Microsoft Autoupdate Script and 10.14 Mojave

[scottlep]

We are doing some testing with 10.14. When our policy to update Office 2016 via the msupdate script runs we receive the following prompt (see screen shot) “jamf“ wants access to control “Microsoft AutoUpdate“. Allowing control will provide access to documents and data in “Microsoft AutoUpdate“, and to perform actions within that app. I clicked OK to allow the process to run. The policy is showing as complete with no errors, but the apps were not updated and I got different output in the logs compared to computers running 10.12-10.13 where no updates were applied even though there are updates available (see other screen shot). I just flushed the policy log to see what happens next time it tries to run.

I just run through System Preferences to see if "jamf" was added to the Security & Privacy>Privacy pane to see if it was given access to Accessibility, Automation, etc....but I don't see it added anywhere.

Any ideas how to avoid this prompt or is it something we will need to live with with the new security in 10.14?

[sdagley]

@scottlep What version of Jamf Pro are you running? 10.7.1 should have the required tcc profile to give the jamf binaries file system access without that prompt.

[scottlep]

@sdagley The JSS and the client are running v10.7.1-t1536934276. This is our dev JSS and a test machine.

Thanks!

[koalatee]

10.7.1 profile does not give the jamf binary access to Microsoft Outlook. You should use the PPPC utility to build a profile for jamf to control Microsoft AutoUpdate

PPPC Util

[anverhousseini]

Do I have to add /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate to the whitelist for that? Seems still happening with Jamf Pro 10.9.0 and the checkbox enabled under Computer Management > Security.

[CypherCookie]

I don't know anyone who uses scripts to set auto-updates for office any more. We now do it via a custom config profile. Have you tried doing it this way?

[burdett]

I'm been having the same issue when using @pbowden's Jamf Pro helper script for controlling Office and Skype updates
Any one have success using the PPPC utility to build a profile for jamf to control Microsoft AutoUpdate? Still trying to figure out how to build profiles with this utility. I saw a discussion this recently with screen shots of the PPPC utility building a profile for jamf to control Microsoft AutoUpdate but now I can't find it.

[pbowden]

@burdett you can pick up both the signed and unsigned mobileconfig for Jamf to control MSUpdate on my GitHub at https://github.com/pbowden-msft/MobileConfigs/tree/master/Jamf-MSUpdate

Hope this helps!

Paul.

[CypherCookie]

Office is now available in the Mac App Store!

[sdagley]

While Office in the Mac App Store is useful for some, I see it as a non-starter in organizations that require testing prior to mass deployment and use msupdate to restrict updates to approved versions. (I don't know of a similar capability for App Store delivered apps)

[jbellez]

I am trying to figure out the mobileconfig, as I think this is what is having an issue.

I'm also seeing the "No result returned from Update Assistant" error, but it is only on mojave machines.

Any idea why this error only appears when running through a Jamf policy?

Running the script alone (even a DIY one I made with 2 commands) will return the same error through Jamf, but is fine when running it through terminal myself as the logged in user.

[pbowden]

@jbellez sounds like you haven’t applied the PPPC config to that machine. It allows the Jamf agent to send Apple Events to MAU
Deploy the profile from Here

[jbellez]

EDIT: Still doesn't work even on a clean machine :( I even tried to install the mobileconfig directly, but it doesn't like it.

@pbowden Just to be sure, this is to be deployed as a config profile correct?

I have tried both files (one at a time of course), but it doesn't seem like it did anything. It still doesn't seem to update my apps, with your script or my own that just calls the msupdate command to trigger all updates.

Here's the log:

[pbowden]

@jbellez what version of MAU is installed on the machine? It needs to be 4.12

[jbellez]

@pbowden it's 4.12. I have a Jamf patch policy that kicks in for machines that don't have the current version. I check the MAU app info for when the version changes manually (I'm purposely starting with the default one used when we deploy our systems 4.2, so we can get the full effect of the upgrade process when we go production with this).

Jamf status always completes quickly and shows that error "No result returned from Update Assistant" for each app, minus the ones not installed.

My quick and dirty script tries to rule out anything funky:

# Word
if [[ ! -e "/Applications/Microsoft Word.app" ]]; then
    echo "Word is not installed"
else
    /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate -i -a MSWD2019
fi

but also returns the same message. I'm kind of stumped at this point... I feel like it's the PPPC stuff, as the symptoms would indicate so.. I'm just thinking maybe Jamf is missing some permissions to execute.

[leegalan]

@jbellez are you still having this issue? If not, how did you resolve it? I'm in the same situation as you.

[jon_verret]

@pbowden is this thread dead? I'm having the same issue and can't find a solution. I've uploaded the PPPC config profile, but that didn't result in any changes to the script results..

[ysdevgan]

@pbowden , all machines running 10.13 or above getting error: ERROR: Cannot send Apple Events to MAU. Check privacy settings

Am using latest PPPC config profile and script from github (https://github.com/pbowden-msft).

[timdsmith72]

I have the same issue. Been beating my head against the wall for days.

[ysdevgan]

I have tried removing (might be good practice or recommendation) CheckAppleEvents function (from line 46 to 52) and also removing CheckAppleEvents (line 115) from script that Paul has shared on GitHub. Here is the logs from a couple of MacBooks :-

Script result: Started - Thu Feb 13 12:23:04 PST 2020
User xxxxxx is logged in
Thu Feb 13 14:23:10 PST 2020
Detecting and downloading updates...
Daemon is busy...
[message repeats 1589 times]
Daemon is busy./Library/Application Support/JAMF/tmp/Microsoft Office Suite Update -WKS testing: line 97: 74464 Terminated: 15 ${CMD_PREFIX}/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate --install --apps $1 --wait 600 2> /dev/null
Finished - Thu Feb 13 19:09:55 PST 2020

Script result: Started - Thu Feb 13 15:22:02 EST 2020
User xxxxxx is logged in
Thu Feb 13 17:39:03 EST 2020
Detecting and downloading updates...
Daemon is busy...
[message repeats 23 times]
No result returned from Update Assistant
Finished - Fri Feb 14 04:27:38 EST 2020

FYI, I have scoped the policy to smart group which has devices running an older version of MS word.

I would appreciate if someone can help or share their experience updating MS office apps via JAMF.

[timdsmith72]

So, for anybody still fighting this:
This worked for me. https://www.jamf.com/jamf-nation/discussions/34787/microsoft-office-for-mac-2019-autoupdate-jamf-trigger

AutoUpdate Fix

[ysdevgan]

Thanks @timdsmith72 , will test it out.