Access Levels Adjustments

The following changes in BLUE will be implemented:

Level 1

Example Role: End User Support

Access description: Read Only (Ex: read machine name)

• Read access to device details 
• Read access to the enrollment path 

Level 2

Example Role: Device Support

Access description: Unit Impact (non-destructive)

Can perform non-destructive commands, (i.e., sync, restart, lock, renew MDM profile, set activation lock, enable/disable remote desktop, etc.)

• Initiate pre-defined (non-destructive) MDM commands  
• Deploy defined software 
• Set (some) device attributes 
• Read extended device attributes 
• Add/Enroll device objects 
• Read disk encryption keys
• Read recovery keys (Jamf only)
• Look up LAPS passwords (Jamf only)
• Start Jamf RemoteAssist session (Jamf only)
• Modify Static groups (Jamf only)

Level 3

Example Role: SysAdmin (unit & UEM)

Access description: Unit Impact (possibly destructive)

Can perform destructive commands, (i.e., wipe, remove MDM profile, delete site devices(computers/iOS) delete site policies, etc.)

• Define enrollment path 
• Initiate destructive MDM commands 
• Create/update configuration profile 
• Delete unit-level objects, assuming no possibility for service degradation  
• Create/Update/Delete Smart/Static Groups
• Create/Update/Delete Jamf App Installer and AppStore configurations
• Create/Update/Delete Policies with existing scripts and policies

Level 4 (was 3)

Example Role: Senior SysAdmin (unit & UEM)

Access description: Global Impact

Recommended to limit to 1-3 users per unit.

Can upload packages and scripts (and change packages and scripts) that all Penn State units can see

• Package software
• Upload packaged software  
• Manage Printers 
• Manage Scripts 
• Change buildings & departments 
  
  

NOTE: To prevent service degradation, kindly refrain from the following at Level 4:

• Creating policies, profiles, or unit-specific packages and scripts without incorporating your unit prefixes.
• Uploading configuration profiles.
• Packaging UEM/EDM team packaged software UNLESS your unit needs a different license or product version
• Hardcoding unit-specific licenses or other info into scripts.  Pass those as a parameter in the policy as necessary.
• Editing a script (or anything) that your unit didn't create. Submit a request if you believe something should be adjusted or fixed.

Level 5 (was 4)

Example Role: UEM Service Admin 

Access description: Global Impact

• Delete a policy, software group, object, policy, profile 
• Create/change extension attributes (jamf)

Accessibility Improvement on macOS restart notifications

This feature change the window type from "hud" to "utility" so the window will be opaque and more easily readable. The change will also include a window title, Penn State IT.