I was able to successfully pass a PAT token challenge with my iPhone in iOS 18. However, after installing a corporate profile via Google Device Policy, it no longer passes the challenge. Is this expected? I.e. does Apple consider a device with a profile to be less secure than one without it?

I was checking the operation of items that are now available on devices with iOS 18 or later, but when I distribute to Shared iPad devices, the following 3 items are not installed on the device and cannot be controlled. allowiPhoneMirroring allowPersonalizedHandwritingResults allowWritingTools Please let us know the following. Are the above 3 items available on Shared iPad? If so, please tell us how to solve the problem that the items are not installed on the Shared iPad device and the control does not work. The specifications of the device used are as follows OS : iOS18.1 beta3 Model : iPad Air 13-inch(M2)

New Local Network Privacy Setting has been added in Privacy & Security Section of system Settings. I just want to know if this permission be managed through MDM mobileconfig profile. Let me know if any suggestions are there, in respect to this.

On the "What's new for enterprise in iOS 18" page here: https://support.apple.com/en-am/121158, one of the new features mentioned is: "On supervised devices, organizations can disable a user’s ability to hide and lock apps." Despite reviewing the developer documentation surrounding device management (https://developer.apple.com/documentation/devicemanagement), as well as going through the latest changes to schema definitions (https://github.com/apple/device-management), I have been unable to find a restriction that corresponds to this functionality. This is a feature that I'd like to implement, has anyone found any details about this restriction and what key may need to be inserted in the restrictions payload to use it?

I integrated the Apple in app SDK, but when using SK Products Request to obtain the product ID, it was empty and invalid. I checked the app backend status and product status, and they are both normal. What's going on? I hope to receive an effective answer and solution as soon as possible. Thank you very much!

I am trying to use Apple Intelligence on a shared iPad. I cannot use Apple Intelligence even though I have registered my Apple Acount. Apple Intelligence does not appear in the device settings. Please tell me the following Can I use Apple Intelligence on my Shared iPad device? If so, is it an expected behavior that Apple Intelligence settings are not displayed on the Shared iPad device? The specifications of the devices used are as follows OS: iPadOS 18.1 beta3 Model: iPad Air-13inch(M2)

Hi Apple Team , We have a. Bunch of macOS devices in our Fleet Which has MDM Passcode Payload Applied. We have observed a huge delay in unlocking the user account at login Screen after the Credentials are presented, Where as Removing the Passcode Payload makes the User to unlock their account at login Screen Immediately. Can someone help with this issue any OS Updates helps this ? Have Filed a FeedBack: FB15143190 (MDM Passcode Payload Causing Delay In Device Unlock) Also there is a Discussion reg this Passode Policy Issue

Hi, We made a MDM Capability request a few months ago and still haven't heard back. Is there a way to check what the status of the request is? Thanks, Dave

I am checking the behavior of the Contact settings, but the controls are not working with respect to the Communication Service Rules. Please let me know the following Is it possible to change the default calling app on a Japanese iPhone? If possible, does the control of the Contact settings in the configuration profile work?

The same problem encountered with iOS 17 beta 1 and beta 2 is back: Unable to create a secure connection to the server ("bad certificate format" -9,808).

IMAP is again broken... this has happened with many prior iOS betas

We have confirmed the operation using iOS18 beta devices regarding the item "allowVideoConferencingRemoteControl" which is implemented for iOS18 beta. Remote control can be requested even if “allowVideoConferencingRemoteControl" is set to "true" or "false". Please tell me the following. Is it an expected behavior that there is no control regarding remote control whether "allowVideoConferencingRemoteControl" is true or false? I have confirmed the operation by following the procedure below, but is the procedure to confirm the control of "allowVideoConferencingRemoteControl" correct? Steps taken Create a profile with "allowVideoConferencingRemoteControl" set to "false" in the restriction settings Distribute to the terminal Make a video call with facetime between iOS18 beta devices One device performs screen sharing of the device with Share Play, and the other device requests remote control. Even if "allowVideoconferencingRemoteControl" is set to "false" in the restriction settings, remote control requests are still made.

Hello, I am working on a MDM solution. I am facing issue to while Activation Unlock Iphone by MDM server. I am following this https://developer.apple.com/documentation/devicemanagement/device_assignment/activation_lock_a_device/creating_and_using_bypass_codes documentation as reference. I am able to activation lock the device from mdm server but while unlocking the device I am getting below error "?xml version="1.0" encoding="UTF-8"?> ns:escrowKeyDeviceServicesResponse version="1" xmlns:ns="http://www.apple.com/cds/mdmescrowKeyDeviceServices/xml"> error code="1002" message="com.apple.cds.cyclops.mdm.MDMServiceException: No registered escrow key found"/> /ns:escrowKeyDeviceServicesResponse>" I am sending below request for Unlock Url=https://deviceservices-external.apple.com/deviceservicesworkers/escrowKeyUnlock?Device_Serial=XXXXXXXX&productType=iPhone12,8&imei=XXXXXXX&imei2=XXXXXXXXXXXXXX&meid=XXXXXXXXXX Body=escrowKey=VT2DK-YR647-HWAY-096C-ER7P-89J1&orgName=ORGNAME&guid=9C1AE0D42A38A23AFFE59 Below working request for Activation Lock URL=https://mdmenrollment.apple.com/device/activationlock Body = { "Device" :"Serial_Number", "EscrowKey" :"B83C6E662299F3AF202656C4D7A434A319A34241A2892792132EECE56F6D898A", "LostMessage":"Message" } Any idea what could cause this error.

