We noticed that Apple Login fails if we try to login with Managed Apple ID on iOS 17.2 & 17.3 This issue could have been introduced in iOS 17 but we did not have iOS 17.0 or 17.1 to validate this. There are few prerequisites to this: Should be a supervised device. It can be enrolled in ABM or ASM. Apple ID should be Managed Apple ID Device should have a passcode policy Device should have “allowListedAppBundleIDs” added in the “com.apple.applicationaccess” payload If either of the above conditions are not met, then the issue does not happen. If the device is set up in the above way and we try to login with Managed Apple ID, then the login fails. Please refer the recording at this link: https://drive.google.com/file/d/1XG17loAuH_GB1IyGdwD8txjkHZWqGeD1/view?usp=drive_link We reproduced the issue three times and got the log files: Issue occurred at: 21st March 2024 at 19:54:58 IST a. Log file name: sysdiagnose_2024.03.21_19-55-26+0530_iPhone-OS_iPhone_21D50(07.54.58 pm).tar.gz b. Link: https://drive.google.com/file/d/1nk-cQPrVEZrAUgVmrxPCsSRDd4aNF8eK/view?usp=drive_link Issue occurred at: 21st March 2024 at 19:59:44 IST a. Log file name: sysdiagnose_2024.03.21_20-00-02+0530_iPhone-OS_iPhone_21D50(07.59.44 pm).tar.gz b. Link: https://drive.google.com/file/d/1VPcF77G2SK2c1rBK4S2GbLCAiQEeYPOB/view?usp=drive_link Issue occurred at: 21st March 2024 at 20:03:27 IST a. Log file name: sysdiagnose_2024.03.21_20-03-39+0530_iPhone-OS_iPhone_21D50(08.03.27 pm).tar.gz b. Link: https://drive.google.com/file/d/1zlLLMd0ugJoiZtmpWlarREFDl1vjZoWP/view?usp=drive_link During the above tests, this was the setup Passcode Policy: a. requireAlphanumeric: true b. minLength: 13 c. allowSimple: false allowListedAppBundleIDs: This can be anything but atleast one of them should be enabled. For example a. com.apple.AppStore b. com.apple.MobileAddressBook c. com.apple.calculator d. com.apple.camera e. com.apple.DocumentsApp f. com.apple.facetime What results I expected: The user should be able to login without an issue What results I actually saw: The user does not login We also created a ticket in Feedback assistant in March but haven't received any response: FB13694721

The customer is trying to enroll macOS devices to Hexode via Apple Business Manager (without reset). Upon running the command sudo profiles renew -type enrollment, he received the below error. Error: DEP enrollment failed: The cloud configuration server is unavailable. (MDMDeviceEnrollment:103) Upon running the command sudo profiles show -type enrollment in Terminal, he received the following output. Error fetching Device Enrollment configuration: (34006) Error Domain=MCCloudConfigurationErrorDomain Code=34006 "The cloud configuration server is unavailable." UserInfo={CloudConfigurationErrorType=CloudConfigurationFatalError, NSLocalizedDescription=The cloud configuration server is unavailable., NSUnderlyingError=0x6000012f0060 {Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." UserInfo={NSLocalizedDescription=Failed to create reference key., NSUnderlyingError=0x6000012f00c0 {Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create ref key." UserInfo={NSLocalizedDescription=Failed to create ref key., NSUnderlyingError=0x6000012f0150 {Error Domain=NSOSStatusErrorDomain Code=-25308 "failed to generate asymmetric keypair" (errKCInteractionNotAllowed / errSecInteractionNotAllowed:  / Interaction is not allowed with the Security Server.) UserInfo=0x6000009f0440 (not displayed)}}}}}} The device was assigned to the Hexnode server and listed in DEP devices in Hexnode. It seems to be an Intel device and we tried following troubleshooting steps. He said another user tried out the case and was encountering the same errors. He tried the following steps as part of troubleshooting. Installed pending OS updates Re-assigned device to Hexnode server Cleared NVRAM/PRAM Switched networks Turned off firewall and proxies on the device Re-assigned DEP configuration profile to devices Re-configured DEP and APNs Enrolling the device using the enrollment URL does work and he's able to deploy actions as well. He is willing to reset the device and check as well, but he has ~30 devices in ABM that are remote and in use. Since 2 devices encountered the case, he would like to know more about what happened.

Is there a way to deploy a client certificate (mTLS) payload with an Application using MDM? What alternatives are there for accomplishing this? A .p12 is fine if that is the only option, however the app would need to import it into it's keychain and delete the .p12 file (or the MDM would need to do so).

Enroll an iOS device via MDM and apply passcode policy with "maxFailedAttempts" setting enabled https://developer.apple.com/documentation/devicemanagement/passcode Now when the user attempts to unlock device exceeds above "maxFailedAttempts" - the device gets wiped. Now the administrator is unaware of this event. It would be helpful to get an message/DDM status from device to notify the MDM server that device is wiped due to incorrect passcode attempts.

