I am trying to set up a workflow where Apple Vision Pro users in my organization can install a signed enterprise .ipa file from an internal web page. The relevant link looks something like this: <a role="button" href="itms-services://?action=download-manifest&url=https://my.example.com/path/manifest.plist">Click here to download</a> After verifying that all the mime types were correct on the server and the certificate was valid, I finally attached my AVP headset to my Mac's console app and saw that the errors look like this: [com.example.myapp] Skipping due to incompatible platform: com.apple.platform.xros Could not load download manifest with underlying error: Error Domain=ASDErrorDomain Code=752 "Not compatible with this platform: com.apple.platform.xros" UserInfo={NSDebugDescription=Not compatible with this platform: com.apple.platform.xros} This manifest.plist was made by the "Distribute App" workflow in Xcode 16.0. Multipart question: Is installing VisionOS apps via manifest+ipa over a web connection a supported way of installing apps? If the issue is with com.apple.platform.xros, what should be the platform-identifier for VisonOS apps?

Dear Apple Developer Support Team, I hope this message finds you well. I am currently utilizing the services at https://identity.apple.com for mobile device management and encountered an issue while attempting to upload a Certificate Signing Request (CSR) file to the portal. The system generated an error indicating that the file format was invalid. Below are the steps I followed to generate the CSR: I first created a private key on my server using the following command: openssl genrsa -out private.key 2048 Next, I generated the CSR file with the following command: openssl req -new -key private.key -out request.csr Despite following these steps, I could not successfully upload the CSR file and obtain the APNs certificate. I would greatly appreciate your guidance on creating and uploading a valid CSR file to avoid this error. Please let me know if there are any specific formatting requirements or additional steps I need to follow. Thank you in advance for your assistance and support.

Hi, I have a question regarding reading the configuration of a managed app deployed via an MDM system. The application has an Action Extension and can receive shared files via this extension. The problem I am facing is that I can read the managed configuration in the host app by accessing the UserDefaults.standard.object(forKey: "com.apple.configuration.managed") dictionary. With this, I can configure the host app. However, I am unable to read this configuration key in the Action Extension part of the application. My question is whether there is any possibility to read the managed configuration even in the extension. So far, I have been unable to figure out how to read it. I found the sample code, but it was not very helpful since it is very basic and does not deal with extensions at all. Any hints are appreciated.

https://support.apple.com/en-gb/guide/deployment/dep6fa9dd532/web dangles a carrot about being able to facilitate "A list of domains that the Shared iPad sign-in screen displays. The user can pick a domain from the list to complete their Managed Apple ID." - this sounds ideal! In the absence of this seemingly being supported by Apple Configurator or iMazing Profile Editor at the time of writing, I have tried to create my own but I fall foul of knowing what PayloadIdentifier or PayloadType to use? This is the draft/work in progress/doomed to failure config so far (which doesn't - as expected - work): <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>HasRemovalPasscode</key> <false/> <key>PayloadContent</key> <array> <dict> <key>PayloadDescription</key> <string>Configures Managed Domains</string> <key>PayloadDisplayName</key> <string>Domains</string> <key>PayloadIdentifier</key> <string>com.apple.domains.DE12211A-CFDD-4F8C-8D7B-72E569CE3B6C</string> <key>PayloadType</key> <string>com.apple.domains</string> <key>PayloadUUID</key> <string>DE12211A-CFDD-4F8C-8D7B-72E569CE3B6C</string> <key>PayloadVersion</key> <integer>1</integer> <key>WebDomains</key> <array> <string>domain.com</string> </array> </dict> </array> <key>PayloadDescription</key> <string>For Shared iPad login convenience</string> <key>PayloadDisplayName</key> <string>DefaultDomain</string> <key>PayloadIdentifier</key> <string>Tom.77CF3CA5-4A48-41DD-9179-EF6F4C5E786E</string> <key>PayloadRemovalDisallowed</key> <true/> <key>PayloadType</key> <string>Configuration</string> <key>PayloadUUID</key> <string>A5594F17-155B-4A1C-8696-3F502D118C37</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </plist> The support article is probably ~2-year old information so I'd have thought that by now that this would be documented somewhere - am I just not looking hard enough?

