So I came across something weird that's affected only my 10.12.4 clients (none of my 10.11.6 clients seem to be affected by this). Even though I have only one Safari profile enabled, which is set-once and doesn't manage the homepage, my 10.12.4 clients are unable to change the homepage in Safari manually. Whatever the homepage was is stuck like that. If you enter a new homepage in the Safari preferences, it will just not take and revert back to the old homepage once you hit Enter or click out of the address entry field.
The only workaround I've found for this is to delete all profiles (again, even though I don't have any profiles managing the Safari homepage):
sudo profiles -D
Are you sure you want to delete all configuration profiles? [y/n]:y
reboot the computer, and then reinstall (via Munki) all the previously installed profiles (yes, including the set-once
profile for Safari that was installed before)... and then I'm able to change the homepage on the client manually. Very bizarre.
Also, after testing on a couple of other clients, there do seem to be situations in which the Safari profile was never set at all, and you still can't modify the homepage, even after deleting any other profiles and rebooting, and it's not account-specific either (freshly created account experiences it, too). It's a real head-scratcher.
Recently (not sure the exact date), Apple started disabling certain Safari plugins by default. That's great for security, but it's not that great for usability, especially if users actually want to use those plugins.
If you want your users to enable plugins themselves manually, they can follow Apple's instructions at How to use Internet plug-ins in Safari for Mac.
If you'd like to deploy a .mobileconfig profile, though, I've posted a sample one on GitHub that enables Flash, Java, and Silverlight (ask first, not just on all the time).
Rod Christiansen has a more comprehensive sample up (more plugins).
In addition to the plugins being generally enabled or disabled (with 0 or 1 / false or true), there is also a first-visit policy to look at.
This is the default setting (blocking):
PlugInFirstVisitPolicy = PlugInPolicyBlock;
This is the setting in the profiles I linked to:
PlugInFirstVisitPolicy = PlugInPolicyAsk;
And this is if you want it on (not asking):
PlugInFirstVisitPolicy = PlugInPolicyAllowWithSecurityRestrictions;
If you try to play Netflix on Safari using an external monitor/projector (either mirrored or extended), you may get this errror:
Whoops, something went wrong...
There appears to be a display problem. Please ensure your monitor is HDCP compliant and is not mirrored using Airplay.
For additional assistance resolving this issue, please visit our Help Center.
Error Code: S7363-1266-48444350
Things may change, but as of the time of this writing, the suggestions Netflix has in its support article do not solve the problem (Disconnect your display doesn't fix the issue; Remove problematic software might work in the unlikely event you have DisplayLink installed; Restart your computer also doesn't fix the issue).
I found another link that had a host of other suggestions: Fix HDCP Compliant Display Error When Watching Netflix Video In Safari On Mac. One of the suggestions (enable the Developer menu in Safari and then switch the user agent to an older version) worked when I tried it in El Capitan but not when I tried it in Yosemite.
The actual solution is just to use another web browser (e.g., Firefox or Chrome).