Hey, everyone.
Welcome to JNUC 2022.
My name is Robert Schroeder
from Insight Enterprises,
Mac engineer over our managed
endpoint services.
Today, I want to talk to you guys
about how to keep your Macs up-to-date
with Microsoft Power Automate.
We'll take a look at our session agenda.
We're going to go over a quick overview
on what this workflow looks like,
how we can build this automation workflow
in Microsoft Power Automate,
how you can make the connection
in Jamf Pro,
and then we'll go over the results
of using this flow.
Now let's go into the overview.
What does this workflow look like?
In Jamf Pro,
a Smart Group Membership Change happens.
That data is sent to Microsoft Power
Automate via a webhook.
Microsoft Power Automate will
process that data
and send a macOS-managed software update
MDM command to our end user devices.
This is done through the Jamf Pro API.
Then the update is processed
on the end user computer,
and then your computer is updated.
I'd like to also talk about
some of the requirements.
To use Microsoft Power Automate
and the features
that we're going to be using,
you need to have a Microsoft Power
Automate Premium per user license.
This is because some of the features
of Microsoft Power Automate
require a Premium license.
We also need a Jamf Pro environment
with an API username and password.
It's important to create a unique
API username and password
specific for this purpose
rather than using an existing Jamf Pro
administrator account.
Some things to keep in mind
are, Macs need to be on macOS 10.11
or later.
And they need to be supervised or enrolled
via a PreStage enrollment.
Our silicon Macs need to have
a bootstrap token escrowed in Jamf Pro
to install updates
without user interaction.
If you do not have
the bootstrap token escrowed in Jamf Pro,
your users will be prompted
for their password.
So let's talk about building
this automation workflow
within Power Automate.
On the right-hand side of your screen,
we have what this completed workflow looks
like within Microsoft Power Automate.
First, we want to sign in
to flow.microsoft.com.
We want to create a new flow,
give this flow a name,
and we want to make sure that we use
our "HTTP request is received" trigger.
We'll go through each one of these steps
to see how this flow is built.
Our first step is our trigger
when a HTTP request is received.
When using this trigger, an HTTP post URL
is automatically generated.
This is the URL that you will send
your Smart Group Membership Change data
from Jamf Pro
to Microsoft Power Automate via a webhook.
We also need to provide a JSON schema
for Microsoft Power Automate
to understand what the data
being sent over is.
This JSON schema is available
in Jamf Pro's webhook documentation.
After we have our trigger set up,
we want to make sure to initialize
a couple variables.
The next three variables are
going to be strings,
and they're going to be our Jamf Pro URL,
our Jamf Pro username,
and our Jamf Pro password.
After we initialize those,
we want to make sure to initialize
our update version variable.
This will also be a string,
but we will intentionally leave it blank
as we will use the flow
to fill this variable at a later time.
Next, we are using an HTTP action
to generate our bearer token.
This is an example of how this will look,
where we are using our Jamf Pro URL
variable in our URI,
and we are using our basic authentication
using our Jamf Pro API username
and our Jamf Pro API password.
Next, we need to gather the response
from our HTTP call.
We're going to initialize a new variable
called bearer token,
and it's going to be a string type.
To gather the actual token value,
we want to use this expression.
We want to gather the body
from our generate bearer token action,
and we want to pull just the token value.
This will ensure that our variable is set
to just our token value.
Next, we want to start looking at sending
our macOS update command.
Now, Smart Group Membership changes
can happen to more than one computer
at a time.
If this happens, we want to make sure
that we process
each computer individually.
For this, we will need to make sure
that we create a for loop.
So here, we're doing
a for each item action–
in this case, computer IDs.
We're gathering the group-added device IDs
from our data that's sent over.
And then we're going to start looking
at what to do for each of those
computer device IDs.
We're going to do another HTTP action
to gather our software updates
from this computer.
We have our Jamf Pro URL.
We specify which computer ID we are going
to be going to.
And we're looking at the section
for software updates.
The current item, in this case,
is our computer ID.
We also want to make sure that we have
our headers available, setting the accept
to application JSON and our authorization
to a bearer token.
Next, we want to have a JSON schema
available so that our data is
organized in a way
that Power Automate can work with it.
So we are going to take our body response
from our HTTP call
and make this schema available to it.
This schema is available in my GitHub
if you wanted to take a look at it
and use it.
But here it is.
