Omnissa macOS Device Management VSaaS

https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/
Admin
Omnissa macOS Device Management VSaaS is a cloud-based device management solution for macOS devices...
Tokens:39,456
Snippets:388
Trust Score:10
Update:9 months ago
Show doc for...
Tokens:
Raw
### Check macOS Hub Version for Intune Compatibility

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/PSSOEntra

This bash script checks if the installed 'Workspace ONE Intelligent Hub' version on a macOS device meets the minimum required version (25.11.0) for Intune Company Portal registration. It reads the version from the application's Info.plist file and compares it against the minimum version. The script outputs whether the Hub is compatible or not.

```bash
#!/bin/bash

APP_PATH="/Applications/Workspace ONE Intelligent Hub.app"
INFO_PLIST="$APP_PATH/Contents/Info.plist"
MIN_VERSION="25.11.0"

# Read the version from Info.plist
APP_VERSION=$(/usr/bin/defaults read "$INFO_PLIST" CFBundleShortVersionString 2>/dev/null)

if [ -z "$APP_VERSION" ]; then
    echo "Unable to read Hub version."
    exit 1
fi

# Function for version comparison
version_ge() {
    # returns true if $1 >= $2
    [ "$(printf '%s\n%s' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

# Check version
if version_ge "$APP_VERSION" "$MIN_VERSION"; then
    echo "Workspace One Intelligent Hub is COMPATIBLE for ICP registration"
else
    echo "The current Workspace One Intelligent Hub version : $APP_VERSION is NOT COMPATIBLE for ICP registration"
fi

```

--------------------------------

### Rotate Recovery Key Via API

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/FullDiskEncryptionwithFileVault

This API endpoint allows administrators to initiate the rotation of the FileVault Personal Recovery Key (PRK) for a specified device. It is recommended to call this API after retrieving the recovery key using one of the GET endpoints.

```APIDOC
## POST /devices/{deviceId}/commands?command=RotateFileVaultKey

### Description
Initiates the rotation of the FileVault Personal Recovery Key (PRK) for the specified device. This API should be used after retrieving the current recovery key.

### Method
POST

### Endpoint
/devices/{deviceId}/commands

### Parameters
#### Path Parameters
- **deviceId** (string) - Required - The unique identifier for the device for which to rotate the recovery key.

#### Query Parameters
- **command** (string) - Required - Must be set to `RotateFileVaultKey` to trigger the recovery key rotation.

### Response
#### Success Response (200)
- **commandId** (string) - The unique identifier for the command issued.
- **status** (string) - The status of the command execution (e.g., 'Queued', 'Success', 'Failed').

#### Response Example
```json
{
  "commandId": "<your_command_id>",
  "status": "Queued"
}
```
```

--------------------------------

### Retrieve Recovery Key via API

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/FullDiskEncryptionwithFileVault

These GET APIs are used to retrieve the security information of a device, including the recovery key. Note that automatic rotation is not triggered via these API calls.

```APIDOC
## GET /devices/security

### Description
Retrieves the security information of the device identified by device ID.

### Method
GET

### Endpoint
/devices/security

### Parameters
#### Query Parameters
- **id** (string) - Required - The unique identifier for the device.

### Response
#### Success Response (200)
- **recoveryKey** (string) - The FileVault Personal Recovery Key.
- **lastRotated** (string) - Timestamp of the last key rotation.

#### Response Example
```json
{
  "recoveryKey": "<your_recovery_key>",
  "lastRotated": "2023-10-27T10:00:00Z"
}
```

## GET /devices/{id}/security

### Description
Retrieves the security information of the device identified by device ID.

### Method
GET

### Endpoint
/devices/{id}/security

### Parameters
#### Path Parameters
- **id** (string) - Required - The unique identifier for the device.

### Response
#### Success Response (200)
- **recoveryKey** (string) - The FileVault Personal Recovery Key.
- **lastRotated** (string) - Timestamp of the last key rotation.

#### Response Example
```json
{
  "recoveryKey": "<your_recovery_key>",
  "lastRotated": "2023-10-27T10:00:00Z"
}
```

## GET /devices/{uuid}/security/recovery-key

### Description
Retrieves the recovery key by the device UUID.

### Method
GET

### Endpoint
/devices/{uuid}/security/recovery-key

### Parameters
#### Path Parameters
- **uuid** (string) - Required - The Universally Unique Identifier for the device.

### Response
#### Success Response (200)
- **recoveryKey** (string) - The FileVault Personal Recovery Key.
- **lastRotated** (string) - Timestamp of the last key rotation.

#### Response Example
```json
{
  "recoveryKey": "<your_recovery_key>",
  "lastRotated": "2023-10-27T10:00:00Z"
}
```
```

