Test: macOS Configuration Profiles

[joshspicer]

Refs: #148942

• macOS @bhavyaus
• macOS @pierceboggan

Complexity: 3

Create Issue

---

This TPI implements device management for macOS.

I suggest you read these docs before continuing to see how the feature works in Windows. For your reference this was the Windows TPI testing the same feature.

❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗
You must use this dev build of Insiders

VS Code Build: c9d6f08

darwin: https://vscode.download.prss.microsoft.com/dbazure/download/insider/c9d6f0899b5d3d8fd6ae46b907216d15c41a0349/VSCode-darwin.zip
darwin-arm64: https://vscode.download.prss.microsoft.com/dbazure/download/insider/c9d6f0899b5d3d8fd6ae46b907216d15c41a0349/VSCode-darwin-arm64.zip

❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗❗

You'll then want to get yourself a .mobileconfig file. These files are XML that encode our policy.

You'll see below that the configuration file has two policies (feel free to customize):

• AllowExtensions => {"github": true, "joshspicer": true, "ms-vscode-remote.remote-ssh": true}
• UpdateMode => Manual

Setup

Save this file to your mac with the name insiders-profile.mobileconfig.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>ConsentText</key>
        <dict>
                <key>default</key>
                <string>This profile manages VS Code settings</string>
        </dict>
        <key>PayloadContent</key>
        <array>
                <dict>
                        <key>AllowedExtensions</key>
                        <string>{"github": true, "joshspicer": true, "ms-vscode-remote.remote-ssh": true}</string>
                        <key>PayloadDisplayName</key>
                        <string>VS Code Insiders (TEST)</string>
                        <key>PayloadIdentifier</key>
                        <string>com.microsoft.VSCodeInsiders.3AD1E08A-673E-4C62-AA68-D43ED8180249</string>
                        <key>PayloadType</key>
                        <string>com.microsoft.VSCodeInsiders</string>
                        <key>PayloadUUID</key>
                        <string>3AD1E08A-673E-4C62-AA68-D43ED8180249</string>
                        <key>PayloadVersion</key>
                        <integer>1</integer>
                        <key>UpdateMode</key>
                        <string>manual</string>
                </dict>
        </array>
        <key>PayloadDescription</key>
        <string>To administer potentially sensitive VS Code settings</string>
        <key>PayloadDisplayName</key>
        <string>Code (TEST)</string>
        <key>PayloadIdentifier</key>
        <string>com.microsoft.VSCodeInsiders_test</string>
        <key>PayloadOrganization</key>
        <string>Microsoft</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadUUID</key>
        <string>9F957DE8-6596-4CD6-A54E-D3A20F2B1C37</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>TargetDeviceType</key>
        <integer>5</integer>
</dict>
</plist>

3. After saving your xxxx.mobileconfig file, open System Preferences on your mac.
4. Go to General > Device Management and add your profile with the +

Testing

Ensure you are testing with commit c9d6f0899b5d3d8fd6ae46b907216d15c41a0349!

Now when you launch the special build of Insiders from above, the policy will take effect.

Here are some screenshots of what to look for in the UI:

Most of the .mobileconfig file is not interesting to edit. Two properties you may want to edit is:

• the JSON value AllowedExtensions
• the enum value UpdateMode

Simply edit the XML with a text editor. You will want to remove previous profiles first and then re-add your new profile just like above. Applying a new profile should be picked up automatically without needing to re-launch VS Code.

Ensure that:

• You see the effect the profile has applied in VS Code
• You cannot circumvent the configuration without uninstalling the profile
• Changes are picked up immediately when updating the profile
• No weird crashes or behavior is observed