., I’ve been staring at the same screen for the last half hour. Is it stuck? Should I power cycle the device?).

Therefore, pairing the process feedback functionality and customizing the onboarding experience with the school logos or colors contributes to a comfortable, seamless experience for end users. Furthermore, you can design a holistic branded experience that flows beyond the onboarding workflow to the Jamf Connect experience and onto the desktop.

To achieve this, create a package with all required images and icons using a tool like Jamf Composer and upload it to Jamf School. Add this package to your ADE profile as a second package and be sure to reference these images in the correct locations within the Jamf Setup Manager Configuration Profile for a rich, integrated and seamless onboarding experience for all stakeholders.