--------------------------------

### Check Out Device to User API

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/EnrollmentOverview

This section details the API endpoint for checking out a device to a user, as used in Workspace ONE UEM.

```APIDOC
## PATCH /api/mdm/devices/{id}/enrollmentuser/{enrollmentuserid}

### Description
This endpoint allows for checking out a device to a specific enrollment user within Workspace ONE UEM.

### Method
PATCH

### Endpoint
/api/mdm/devices/{id}/enrollmentuser/{enrollmentuserid}

### Parameters
#### Path Parameters
- **id** (string) - Required - Workspace ONE UEM Device ID
- **enrollmentuserid** (string) - Required - Workspace ONE UEM Enrollment User ID

#### Query Parameters
None

#### Request Body
None

### Request Example
None

### Response
#### Success Response (200)
None specified. Typically, a successful PATCH operation returns a 204 No Content or a representation of the updated resource.

#### Response Example
None specified.
```

--------------------------------

### Get Socket Filter Requirement using codesign (macOS)

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/ProfilesOverview

This command-line utility is used to retrieve the designated requirement for a filter data provider system extension on macOS. It's essential for configuring socket filtering within a content filter profile.

```bash
codesign --display -r - /path/to/app/binary
```

--------------------------------

### Open Keychain Access Utility using Terminal

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/FullDiskEncryptionwithFileVault

This command opens the Keychain Access application on macOS, which is necessary for adding and managing keychains. It ensures the utility is ready to accept the FileVaultMaster keychain.

```bash
open /Applications/Utilities/Keychain\ Access.app/
```

--------------------------------

### Device Data Collection Options

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/macOSDeviceManagement

These options represent different levels of data collection for device management. They indicate whether data should be collected and displayed, or if collection should be omitted entirely.

```text
-   Collect and Display.
-   Collect Do Not Display.
-   Do Not Collect.
```

--------------------------------

### Create FileVault Master Keychain using Terminal

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/FullDiskEncryptionwithFileVault

This command creates a FileVault master keychain on a macOS computer (10.13+). You will be prompted to set a password for the keychain. Ensure this password is securely stored.

```bash
sudo security create-filevaultmaster-keychain /Library/Keychains/FileVaultMaster.keychain
```

--------------------------------

### Verify Platform SSO Registration Status

Source: https://docs.omnissa.com/nl-NL/bundle/macOS-Device-ManagementVSaaS/page/PSSOEntra

This bash script checks the Platform SSO (PSSO) registration status for the currently logged-in console user on a macOS device. It retrieves the AltSecurityIdentities attribute from the user's directory record and extracts the PSSO status. The script outputs the status in an XML format suitable for integration with MDM solutions and handles cases where no user is logged in or the user is not found. It uses strict error handling and logs diagnostics to stderr.

```bash
#!/usr/bin/env bash
# Copyright © Omnissa, LLC. All rights reserved.
# Check Platform SSO (PSSO) registration for the current console user
# - Uses strict mode and pipefail to correctly capture errors in pipelines
# - Provides clear XML <result> output for integrations (Jamf/MDM/etc.)
# - Accepts optional username argument for testing
# - Logs errors to stderr and returns meaningful exit codes
set -euo pipefail
IFS=$'\n\t'
prog_name="$(basename "$0")"
# Print to stderr for diagnostics
log_err() {
    printf '%s: %s\n' "$prog_name" "$1" >&2
}
# Print XML result to stdout (keeps single-line result for MDM)
print_result() {
    printf '%s\n' "<result>$1</result>"
}
# Usage helper
usage() {
    cat <<EOF
Usage: $prog_name [optional_username]
If no username is provided the script will detect the current ConsoleUser.
EOF
}
# Trap unexpected errors
trap 'log_err "An unexpected error occurred."; exit 2' ERR
# Allow optional username (useful for testing)
if [[ ${#@} -gt 1 ]]; then
    usage
    exit 1
fi
if [[ ${#@} -eq 1 ]]; then
    currentUser="$1"
else
    # Detect the logged-in console user (excluding loginwindow)
    currentUser=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" \
        | /usr/bin/awk -F': ' '/[[:space:]]+Name[[:space:]]:/ { if ($2 != "loginwindow") print $2 }' 
        || true)
    # If empty, no user is logged in
    if [[ -z "$currentUser" ]]; then
        print_result "No user logged in"
        exit 0
    fi
fi
# Read the AltSecurityIdentities attribute and extract PlatformSSO (PSSO) value
# Use set -o pipefail above so failures in either dscl or awk are captured
pssoe_status=$(/usr/bin/dscl . -read "/Users/$currentUser" dsAttrTypeStandard:AltSecurityIdentities 2>/dev/null \
    | /usr/bin/awk -F'SSO:' '/PlatformSSO/ { gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2 }' 
    || true)
# If dscl failed (no such user or other error) then pssoe_status will be empty.
# But we can explicitly check whether the user exists first to give a clearer message.
if ! /usr/bin/id -u "$currentUser" >/dev/null 2>&1; then
    print_result "User $currentUser not found"
    exit 1
fi

```
Tokens:
Raw