Managing Major OS Updates for Mac: VMware Workspace ONE ... · MANAGING MAJOR OS UPDATES FOR MAC: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL DOCUMENT | 3 OT-macOS-Deploy-Major-OS-Upgrade

DOCUMENT – MARCH 2020

PRINTED 3 MARCH 2020

MANAGING MAJOR OSUPDATES FOR MAC:VMWARE WORKSPACE ONEOPERATIONAL TUTORIALVMware Workspace ONE

MANAGING MAJOR OS UPDATES FOR MAC: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL

DOCUMENT | 2

Table of Contents

Overview

– Introduction

– Audience

– Validation Environment

– Prerequisites

Managing Major OS Updates for Mac

– Introduction

– Option 1: Deploying macOS Upgrade from Apple Business Manager

– Option 2: Deploying macOS Upgrade from Workspace ONE Software Distribution

– Option 3: Automatically Updating after macOS Update Downloads

– Option 4: Deploying macOS Upgrade with Repeat User Notifications

Summary and Additional Resources

– Conclusion

– Terminology Used in This Tutorial

– Additional Resources

– About the Authors

– Feedback


DOCUMENT | 3

OT-macOS-Deploy-Major-OS-Upgrade

OverviewIntroductionOn macOS, deploying major OS updates (for example, macOS 10.14 Mojave to macOS 10.15 Catalina) is best handled as a two-step process:

Deploy an Install macOS {name}.app file to the end user’s device.1.Run the installer with various parameters to update the device. 2.

Depending on the level of automation, user approval, and network considerations that you want, there are different ways toapproach each of these steps. In some cases, you may decide to handle both steps in a single automated flow. In other cases,you may decide to deploy the install app first but provide the user some flexibility on when and how to update the device.

This tutorial walks through several deployment scenarios and demonstrates how to configure VMware Workspace ONE® UEM toupgrade a fleet of macOS devices (such as from 10.14 to 10.15).

AudienceThis operational tutorial is intended for IT professionals and Workspace ONE administrators of existing production environments.Both current and new administrators can benefit from using this tutorial. Knowledge of additional technologies such as scripting,Apple Business Manager and VMware Workspace ONE® UEM is also helpful.

Validation EnvironmentThe content created for this operational tutorial used the following software and hardware versions for testing:

Workspace ONE UEM version 2001Workspace ONE Intelligent Hub version 2001Apple hardware compatible with the macOS upgrade

The content in this tutorial may be applicable to earlier Workspace ONE UEM and Hub versions but this was not specifically tested.

PrerequisitesThere are many different ways you can approach deploying major macOS updates to end-user devices through Workspace ONE. Inany of the methods discussed in this tutorial, the first step is to create a smart group that only targets devices that are not yet onthe target OS version. This way, you can assign the appropriate apps and packages to those target devices, and you will avoidupdating any devices that have already run through the update process.

When defining your smart group, make sure to specify the Platform and Operating System that includes Apple macOS deviceswith an OS version less than the target version. Beyond that, feel free to include any additional filters in the smart group to targetthe appropriate devices.

1. Add Smart Group

https://www.vmware.com/products/airwatch-enterprise-mobility-management.html

https://www.vmware.com/products/airwatch-enterprise-mobility-management.html


DOCUMENT | 4

Click Groups & Settings.1.Expand Groups.2.Click Assignment Groups.3.Click Add Smart Group.4.

2. Create New Smart Group


DOCUMENT | 5

Enter a Smart Group Name (such as Pre-Catalina).1.Expand Platform and Operating System.2.Select Apple macOS | Less Than | macOS Catalina 10.15.0.3.Optionally, click Enabled to preview a list of devices targeted by this Smart Group.4.Click Save.5.

Managing Major OS Updates for MacIntroductionOne of the easiest ways to get the macOS Update Installer is to deploy the app through Apple Business Manager, which can beintegrated with Workspace ONE. The installer app distributed through Apple Business Manager, which we refer to in this documentas the online installer, is very lightweight (approximately 20 MB for macOS Catalina), and can be installed with minimal issueseven on devices with unreliable network connections.