Hello, I have a system, which is able to execute bash/zsh scripts on a set of machines. The default behaviour is that the signature of the script is checked on the machine, which is executing it, and in case if it is not signed properly, the system rejects the execution. An own certificate has to be created for signing the scripts, which means that the certificate has to be installed and marked as trusted on the target machines (which are executing the script). I've been using : "/usr/bin/security add-trusted-cert ..." command to install the certificate on the machines as trusted. Since macOS Big Sur, the above command was prompting the local user for admin credentials. To avoid this, Apple suggested to use the following command to temporarily disable and re-enable the confirmation dialog : 1.: /usr/bin/security authorizationdb write com.apple.trust-settings.admin allow 2.: /usr/bin/security authorizationdb write com.apple.trust-settings.admin admin Now with the release of macOS Sequoia, the above command : "/usr/bin/security authorizationdb write com.apple.trust-settings.admin allow" does not work any more. It gives the following output : NO (-60005) I have the following questions : 1.: Could you please suggest an alternative way for IT administrators to install certificates on their machines, without any user confirmation? 2.: Could you please suggest how the same could be achieved using a bash/zsh script? In which context could the above commands : "/usr/bin/security authorizationdb write com.apple.trust-settings.admin allow" and "/usr/bin/security authorizationdb write com.apple.trust-settings.admin admin" still work? Thank you for your help in advance!

中文： 大家好，我通过https://mdmenrollment.apple.com/session获取到了auth_session_token，并能正常使用device/activationlock、devices、profile/devices这些接口，但是不能正常使用devices/disown（https://mdmenrollment.apple.com/devices/disown）这个接口，接口返回401 UNAUTHORIZED，请问应该怎么处理？ English： Hi, I have passed https://mdmenrollment.apple.com/session Obtained auth_dession_token and can use interfaces such as device/activationlock, devices, and profile/devices normally, but cannot use devices/disown normally（ https://mdmenrollment.apple.com/devices/disown ）How should I handle this interface, which returns 401 UNAUTORIZE?

I am looking into bypassing the following popup when setting up an iPhone 15 Pro: Would the SkipKey SIMSetup allow to bypass having the following window popup upon initial setup? So far all settings are bypassed during the initial setup of the phone and the application of Wi-Fi. The only issue present in the setup I want to achieve is prohibiting this window regarding eSIM set up.

We are in the process of replacing the TripleDES algorithm with AES in our MDM solution. However, after switching the encryption algorithm, we encountered the following error on Apple devices during enrollment: Error: "-26275 error decrypting response payload (mdmclient(SCEP))" Do Apple devices support AES encryption during the enrollment process, or are there any known limitations that prevent its use? Technical Details: During enrollment, when the device attempts to install the Management Profile, it requests the MDM server to retrieve the device certificate from the SCEP URL. We send the certificate by creating Enveloped CMS content, using TripleDES as the algorithm identifier. If we switch the algorithm to AES, we observe the error mentioned above. We are also using TripleDES when preparing the CMS content for the enrollment profile, which works without issues.

A profile that contains setting of allowVPNCreation is false was installed duiring activation in my requirements. The iOS version is 18. AllowVPNCreation is first, setting the app's network is second, the app can't use network. Setting the app's network is first, AllowVPNCreation is second, the app works well. For example: Scene 1 Step 1: Install a profile that contains a setting where allowVPNCreation is false during activation. Step 2: Complete activation and enter the main screen. Step 3: Tap App Store, the screen displays network unavailable, needs to be set in Setting. Step 4: Open the network setting for App Store, but still closed.And the network settings for other apps are all closed; Step 5: Remove the profile. Step 6: After a minute, opening the network setting for App Store is work. Result: AllowVPNCreation effects app's newtork after entering the system for the first time. It don't happen below iOS 18. Scene 2 Step 1: The app's network setting is ok. Step 2: Install a profile that contains a setting where allowVPNCreation is false. Result: No effect。The same result below iOS 18. Is this a bug or new features, how to handle？

Could you please provide guidance on what is required to set up an Apple MDM server from scratch? Specifically, I would like to understand the necessary steps, tools, certifications, and best practices involved in the process. Any resources or documentation you could recommend would also be appreciated.

