Meraki Systems Manager agent and app

The agent, the profile and the app

Systems Manager uses two main components, and they do different jobs:

• The MDM management profile provides most of the management: restrictions, settings, wipe and lock commands, app deployment and notifications. It uses each operating system's own management framework and is installed during enrolment. It is used on iOS, iPadOS, tvOS, macOS, Windows and Android.
• The Meraki agent installs like an application on Windows and macOS desktops and runs as a background service. It adds features the profile cannot provide, such as remote desktop, screenshots, a remote command line, process lists, network statistics, power control and installing software packages.

The agent and the profile are not exclusive. Meraki recommends enrolling Windows and Mac computers with both for full functionality. In the dashboard, a device with the agent shows "Last online"; a device with the profile shows "Last check-in"; a device with both shows both.

On phones and tablets there is also the Systems Manager app:

• On iOS and iPadOS the app is optional. It adds GPS location reporting, notifications, monthly cellular data usage, the last SSID and LAN IP, and Backpack for distributing files to users. It can also be used as a way to enrol.
• On Android the Systems Manager app is mandatory: it is installed as part of enrolment, and the enrolment profile can be viewed inside it.

How devices enrol

Enrolment instructions for each platform are in the dashboard under Systems Manager, Add devices. The main methods are:

Two Meraki features make larger rollouts easier. Systems Manager Sentry can use an enrolment SSID on Meraki access points to prompt devices to enrol, and enrolment authentication can require users to sign in before a device joins. For Apple devices, supervision through Automated Device Enrolment unlocks more control than a user-installed profile; Meraki notes that some commands, such as installing OS updates on iOS, need ADE supervision specifically.

Common Systems Manager agent problems and fixes

These are the issues admins most often run into, with the fix Meraki's documentation points to:

• The device enrols into the wrong network. The agent installer is network-specific: it enrols the device into the Systems Manager network it was downloaded from. Download the installer from the correct network.
• The agent will not install. Installation needs local administrator rights on the computer. Use a privileged account, Group Policy or the dashboard's app push to deploy it.
• Remote desktop or screenshots fail on a Mac. Recent macOS versions need Privacy Preferences Policy Control (PPPC) settings that allow the agent to work. Deploy a PPPC profile from Systems Manager.
• Agents are on mixed versions. Set the preferred agent version per network (a specific version or "Latest") under Systems Manager, Configure, General, or set it per device from the device details page; the change applies at the next check-in.
• iPhones and Macs show offline and ignore commands. Check the Apple MDM push certificate. Apple requires it to be renewed every 365 days with the same Apple ID that created it. Creating a new certificate instead of renewing the existing one leaves enrolled devices offline until they re-enrol, so use an Apple ID that belongs to the organisation, not to one person.
• A removed device still has settings and apps. Deleting a device in the dashboard before uninstalling Systems Manager on the device removes management access but leaves profiles, settings and apps behind. Uninstall from the device first; otherwise the device may need a factory reset to clear them.

If you cannot get into the dashboard to fix any of these, see our Meraki dashboard login guide.

Systems Manager lifecycle: what the dates mean

Source: Cisco Meraki's Systems Manager end-of-sale FAQ. Cisco says it is exiting the MDM market. Until 3 June 2029 it says existing customers continue to receive technical support, platform maintenance, security updates and work to keep enrolment and management functioning as operating systems change. Existing contracts are unaffected until end of support, and Cisco says it will automatically issue partial credits, through the original purchasing route, for Systems Manager licences that run beyond the end-of-support date.

So the agent and app keep working for now, but any organisation using Systems Manager needs a plan to move to another MDM before mid-2029.

Planning the move to another MDM

Cisco names Ivanti Neurons for MDM, sold through Cisco's SolutionsPlus programme, as its suggested alternative, and publishes a technical migration guide showing how Systems Manager configurations and policies translate to other MDM platforms. Other MDM platforms are also options. For organisations already on Microsoft 365, Microsoft Intune is often the natural choice.

Whichever platform you choose, the migration work is similar:

1. Inventory devices by platform and ownership (company or personal) and how each was enrolled.
2. Document the profiles, restrictions, Wi-Fi and certificate settings, apps and scripts in use.
3. Rebuild them in the new platform and test with a pilot group.
4. Plan the switch for Apple devices enrolled through Automated Device Enrolment, which are typically reassigned to the new MDM in Apple Business Manager or Apple School Manager.
5. Uninstall Systems Manager cleanly from each device before deleting it from the dashboard.

Forever Group provides mobile device management services, and our Meraki Systems Manager service page covers Systems Manager itself.

How Forever Systems helps

Forever Systems is a Cisco Partner. With Systems Manager now past its last order date, we can help existing users troubleshoot agent and enrolment problems, review what your Systems Manager configuration does today, and plan and carry out a move to another MDM well before support ends.

Contact us to talk about your Systems Manager estate.