I appreciate any suggestions on a problem we're having. Here's what's happening: We use Visual Studio to create Xamarin and MAUI apps. We have several apps that all have In-House provisioning profiles attached to the same certificate. Developers upload ipa files to our internal website, so our QA team can install and test them. We have done this in this way for several years. As of a month or so ago, one of these apps will not install after download. Under the app icon on the device there is a download icon before the app name, and tapping the icon receives in the error message, "This app cannot be installed because its integrity could not be verified." Something else that stated around the same time is that while the name of our enterprise certificate "iPhone Distribution OurCompanyName" shows in the Signing Identity dropdown. When we select it and open the list again, the list now also has "Unknown (iPhone Distribution OurCompanyName)" as a selection. Timing can't be a coincidence. It must be connected to the problem. I have made new certificates and provisioning profiles (Ad-Hoc and In-House) several times, but nothing I have tried over the past three days has worked. And, as I mentioned, we have many other apps that work just fine.

Hi Does anyone know why the ‘allowVPNcreation’ restriction available to supervised devices doesn’t apply to third-party apps? This Support page says it should: https://support.apple.com/en-gb/guide/deployment/dep0f7dd3d8/web Thanks

Hi, I am consuming the API https://gdmf.apple.com/v2/pmv to get the supported apple OS versions. I do get intermittent 403 exception almost every alternate day. Is there any way to fix this issue for this API? Is there any better and reliable Apple API to get supported apple OS versions across macos, ios etc?

Im experiencing an error code 12026 when trying to install an app with iTunes Store ID 1163307568 and has tried various solutions but is still unable to install the app. Tried revoking the licenses and pushing the apps again but the error prompt persists. We have also tried syncing VPP, checking the app license, and purchasing a mild surplus, but still getting the error.

Yesterday, OpenSSH disclosed a critical RCE vulnerability that affects all instances of OpenSSH and released a patch to fix this vulnerability. As a result, do we have any official word from Apple as to when this vulnerability will be fixed? This weakness exposes every macOS device without a strict firewall configured. Reading Link: https://thehackernews.com/2024/07/new-openssh-vulnerability-could-lead-to.html

Using Apple configurator, I cannot transfer over iPhone 8 ( installed iOS 16.7.8) because of this message: Si è verificato un errore inatteso con “iPhone di Sandro”. Impossibile completare l’operazione. Blocco risorsa evitato [NSPOSIXErrorDomain – 0xB (11)] How can I fix it?

I am working with Microsoft Engineers regarding an Intune SCEP User certificate always defaulting and deploying to System keychain. I have MobileIron in my environment and it is able to deploy SCEP User certificates to the User keychain without issues. Is there any insight that Apple or anyone else can provide on how to overcome this limitation with Intune SCEP and iOS/iPadOS? Microsoft has made it clear to me this is by design with Apple on Intune and deferred the SME insight to Apple. The only documentation I have found from Microsoft related to this is below and see the Note it only mentions macOS but it also applies to iOS/iPadOS. https://learn.microsoft.com/en-us/mem/intune/protect/certificates-profile-scep Note Storage of certificates provisioned by SCEP: o macOS - Certificates you provision with SCEP are always placed in the system keychain (System store) of the device.

We are using JAMF profile to configure automatic proxy configuration URL on macOS. The configuration looks as following: #scutil --proxy <dictionary> { BypassAllowed : 0 ExceptionsList : <array> { 0 : https://exception.com } FTPPassive : 0 FallBackAllowed : 0 HTTPEnable : 0 HTTPSEnable : 0 ProxyAutoConfigEnable : 1 ProxyAutoConfigURLString : https://pac.com/FailbackWithExclusionsENDUSERS.pac SOCKSEnable : 0 } This configuration works fine with normal network. When user tries to connect to a Captive Portal Network, the captive portal login page does not appear but an error page appears as shown below We need help to identify what is wrong with this configuration causing this error.

In our Device Configuration Policy (MDM Policy) We have Excluded Domains that should prevent VPN traffic for that domain but it's not working for iOS 17.5.1 but were working before!

When a package is published via MDM using the Install Enterprise app command provided by Apple On one of the devices, this command is failing with com.apple.appstored.xpc exception but works fine on other macOS devices having the same restrictions and OS version. We tried restarting the device and also the appstored process via Activity Monitor but it was in vain. I am attaching system logs that contain the exception and stack trace when the command failed. ExceptionLogs

Long time ago, probably more than 10-15 years ago, I could create a user account without a password. I have since migrated my whole setup through many generations of hardware and updates to MacOS and still have an account that doesn't have a password (you just click on it and it logs in directly alternatively you enter the name and press enter, no password needed). However, since many years the UI used to create a new user doesn't allow you to leave the password field empty. How can I, using a current version of MacOS, create another account like my old password-less account? From the command line or the UI. Alternatively, can I remove the password from an existing account? I have looked into this before and found instructions, which I think I followed, unsuccessfully, to use the Netinfo Manager (this is oooold!), dscl etc, so far to no avail

We are configuring a passcode policy through MDM where the password expiration is set to 2 months for local accounts (not domain joined). Occasionally, we receive prompts to change the password a few days before it expires. Please refer to the image below. We would like to clarify the following: What is the default timing for these reminders? Specifically, how many days before the password expiration do these prompts typically start appearing? Can we adjust the number of days before these reminders appear? If yes, can this adjustment be made through MDM settings or via a script?