This online installer downloads the rest of the software required (approximately 8 GB) after the update is initiated, and can takeadvantage of Apple content distribution servers and Apple Caching services to do so. In Apple Business Manager, find the macOSCatalina installer. Make sure the purchased quantity is greater than the total number of devices you will deploy theupdate to and make sure that the Apple Business Manager location the licenses are assigned to, matches the correct LocationToken synced into Workspace ONE.

Option 1: Deploying macOS Upgrade from Apple Business ManagerDepending on the path chosen to plan the upgrade, you may need to distribute the Installer bundle directly from the App Store.This allows Workspace ONE administrators to leverage the power of Apple's Content Distribution network to help deliver theupgrade bits globally. Also, leveraging the App Store and macOS Caching Services helps reduce upgrade-related WAN traffic.


DOCUMENT | 6

1. Purchase macOS Upgrade Installer in Apple BusinessManager

Click Apps and Books.1.Search for the OS Upgrade, for example, macOS Catalina.2.Select the OS Upgrade in the results list. 3.Select the ABM Location that is synced with Workspace ONE. 4.Enter the Quantity of licenses needed. 5.Click Get to purchase the licenses. 6.

2. Sync Purchased macOS Upgrade App to WorkspaceONE


DOCUMENT | 7

In the Workspace ONE UEM Console, click Apps & Books.1.Expand Applications. 2.Click Native.3.Select Purchased.4.Click Sync Assets.5.When the sync completes, the app purchased in the previous section should appear in the app list view. 6.

3. Enable Device Assignment for macOS Upgrade


DOCUMENT | 8

From the app list view, select the macOS Catalina app. 1.Click Enable Device Assignment.2.Click OK.3.Click Save & Assign then click Add Assignment.4.

4. Assign to Pre-Catalina Devices


DOCUMENT | 9

Select the Smart Group created in the Prerequisites.1.Change the Allocated number to the appropriate value based on the total purchased licenses. This should be at least the2.amount of devices you are deploying the update to. Set the Assignment Type to Auto.3.Click Save.4.Click Save and Publish then click Publish.5.

Note: Workspace ONE administrators may also elect to set the Assignment Type to On-Demand. This advertises the availabilityof the installer to the user but does not automatically force the installer to download. Rather, the user must choose to install theinstaller from their App catalog to initiate installer download.

5. User Experience


DOCUMENT | 10

If the app is distributed through the Volume Purchase Program (VPP), the user will receive a notification after the app installs onthe device. In reality, the install is simply a software download triggered by Workspace ONE UEM against Apple Business Managerand the device. Rather, the user must execute the Install macOS Catalina.app application when they are ready to performthe upgrade. The native OS Upgrade Wizard will walk them through the process.

Option 2: Deploying macOS Upgrade from Workspace ONE Software DistributionInstead of deploying the online macOS Upgrade Installer directly through Apple Business Manager, Workspace ONE administratorscan choose to deploy it through Workspace ONE software distribution. Using this method provides additional capabilities incustomizing the deployment, including a better user experience.

1. Complete Prerequisites for Option 2Follow the instructions in Option 1: Deploying macOS Upgrade from Apple Business Manager to deploy the installer to a1.single administrative Mac.Install the VMware AirWatch Admin Assistant app on the same Mac.2.

2. Prepare the OS Installer with VMware AirWatch AdminAssistant

https://awagent.com/AdminAssistant/VMwareAirWatchAdminAssistant.dmg


DOCUMENT | 11

On the target device, open Finder and navigate to the /Applications/ folder. 1.Find the Install macOS Catalina.app application. 2.Open the VMware AirWatch Admin Assistant application. 3.Drag the Install macOS Catalina.app file from the Finder window onto the VMware AirWatch Admin Assistant4.application.

3. Reveal VMware AirWatch Admin Assistant Output


DOCUMENT | 12

When parsing is complete, a pop-up window appears. Select Reveal in Finder.1.Verify that three files have been created: a .plist, a .dmg, and an image.2.

Note: By default, the plist contains a generic Install macOS name for the package/installer. Workspace ONE administrators canmanually specify the install name by changing the name value in the plist:

4. Add Internal App


DOCUMENT | 13

In the Workspace ONE UEM Console, click Apps & Books.1.Expand Applications and click Native.2.Click Add Application on the Internal tab.3.

