Back to All Cheatsheet Libraries
cheatsheets
Lightweight, API-first Apple device management with built-in Munki hosting — built for small teams who would rather script than click.
| Object | What it is | Notes |
|---|---|---|
| Device Group | The primary unit of organisation. Profiles, apps, and scripts are assigned to groups. | Assignment is group-centric rather than criteria-driven — closer to a folder than a Jamf Smart Group. |
| Assignment Group | Binds a set of apps to a set of devices, with optional auto-install and auto-update. | The main app-deployment mechanism. Enable auto-update so apps stay current without policies. |
| Configuration Profile | Standard Apple payloads, either built in the console or uploaded as custom .mobileconfig. | Custom profile upload is well supported — the escape hatch for anything the GUI doesn't expose. |
| Custom Attribute | A key/value field on a device, settable via API or script. | Can be referenced as a variable inside profiles — how you template per-device values like a hostname or asset tag. |
| Script | Shell script run on macOS devices, on demand or on a schedule. | Straightforward. No extension-attribute-style feedback loop into dynamic grouping. |
| Munki integration | Built-in Munki catalogue hosting for third-party app deployment. | A genuine differentiator — you get Munki's power without hosting a repo yourself. |
| Enrollment | ADE (zero-touch) via ABM, or one-time enrollment URLs/QR for existing devices. | Per-enrollment limits and expiry are configurable, which is handy for controlled rollouts. |
| Task | Example | Notes |
|---|---|---|
| List devices | curl -u $API_KEY: https://a.simplemdm.com/api/v1/devices | Note the trailing colon — the key is the username, password is empty. |
| Get one device | curl -u $API_KEY: .../api/v1/devices/<id> | Returns full inventory including OS version, model, and custom attributes. |
| Push an update / lock / wipe | curl -X POST -u $API_KEY: .../api/v1/devices/<id>/lock | Lifecycle commands are all simple POSTs. Wipe is irreversible — guard it in any script. |
| Set a custom attribute | curl -X PUT -u $API_KEY: .../api/v1/devices/<id>/custom_attribute_values/<name> -d "value=X" | How you feed external data (HR system, asset DB) into device records. |
| List/assign apps | curl -u $API_KEY: .../api/v1/apps | Assignment groups are also fully API-manageable. |
| Pagination | ?limit=100&starting_after=<id> | Cursor-based. Loop until has_more is false rather than assuming one page. |
A practical example — flag every Mac that hasn't checked in for 30 days, for an offboarding audit:
#!/bin/bash
# Requires: SIMPLEMDM_API_KEY in the environment, plus jq
CUTOFF=$(date -v-30d +%s 2>/dev/null || date -d '30 days ago' +%s)
NEXT=""
while :; do
URL="https://a.simplemdm.com/api/v1/devices?limit=100${NEXT}"
RESP=$(curl -sS -u "$SIMPLEMDM_API_KEY": "$URL")
echo "$RESP" | jq -r --argjson cutoff "$CUTOFF" '
.data[]
| select((.attributes.last_seen_at // "1970-01-01T00:00:00Z"
| fromdateiso8601) < $cutoff)
| "\(.id)\t\(.attributes.name)\t\(.attributes.last_seen_at)"'
[ "$(echo "$RESP" | jq -r '.has_more')" = "true" ] || break
LAST=$(echo "$RESP" | jq -r '.data[-1].id')
NEXT="&starting_after=${LAST}"
done
SimpleMDM fits well when…
- You manage roughly 10–500 Apple devices with mainstream requirements.
- Nobody's job title is "Mac admin" — the product is genuinely learnable without training.
- You'd rather express fleet operations as scripts against a clean API than as console configuration.
- You want Munki's third-party app management without running a Munki repo.
- Predictable per-device pricing matters more than feature maximalism.
Look elsewhere when…
- You need criteria-driven dynamic grouping that recalculates from collected inventory — that's Jamf's Smart Group model and SimpleMDM doesn't match it.
- You have Windows or Android in scope. SimpleMDM is Apple-only; see Hexnode or Intune.
- You need bundled endpoint security and identity — Mosyle Fuse packages those.
- You're running thousands of devices with complex delegated administration.
Gotchas
Apple's annual certificate expiries apply here too
- APNs push certificate: expires every 12 months. Renew with the same Apple ID or re-enroll everything.
- ABM/ADE and VPP tokens also expire annually.
- This is an Apple constraint shared by every MDM — not something a simpler product avoids.
API keys are full-access credentials
- A SimpleMDM API key can wipe devices. Treat it exactly like a production secret.
- Store it in a secret manager or environment variable — never commit it to a repo or paste it into a shared doc.
- Rotate on staff changes, and use separate keys per integration so one can be revoked without breaking the others.
Secure Token / Bootstrap Token still bite on Apple silicon
- Platform-level Apple behaviour: a user needs a Secure Token for FileVault and OS updates.
- Ensure the Bootstrap Token escrows to SimpleMDM, or MDM-driven FileVault enablement fails on tokenless accounts.
- Check with
profiles status -type bootstraptokenon the device.
PPPC profiles are still mandatory
- Full Disk Access, Screen Recording, and Accessibility can only be pre-approved by an MDM-delivered PPPC profile.
- Build one with PPPC Utility and upload it as a custom profile — you need the app's bundle ID and code requirement.
Resources
SimpleMDM API reference
Full REST documentation — endpoints, pagination, and webhooks.
simplemdm.com
Knowledge base
Setup guides, profile references, and Munki integration walkthroughs.
simplemdm.com
Munki
The managed-install system SimpleMDM hosts for you — useful background on how it works.
github.com/munki
PPPC Utility
Generates privacy-preference profiles to upload as custom profiles.
github.com/jamf
Apple Platform Deployment
Vendor-independent reference for ADE, supervision, and enrollment.
support.apple.com
Mac Admins Slack
Community support across every Apple MDM including SimpleMDM.
macadmins.slack.com