**Hi Apple Developer Community, Good Morning ** My Personal MacBook Air M1: Mac OS: Sequoia, Version 15.0 Please note, this is my personal MacBook and I am the only one who is using it. I can see System Configuration, Configuration Profiles and Kerberos on my personal MacBook Air M1 System Folder ---&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; Library ----&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; Configuration profile, System Configuration folders ?. Attaching herewith the snapshot of the same. Can some throw light on the same. Do I need to remove the configuration profile, system configuration from my personal MacBook Air M1 which is seen in System Folder ---&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; Library ----&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; Configuration profile, System Configuration folders ? Also, I cannot edit the user in my name. **Kindly assist me with the same. Thanks and Regards,** Omkar

On October 4, 2024, the enterprise app we are using showed a "(app name) is no longer available" pop-up on certain devices and the app was not available. And if those users delete the app and reinstall it, "I can't install (app name) because I can't verify integrity, I can't install this app" pop up. The profile of the app was renewed in February this year, and membership, certificate, and profile were all not expired. Currently, the problem has been solved by re-deploying the app, Please tell me the cause of the phenomenon and how to take preventive measures.

I got sent an activation code through one of these apple emails and it can’t access the code because I don’t know where to go. Please help if you can!

macOS devices- dep enrolled device - configured an email policy and it gets stuck on pending status. The rest of the policies and actions like lock device and scan device are executed successfully. While enrollment using DEP, if there is account creation config present in Dep configuration profile , At the time of enrollment we don't receive the user token and user channel is not present. The keys UserID and EnrollmentUserID in TokenUpdate is not present. As a result we can't successfully push the email policy. Is the inference correct or is there anything else we are missing out.

out of 37 devices, 7 are inactive( al are ios ). We have checked one of the devices and the broadcast message was sent successful. Additionally, Cx confirmed that the location history is shown properly. We restarted the device, checked the date and time, and found it to be correct. We also switched to a different network, but that doesn't change anything. The sync from the Hexnode app was successful. We reinstalled the MDM profile, yet it doesn't change anything. We renewed the APNs once and checked, but the scan device action remains pending.

When a DeviceInformation command along with ManagedAttestion data in the query along with a new nonce and after 7 days last time we queried for fresh certificate, is there a possibility that a) we will get a DeviceInformation response without a Managed attestion certificte. OR b) We will get a cached certificate Also, what's the average increase in expected response time when we query Managed attestation certificate in DeviceInformation.

Here https://github.com/apple/device-management/blobelease/mdm/commands/information.device.yaml#L3246 it is mentioned that for querying Managed attestation certificate the ios device needs to have A11 Bionic and later, Wanted to understand how to get this information programmatically i.e is Apple sending chip information for iphone and ipad devices as part of some sample ? or is there a way to query this information from the device ? Here https://github.com/apple/device-management/blobelease/mdm/commands/information.device.yaml#L3246 it is mentioned that for querying Managed attestation certificate the macos device needs to have Apple Silicon, using IsAppleSilicon https://github.com/apple/device-management/blobelease/mdm/commands/information.device.yaml#L357 property is fine ? Can we use this field to determine if the device is Apple silicon ? Same question for Apple TV as well - How to get the information if a device is having A12 Bionic and later ? and same for Apple watch, how to know if a device is S4 and later ?