5. Upload macOS Application to Workspace ONE


DOCUMENT | 14

Click Upload.1.Click Choose File, browse to and select the dmg file output by VMware Admin Assistant and click Choose.2.Click Save.3.Click Continue.4.

6. Upload Metadata File


DOCUMENT | 15

Click Upload. 1.Click Choose File. Navigate to the folder containing the files exported from the VMware AirWatch Admin Assistant. Select2.the .plist file and click Choose.Click Save. 3.Click Continue.4.

7. Add Image to App


DOCUMENT | 16

Select the Images tab. 1.Select Click or drag files here. Navigate to the folder containing the files exported from the VMware AirWatch Admin2.Assistant. Select the image file. Click Save & Assign.3.

8. Assign the Application On-Demand


DOCUMENT | 17

Click Add Assignment.1.Select the Smart Group created in the Prerequisites. 2.Set the App Delivery Method to On Demand.3.Set Display in App Catalog to Show. 4.Set Desired State Management to Disabled.5.Set Remove on Unenroll to Disabled.6.Click Add.7.Click Save and Publish, then click Publish.8.

9. User ExperienceWith this setup, the Install macOS [version] application appears inside the assigned user’s Workspace ONE Intelligent Hubcatalog. With Hub Services configured, the end-user receives an alert when the app becomes available to them on-demand. Whenthe user selects to install the app, it is placed within the /Applications/ folder, just as if it was deployed directly through AppleBusiness Manager.

Similar to Option 1, this does not auto-launch the upgrade. Rather, the user must still launch the upgrade app installed to the/Applications/ folder.

https://media.screensteps.com/image_assets/assets/003/160/845/original/b8a66cda-d2f7-4e32-adc3-d1982c675e9f.png


DOCUMENT | 18

However, one advantage of using Workspace ONE software distribution to deploy the macOS Upgrade Installer itself, is that itallows further customization of the upgrade process through the use of scripting, which can be configured in the Scripting tabwithin the application configuration. This will be discussed in the following sections.

Option 3: Automatically Updating after macOS Update DownloadsFor Option 3, a Workspace ONE administrator aims to deploy the macOS Upgrade Installer to the target device, and then toautomatically initiate the upgrade without any further user interaction. Background information about the startosinstallcommand in the macOS installer is included in the first section—Understand the startosinstall Command.

1. Understand the startosinstall CommandThis section discusses the startosinstall command.

1.1. What is startosinstall?

startosinstall is a command line utility built into the macOS installer which performs scripted OS upgrades. The commandsupports a few flags which control the behavior of the upgrade. The most commonly used flags include:

--nointeraction : Bypasses standard user prompts during upgrade process. --agreetolicense : Automatically agree to the macOS installer license. --eraseinstall : Erases the current OS install, including any user files. --forcequitapps : Force quits any apps that could halt the restart process. --usage : Lists out all available arguments.

Note: The –eraseinstall argument should never be used in cases where you want to preserve the file system on the machine.Only use this flag in cases requiring a factory fresh volume after the upgrade. When the online installer is used, initiating thestartosinstall command (particularly with the –nointeraction tag), will first download the remaining upgrade files beforeinitiating a reboot to complete the upgrade process.

1.2. Where is startosinstall?The startosinstall command is only available when a macOS installer application has been delivered to the device. Find theutility at /Applications/Install macOS Catalina.app/Contents/Resources/startosinstall.

1.3. How Long Does startosinstall Take?The startosinstall command could take anywhere from 15 minutes or longer before the reboot occurs. The timing andexperience depends on a few different factors:

A device’s network connection, such as Wi-Fi versus Ethernet.A device's Internet connection speed (when components are downloaded from Apple's CDN and not from a local, on-network caching server).The arguments used as users may not be directly notified when the reboot is about to occur if the nointeraction flag is


DOCUMENT | 19

used.

2. Complete Prerequisites for Option 3Start by following Option 2 until Step #7. After uploading the app icon, follow the next step—Step 3: Configure Post-Install Script inWorkspace ONE.