Next, because each computer can have
multiple software updates,
we want to make sure that we are
doing a for loop
to find only our macOS-applicable updates.
For instance, a computer can have
both macOS 12.5.1
and Xcode Command Line Tools 13.
When sending the version over
for our macOS update, we want to make sure
that we're sending our 12.5.1 version,
not our 13 from Xcode Command Line Tools.
So we are going to take
our software updates,
and we are going to append them
into our software updates array.
We're going to be pulling the name
and the version into this array.
Next, we're going to use a condition
to find out if the name
of the software update contains macOS.
And if it does, we're going to be setting
our variable for our update version.
Here, we're just going to be pulling in
the version that is sent over.
Once we have our macOS update version
available in our variable,
we want to go ahead and send
our macOS-managed update.
This is an example
of what this would look like.
We have our URI
as our macOS-managed software updates.
We have our headers available.
And in our body is our API call.
We have our device IDs set
to the current item, which, inside of our
for each computer ID loop,
is still the computer ID
that we are working with.
We have our update action as download
and install
and our version set to our update
version variable.
Next, we want to make sure that we are
invalidating our bearer token at the end
of our process.
This will ensure that the token cannot be
used later on.
It's just a nice way to tidy things up
at the end.
Next, we'll be talking about how to make
the connection in Jamf Pro.
In Jamf Pro,
you want to create a new webhook
using the Smart Group
for your software updates to target.
We want to grab the webhook URL
from our step one
in our Power Automate workflow.
Again, that is that unique URL that is
generated when we use that trigger.
Another thing to remember is to replace
all of the %2F characters
with a forward slash.
If you do not do that,
your webhook will not work.
Jamf Pro will not send the data
to your Power Automate workflow.
We also want to make sure that we set
our content type to JSON.
Now, what does this workflow look like
for our results?
When a computer is added to our Software
Updates Available Smart Computer Group,
that group's membership change data
is sent over to Power Automate.
Microsoft Power Automate will parse
the data and then create a Jamf Pro API
call that sends the macOS-managed software
update for our particular version
to that computer.
Then the end user's computer is updated.
If we look in our Jamf Pro admin console,
for this computer, we can see
that there is a macOS Monterey 12.5.1
software update available.
On our end user computer,
we can see that this same update
is available.
When this update becomes available
to the computer, the computer gets added
to the Software Updates Available
Smart Computer Group.
When that computer is added,
that change data is sent over
to Microsoft Power Automate.
If we log into Microsoft Power Automate
to see the results of our flow,
we can see that there are green checkboxes
for every step of our flow.
This means that that step was
processed successfully.
We're going to dive into a couple of these
just to look at how that data
is processed.
For instance, in our condition,
we were looking for only updates
that had macOS.
Our condition was Yes.
So we can see that Power Automate was
able to get the version number
and set that as our update
version variable.
Then Microsoft Power Automate
was able to send an HTTP action
to send our Jamf Pro API call
to update the Mac.
This is an example
of what that looks like.
We can see our device ID is 3.
We can see our update action was
download and install.
And we can see our version was 12.5.1.
In our Jamf Pro admin console,
we can see, under the Management History,
that we have a couple management commands
related to updates.
These were successfully processed,
which means that our Jamf Pro API call
was successful.
Next, on our end user computer,
we can see that the update is downloading.
Once the update has downloaded
and processed, the end user will get
a notification that their computer will
restart in one minute.
Upon restart, the update is applied
and the user can see that their computer
has been updated to the version specified.
Back in the Jamf Pro admin console,
once an inventory is taken,
we can see that, indeed,
the OS has been updated to 12.5.1.
Another thing that I wanted to quickly
talk about is the implementation
of a three-ring deployment strategy
within Jamf Pro
using an extension attribute.
This is something that I thought of
after looking at how Microsoft deploys
its updates with the same strategy.
Using a three-ring deployment strategy,
you, as an admin,
are able to control the flow of an update
and ensure that an update will not break
any existing configurations.
If you'd like to know more about using
a three-ring deployment strategy
within Jamf Pro
and how to implement it
in your own environment, please check out
my blog link below for more information.
Additionally, I wanted to provide
some extra resources that may help you
with understanding how macOS updates
using the MDM commands work.
Here are a list of resources that I used
while researching how to implement this
in my environments.
Thank you very much,
and I hope that you guys enjoy your JNUC.