I'm having an issue on ad-hoc OTA installation. I get my app archive via distribution (being automatically signed) with manifest.plist for OTA and upload it to dropbox account. However itms-service's action=download-manifest does not work for me with the dropbox URLs. I get the download link and add it to the manifest.plist. And then goes the link to download the manifest itself: itms-services://?action=download-manifest&url=https://www.dropbox.com/scl/fi/rzzlmbgx0duvd5gjb84uf/ManifestName.plist?rlkey=9j96n42qq8t1vwhcf3e7gxj8c&st=2hbhkidc&dl=1 I put the link on another web-site but it's not working. Nothing happens by pushing an install button with redirection link inside. And if I just copy the link and paste it in new page URL Safari asks me if I want to open it via iTunes and then still goes nothing. I'm not sure this is an issue either on apple and my app or dropbox with their links generation. Like a year ago it worked with the old link-generation. There was not rlkey parameter and the link ended with .../manifest.plist. Please suggest me if I miss something and maybe should re-check some options on my app or distribution or something. Or I should ask for dropbox's support help

Enrol Supervised iOS device Turn ON screen time restriction by opening Settings app -> Content & Privacy restrictions -> Passcode & Face ID -> Don’t Allow. Now install a Passcode policy profile via MDM with the key “forcePIN” set to “true”, such that the device is needed to change the passcode in device. By following above steps, the profile fails. The failure response from the device states that passcode restriction is applied in the device, “The profile ‘Profilename’ may require a passcode change but the passcode cannot be modified.” This is an incorrect behaviour as MDM should have more control over the screen-time restriction as well. Error response from the device <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>InstallProfile</string> <key>ErrorChain</key> <array> <dict> <key>ErrorCode</key> <integer>4001</integer> <key>ErrorDomain</key> <string>MCInstallationErrorDomain</string> <key>LocalizedDescription</key> <string>Profile Installation Failed</string> <key>USEnglishDescription</key> <string>Profile Installation Failed</string> </dict> <dict> <key>ErrorCode</key> <integer>4026</integer> <key>ErrorDomain</key> <string>MCInstallationErrorDomain</string> <key>LocalizedDescription</key> <string>The profile **** may require a passcode change but the passcode cannot be modified.</string> <key>USEnglishDescription</key> <string>The profile **** may require a passcode change but the passcode cannot be modified.</string> </dict> </array> <key>Status</key> <string>Error</string> <key>UDID</key> <string>****</string> </dict> </plist> Feedback ID : FB14249704

Enrol Supervised iOS device. Push an CardDAV policy for the above device, the contacts gets synced in the native Contacts app as expected. (https://developer.apple.com/documentation/devicemanagement/carddav) When the above same profile is re-installed in the above device, the synced contacts are lost and password prompt is shown to enter the password - even though the installed profile contains password for the CardDAV policy. Password prompt from the device Re-Installed configuration <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>35ee541b-fec0-46b0-bd48-bcc0702ab60b</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadOrganization</key> <string>MDM</string> <key>PayloadIdentifier</key> <string>com.mdm.ec89620f-2905-4c14-b09d-7e9f17944468.CardDAV</string> <key>PayloadDisplayName</key> <string>CardDAV</string> <key>PayloadRemovalDisallowed</key> <true/> <key>PayloadContent</key> <array> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>07c423b5-8ae2-4e6e-9336-aa9ca850d6c9</string> <key>PayloadType</key> <string>com.apple.carddav.account</string> <key>PayloadOrganization</key> <string>MDM</string> <key>PayloadIdentifier</key> <string>07cV423b5-8ae2-4e6e-9336-aa9ca850d6c9</string> <key>PayloadDisplayName</key> <string>CardDAV Policy</string> <key>CardDAVAccountDescription</key> <string>****</string> <key>CardDAVHostName</key> <string>www.googleapis.com</string> <key>CardDAVPassword</key> <string>****</string> <key>CardDAVPort</key> <integer>443</integer> <key>CardDAVPrincipalURL</key> <string></string> <key>CardDAVUseSSL</key> <true/> <key>CardDAVUsername</key> <string>****</string> </dict> </array> </dict> </plist> Feedback ID : FB14250521

When making a GET request to the ABM Account API at https://mdmenrollment.apple.com/account, we receive a response that includes an org_email field. However, we’ve noticed that the value of org_email varies. Sometimes it corresponds to an account with the role of Administrator, while other times it comes from account with roles Device Enrolment Manager, Content Manager and People Manager. We seek clarification on the following points: Which roles determine the org_email sent in the response? Is the org_email coming in API response always same or does it change when we hit the APIs in multiple times. org_email in this response: https://developer.apple.com/documentation/devicemanagement/accountdetail