3. Configure Post-Install Script in Workspace ONE

Select the Scripts tab1.Paste the following script into the Post Install Script section2.Click Save & Assign3.

#!/bin/sh

if [[ $(sw_vers -productVersion) != *"10.15"* ]]; then

/Applications/Install\ macOS\ Catalina.app/Contents/Resources/startosinstall –-agreetolicense --nointeraction

fi


DOCUMENT | 20

Note: The previous example is making use of the –-agreetolicense and –-nointeraction arguments to bypass all userinteraction of the upgrade.

4. Assign the Application On-Demand

Click Add Assignment.1.Select the Smart Group created in the Prerequisites. 2.Set the App Delivery Method to Auto.3.Set Display in App Catalog to Show.4.Set Desired State Management to Disabled.5.Set Remove on Unenroll to Disabled.6.Click Add.7.Click Save and Publish, then click Publish.8.

5. User ExperienceThe Post Install Script executes as soon as the .dmg file is fully installed. With this setup, the Install macOS [Version]application appears inside the assigned user’s Workspace ONE Intelligent Hub catalog. When the user selects to install theapp, Workspace ONE immediately begins the upgrade process, including restarting the machine, without additional userinteraction.

If the Deployment Type is set to Automatic in Step 3, the upgrade is deployed to and performed on all assigned devices withoutany user interaction at all. This can be useful when you know devices are not actively in use, or if you can no longer allow endusers the ability to defer the upgrade. Note that if this approach is taken, users will not be notified to save their current progresswithin active apps before the reboot occurs.

https://media.screensteps.com/image_assets/assets/003/160/887/original/65b7e2e4-c67f-4c7b-adc1-0b88b448532c.png


DOCUMENT | 21

Option 4: Deploying macOS Upgrade with Repeat User NotificationsIn this option, the goal is not to directly initiate the OS Upgrade without any user interaction at all, but to leverage notifications toencourage end users to perform the upgrade when ready. A great way to support the use of periodic notifications is through theCustom Attributes profile payload.

A script included as a Custom Attribute will run either on a pre-defined schedule or after certain events (such as a user login). Byincluding a hubcli notification as part of a Custom Attribute, you can occasionally ask users to initiate the upgrade, without forcingthem to do so. For example, Option 4 creates a Workspace ONE notification asking the users to upgrade, and also store the currentOS version in the defined custom attribute.

1. Complete Prerequisites for Option 4To begin, a Workspace ONE admin should deploy the macOS Upgrade Installer using the Automatic deployment type as outlined ineither Option 1 or Option 2. This downloads the installer on the end-user devices, but does not initiate the upgrade. From thispoint, the remaining steps provide detail on how to create a notification that regularly prompts users to initiate the upgrade.

2. Add New Profile to Workspace ONE

In the Workspace ONE UEM Console, click Devices.1.Expand Profiles & Resources and click Profiles.2.Click Add.3.Click Add Profile.4.

3. Select Profile Platform and Context


DOCUMENT | 22

Select Apple macOS.1.Select Device Profile. 2.

4. Configure General macOS Device Profile Settings

https://media.screensteps.com/image_assets/assets/003/162/272/original/0440659c-ed2d-461a-ae91-6e7d3fbba68c.png


DOCUMENT | 23

In the General tab, enter a Name for your profile, such as macOS Upgrade Check. 1.Ensure the Assignment Type is Auto.2.Select the Smart Group created in the Prerequisites. 3.

5. Configure Custom Attributes Payload


DOCUMENT | 24

Select the Custom Attributes payload from the list and click Configure.1.Enter an Attribute Name such as macOS Upgrade Check. 2.Paste the following code into the Script/Command section:3.

#!/bin/sh if [[ $(sw_vers -productVersion) != *"10.15"* ]]; then /usr/local/bin/hubcli notify -t "Upgrade to macOS Catalina" -s "This may take upto 1 hour." -i "Your machine will restart automatically." -a "Begin" -b"/Applications/Install\ macOS\ Catalina.app/Contents/Resources/startosinstall --agreetolicense --nointeraction" -c "Cancel" fi sw_vers -productVersion

Note: Customize the text and behavior of the hubcli command as needed, including any modifications to the startosinstallcommand.