I'm trying to set up a configuration profile on a supervised device for a kid's phone. I want to force a VPN 100% of the time except for local network activity and some specific domains. Or at the very least, have a few apps go outside the tunnel. Apple makes this IMPOSSIBLE even though according to the documentation it should be possible. The IKEv2 vpntype has a key "OnDemandUserOverrideDisabled" which is supposed to prevent a user from toggling off the vpn, which obviously defeats the purpose of having it. However, as other users have posted, this DOES NOT WORK. So anyone can just turn off the vpn and be connected to the internet unprotected. On the "AlwaysOn" vpntype, the element "ApplicationExceptions" which would allow you to list a few applications that can go outside the tunnel DOES NOT WORK. This is critical because so many domains automatically block vpn servers and it's a huge pain. Also local network activity also gets blocked, which makes it impossible to connect to local devices. And there's no split tunneling possible with this vpntype. So basically, it's impossible. I WOULDN'T BE SURPRISED IF APPLE DID THIS INTENTIONALLY TO KEEP KIDS ADDICTED AND IN DANGER SO THEY USE THE PHONE MORE.

Hi everyone, We are currently integrating Apple DDM into our existing MDM system and encountered an issue where an update to a declaration failed with the message: "Activation xxxxx is missing configurations." While we know how to fix the issue, I'm quite concerned about potential impacts. An incorrect activation could deactivate the current one, leading to the automatic removal of all profiles and apps. Given that unexpected server errors can occasionally occur, this could significantly impact end-users if their apps are suddenly removed. I'm looking for a way to prevent activations from "failing to update then lost everything" or a safer method to deploy updated version of activations, especially given the potential for unexpected server errors or logic bugs. This could significantly affect end-users if their apps suddenly disappear. If anyone has any insights, thoughts, or best practices to share regarding activation updates, I would greatly appreciate your input. Leo Chan

