Back to All Cheatsheet Libraries cheatsheets

Cisco Meraki Systems Manager

Network-integrated endpoint management — device posture drives network access from the same dashboard as your Meraki switches and APs.

Concept	What it is	Notes
Organization → Network	Meraki's hierarchy. An Organization contains Networks; Systems Manager is a network type alongside wireless, switch, and appliance.	Devices live in an SM network. Getting this structure right early matters — reorganising later is disruptive.
Tags	Labels applied to devices, manually or automatically by rule.	The core scoping mechanism — Meraki's answer to Smart Groups. Profiles and apps target tags.
Security Policies	Compliance rules: encryption, passcode, OS version, jailbreak detection, required apps.	Non-compliance can automatically re-tag a device, which is what feeds network enforcement.
Profiles	Configuration payloads scoped by tag — Wi-Fi, VPN, restrictions, certificates.	Standard Apple/Android/Windows payloads with a GUI, plus custom profile upload.
Sentry Enrollment	Enrolls devices into SM automatically when they join a Meraki SSID.	Genuinely useful in guest/BYOD environments — unmanaged devices get onboarded by connecting.
Sentry Policies	Network access rules that reference SM device posture.	This is the headline integration — see the Network tab.
Systems Manager Agent	Optional agent adding deeper inventory and remote features beyond native MDM.	Required for some Windows/macOS capabilities; native MDM covers the rest.

Define what compliant means

Systems Manager → Security Policies. Set the real requirements: disk encryption on, passcode set, minimum OS, not jailbroken, required security agent present.

Auto-tag on compliance state

Devices failing the policy get tagged automatically. That tag is the bridge between the MDM side and the network side — everything downstream keys off it.

Build a Sentry policy on the SSID

Wireless → Access Control → Sentry. Require SM enrollment and a compliant tag to reach the corporate VLAN; send everything else to a remediation VLAN with access only to the enrollment portal and update servers.

Push Wi-Fi config via Sentry Wi-Fi

SM can deploy the corporate SSID profile with certificates so users never type a PSK. Combined with the above, an enrolled compliant device connects silently and an unmanaged one cannot.

Give non-compliant devices a way out

The remediation VLAN must reach whatever fixes the problem — OS update servers, the enrollment page, your IdP. A quarantine with no escape route just generates tickets.

Meraki SM fits when…

You already run Meraki networking. This is the deciding factor. One dashboard, one support contract, one vendor relationship.
You want device posture to gate network access without deploying a separate NAC product.
Your endpoint requirements are mainstream — enroll, configure, restrict, inventory, wipe.
Education and retail environments where the network and the devices are managed by the same small team.

Look elsewhere when…

You don't run Meraki networking — the integration is the value, and without it you're comparing a mid-tier MDM against specialists.
You need deep macOS management. Jamf and Mosyle are substantially stronger there.
You need tight Entra ID / Conditional Access integration — that's Intune.
Licensing is per-device and stacks on top of network licensing; at scale, model the total cost before assuming bundling saves money.

Gotchas

Licensing is co-termination based

Meraki licences are per-device and co-terminate on a single date across the organisation, so adding devices mid-term is prorated.
If licensing lapses, the dashboard stops managing devices — including your network hardware. This is a harder failure mode than most MDMs.
Track renewal centrally. There is no grace-period equivalent to simply losing MDM check-in.

Apple certificate expiries apply as always

APNs push certificate expires annually — renew with the same Apple ID or re-enroll every Apple device.
ABM/ADE and VPP tokens likewise.
Universal across MDMs; being inside the Meraki dashboard doesn't exempt you.

Tag sprawl gets out of hand fast

Because tags are the only scoping mechanism, environments accumulate dozens of overlapping ones.
Agree a naming convention early — e.g. role-, site-, compliance- prefixes — and document what each one drives.
A tag that both a Sentry policy and a profile depend on should be clearly marked, or someone will delete it.

Don't lock yourself out with Sentry

A Sentry policy requiring compliance can block admin devices too, including the one you're configuring from.
Always keep a management SSID or wired path exempt from Sentry enforcement.
Test on a pilot SSID before applying to production wireless.

Resources

Systems Manager documentation Cisco's official SM guide — enrollment, profiles, Sentry, and troubleshooting. documentation.meraki.com Meraki Dashboard API Full REST API covering both network and Systems Manager objects. developer.cisco.com Sentry Enrollment Automatic enrollment via SSID, and posture-based network access policies. documentation.meraki.com Meraki Community Cisco's user forums — the practical place for configuration questions. community.meraki.com Apple Platform Deployment Vendor-independent ADE and supervision reference. support.apple.com Android Enterprise Work Profile and Fully Managed reference for the Android side. developers.google.com