Set the Execution Interval to Schedule.1.Set Report Every to 8 Hours.2.Click Save and Publish, then click Publish.3.


DOCUMENT | 25

6. User Experience

In this example, the user receives the notification to upgrade once every 8 hours. If they select Begin, the upgrade initiates,including the reboot, without any further user interaction.

Summary and Additional ResourcesConclusionThis operational tutorial provided four different deployment scenarios and demonstrated how to configure Workspace ONE UEM toupgrade a fleet of macOS devices.

The deployment options included:

Deploying macOS upgrade from Apple Business ManagerDeploying macOS upgrade from Workspace ONE software distributionAutomatically updating when macOS update downloadsDeploying macOS upgrade with repeat user notifications

Check out the Understand macOS Management Activity Path on Digital Workspace Tech Zone.

Terminology Used in This TutorialThe following terms are used in this tutorial:

application store A user interface (UI) framework that provides access to a self-service catalog, public examples of which include the Apple App Store,the Google Play Store, and the Microsoft Store.

auto-enrollment Auto-enrollment simplifies the enrollment process by automatically enrolling registered devices following the Out-of-Box-Experience.

catalog A user interface (UI) that displays a personalized set of virtual desktops and applications to users and administrators. Theseresources are available to be launched upon selection.

cloud Asset of securely accessed, network-based services and applications. A cloud can also host data storage. Clouds can be private orpublic, as well as hybrid, which is both private and public.

device enrollment The process of installing the mobile device management agent on an authorized device. This allows access to VMware products withapplication stores, such as Workspace ONE Access (formerly VMware Identity Manager).

identity provider (IdP) A mechanism used in a single-sign-on (SSO) framework to automatically give a user access to a resource based on theirauthentication to a different resource.

mobile device management(MDM) agent Software installed on an authorized device to monitor, manage, and secure end-user access to enterprise resources.

one-touch login A mechanism that provides single sign-on (SSO) from an authorized device to enterprise resources.

service provider (SP) A host that offers resources, tools, and applications to users and devices.

virtual desktop The user interface of a virtual machine that is made available to an end user.

virtual machine A software-based computer, running an operating system or application environment, that is located in the data center and backedby the resources of a physical computer.

For more information, see the VMware Glossary.

https://techzone.vmware.com/understanding-macos-management

https://techzone.vmware.com/

https://www.vmware.com/support/pubs/


DOCUMENT | 26

Additional ResourcesFor more information about Workspace ONE, explore the VMware Workspace ONE Activity Path. The activity path provides step-by-step guidance to help you level-up in your Workspace ONE knowledge. You will find everything from beginner to advanced curatedassets in the form of articles, videos, and labs.

Additionally, you can check out the VMware Workspace ONE and VMware Horizon Reference Architecture which provides aframework and guidance for architecting an integrated digital workspace using VMware Workspace ONE and VMware Horizon.

About the AuthorsThis tutorial was written by:

Paul Evans, EUC Solution Engineer, End-User Computing, VMwareRobert Terakedis, Senior Technical Marketing Manager, End-User-Computing Technical Marketing, VMware

FeedbackYour feedback is valuable.

To comment on this tutorial, contact VMware End-User-Computing Technical Marketing [email protected].

https://techzone.vmware.com/becoming-workspace-one-hero

https://techzone.vmware.com/resource/workspace-one-and-horizon-reference-architecture

https://techzone.vmware.com/users/paul-evans

https://techzone.vmware.com/users/robert-terakedis

mailto:[email protected]

VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax650-427-5001 www.vmware.com

Copyright © 2019 VMware, Inc. All rights reserved. This product is protected by U.S. and internationalcopyright and intellectual property laws. VMware products are covered by one or more patents listedat http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc.in the United States and/or other jurisdictions. All other marks and names mentioned herein may betrademarks of their respective companies.

Documents

Managing Major OS Updates for Mac: VMware Workspace ONE ... · MANAGING MAJOR OS UPDATES FOR MAC: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL DOCUMENT | 3 OT-macOS-Deploy-Major-OS-Upgrade