btm_launchagent.txt I have a menu bar app which should be triggered to start when a system extension is successfully installed. The menu bar app is configured as a agent which should be started by SMAppServer. SMAppService register/unregister the agent successfully when the program is running locally. When doing the program installation through JamfNow, which is a MDM system, it fails with following error. I think the problem here is that the backgroundtaskmanagementd trys to register the agent with an invalid uid=-1 or uid: 4294967295(0xFFFFFFFF). 2024-10-02 10:45:33.100537+0200 0x156d4 Activity 0x1b927 88 0 smd: (BackgroundTaskManagement) BTMManager.getEffectiveDisposition 2024-10-02 10:45:33.103478+0200 0x156dd Default 0x1b927 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] effectiveItemDisposition: appURL=file:///Applications/Company%20Agent.app/, type=agent, url=Contents/Library/LaunchAgents/com.Company.agent.notifier.plist -- file:///, config={ BTMConfigArguments = ( ); BTMConfigBundleIdentifiers = ( ); BTMConfigExecutablePath = "Contents/Resources/CompanyNotifier.app/Contents/MacOS/CompanyNotifier"; BTMConfigLabel = "com.Company.agent.notifier"; } 2024-10-02 10:45:33.103544+0200 0x156dd Info 0x1b927 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] effectiveItemDisposition: result=[disabled, allowed, visible, not notified] 2024-10-02 10:45:33.105120+0200 0x156d4 Default 0x1b927 88 0 smd: (BackgroundTaskManagement) [com.apple.backgroundtaskmanagement:main] getEffectiveDisposition: disposition=[disabled, allowed, visible, not notified], have LWCR=true 2024-10-02 10:45:33.105181+0200 0x156d4 Default 0x0 88 0 smd: [com.apple.xpc.smd:all] Found status: 0 for &lt;private&gt; 2024-10-02 10:45:33.240190+0200 0x154da Default 0x0 88 0 smd: [com.apple.xpc.smd:SMAppServiceFactory] Setting up BundleProgram keys for &lt;private&gt; 2024-10-02 10:45:33.240250+0200 0x154da Default 0x0 88 0 smd: [com.apple.xpc.smd:SMAppServiceFactory] Setting up BundleProgram keys for &lt;private&gt; 2024-10-02 10:45:33.240388+0200 0x154da Activity 0x1b92a 88 0 smd: (BackgroundTaskManagement) BTMManager.registerLaunchItemWithAuditToken 2024-10-02 10:45:33.243990+0200 0x156dd Default 0x1b92a 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] registerLaunchItem: pid=3626, uid=-1, type=agent, parentURL=&lt;private&gt;, url=&lt;private&gt;, config=&lt;private&gt; 2024-10-02 10:45:33.244917+0200 0x156dd Default 0x1b92a 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] registerLaunchItem: found existing item: uuid=AC0DBC9B-7A16-443E-ABFC-05DF0F534C08, name=CompanyNotifier, type=managed agent, disposition=[disabled, allowed, visible, notified], identifier=com.Company.agent.notifier, url=Contents/Library/LaunchAgents/com.Company.agent.notifier.plist -- file:/// 2024-10-02 10:45:33.245238+0200 0x156dd Debug 0x1b92a 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] BTMStore: save scheduled. 2024-10-02 10:45:33.245281+0200 0x156dd Debug 0x1b92a 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] RecordSet notification scheduled for uid -1 .... 2024-10-02 10:45:33.252358+0200 0x154da Error 0x0 88 0 smd: [com.apple.xpc.smd:SMAppService] Unable to submit job: &lt;private&gt; error: Error Domain=OSLaunchdErrorDomain Code=112 UserInfo={NSLocalizedFailureReason=&lt;private&gt;} 2024-10-02 10:45:33.252707+0200 0x156d4 Default 0x1b92a 88 0 smd: [com.apple.xpc.smd:all] Update request for identifier: &lt;private&gt; uid: 4294967295 2024-10-02 10:45:33.253190+0200 0x156dd Default 0x1b92a 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] getItemWithIdentifier: identifier=com.Company.agent.notifier, uid=-1 2024-10-02 10:45:33.253759+0200 0x156d4 Error 0x1b92a 88 0 smd: [com.apple.xpc.smd:btm] Error getting BTMItem with Identifier: &lt;private&gt; uid: 4294967295 error: (null) 2024-10-02 10:45:33.253803+0200 0x156d4 Error 0x1b92a 88 0 smd: [com.apple.xpc.smd:all] Unable to find BTMItem for &lt;private&gt; in 4294967295 2024-10-02 10:45:33.253835+0200 0x156d4 Error 0x1b92a 88 0 smd: [com.apple.xpc.smd:all] Update operation returned error: 3, but no reply expected so error will be silent 2024-10-02 10:45:33.661537+0200 0x156dd Debug 0x0 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] sending notification for uid -1, type 131080 2024-10-02 10:45:33.665159+0200 0x154fa Info 0x1b853 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] fetchSFLItemsMatching: type=managed user item app 2024-10-02 10:45:33.665374+0200 0x154fa Activity 0x15dd3 282 0 backgroundtaskmanagementd: (BackgroundTaskManagement) BTMManager.userDataDidChange 2024-10-02 10:45:33.666041+0200 0x154da Activity 0x1b92d 88 0 smd: (BackgroundTaskManagement) BTMManager.userDataDidChange 2024-10-02 10:45:33.666651+0200 0x154fa Debug 0x15dd3 282 0 backgroundtaskmanagementd: (BackgroundTaskManagement) [com.apple.backgroundtaskmanagement:main] -[BTMManager handleUserDataDidChangeNotification:]: uid=-1, type=131080 2024-10-02 10:45:33.666085+0200 0x154da Debug 0x1b92d 88 0 smd: (BackgroundTaskManagement) [com.apple.backgroundtaskmanagement:main] -[BTMManager handleUserDataDidChangeNotification:]: uid=-1, type=131080 2024-10-02 10:45:36.218160+0200 0x154fa Debug 0x0 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] -[BTMStore handleWriteTimer] entered 2024-10-02 10:45:36.218254+0200 0x154fa Debug 0x0 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] -[BTMStore _save] entered 2024-10-02 10:45:36.224738+0200 0x154fa Default 0x0 282 0 backgroundtaskmanagementd: [com.apple.backgroundtaskmanagement:main] BTMStore: store saved to /var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v9.btm Could it be a problem from the MDM system JamfNow or somewhere else? The whole logs is as attached. Thanks!