Inquiry about Running Enterprise Apps in Killed State and MDM Payload Management:- I am developing an enterprise iOS application that needs to perform specific tasks or network calls even when the app is in a killed state (i.e., when it is not actively running in the foreground or background). I understand that standard iOS restrictions prevent apps from executing code while in this state, but I am exploring potential solutions within the scope of enterprise apps and MDM (Mobile Device Management) capabilities.

Inquiry about Running Enterprise Apps in Killed State and MDM Payload Management:- I am developing an enterprise iOS application that needs to perform specific tasks or network calls even when the app is in a killed state (i.e., when it is not actively running in the foreground or background). I understand that standard iOS restrictions prevent apps from executing code while in this state, but I am exploring potential solutions within the scope of enterprise apps and MDM (Mobile Device Management) capabilities.

I am configuring the per app VPN deployment for iOS application and want to configure the match domain per app rules so that only the traffic from that match domain will trigger the VPN for the included app. I found the documentation on portal but I can't find any MDM related page. https://developer.apple.com/documentation/networkextension/neapprule/1406488-matchdomains

Hi Team, The User Enrollment introduced by Apple back was really great I was trying to test out that .As per the implementation details provided by apple for Simple Authentication - User Enrollment Flow. Below are the steps I followed to implement it. Step 1) Making a /.well-known/com.apple.remotemanagement url and sending a json as for byod which apple has detected successfully. Step 2) Apple making a POST request to BaseServer URL of MDM to get enrollment profile ( At this Step as there is not Authorization header I sent a 401 with WWW-Authenticate header with scheme and url as mentioned by apple) Step 3) Apple has requested With GET to get the html page to show to the user from the url mentioned in WWW-Authenticate header. Step 4) Here there is a tweak the HTML page I actually shown doesn't contains any form as it is for testing purposes. I Simply had a button which upon clicking sends a POST to my url with empty JSON using axios library where from the server I sent a 308 redirect with Location header as mentioned by apple apple-remotemanagement-user-login://authentication-results?access-token=dXNlci1pZGVudGl0eQ Where after I expect the ASWebAuthenticationSession to end and apple to start Second Enrollment attempt with acces token as Authorization Bearer token But the Screen showing the HTML page doesn't go away and neither apple started any steps to get the Enrollment profile from MDM server . Am I commiting any mistakes here.Could you please help on going with it.

I sent the description file through MDM in advance and configured the system extension and web content filter. When my code uses activationRequestForExtension:queue: to activate the system extension, other security app processes will be killed. I received the following message. May I ask why this may be? 2024-09-02 11:42:19.737229 (gui/501/killed_bundleid [679]) : exited due to SIGPIPE | sent by killed_app[679], ran for 301372ms 2024-09-02 11:42:19.737239 (gui/501/killed_bundleid [679]) : service state: exited 2024-09-02 11:42:19.737245 (gui/501/killed_bundleid [679]) : internal event: EXITED, code = 0 2024-09-02 11:42:19.737247 (gui/501/killed_bundleid [679] ]) : job state = exited 2024-09-02 11:42:19.737274 (gui/501 [100003]) : service inactive: killed_bundleid 2024-09-02 11:42:19.737277 (gui/501/killed_bundleid [679]) : service state: not running 2024-09-02 11:42:19.737282 (pid/679 [killed_app]) : shutting down 2024-09-02 11:42:19.737310 (pid/679 [killed_app]) : cleaning up

Hi, Team: Is there any difference in the underlying logic between starting the network filter by configuring the MDM description file through the first connection below and starting the network filter through the second connection in the code? First connection：https://developer.apple.com/documentation/devicemanagement/webcontentfilter?language=objc Second connection： https://developer.apple.com/documentation/networkextension/nefiltermanager?language=objc

I am experiencing issues when pushing the "WiFi Lock" profile via MDM or the "Join only Wi-Fi networks installed by a Wi-Fi payload'" Restriction via Apple configurator 2. I am pushing a WiFi Authentication profile along side it which means that the wifi lock profile is suppose to force the device to only be able to connect to the wifi authentication profile that was pushed to the device via MDM. However, what end up happening, the device "forgets" or does not recognize the pushed wifi auth profile that it has after device reboot. It ends up not showing any available wifi networks and wont allow the device to connect to wifi. The only way i can fix it, is if i push the wifi authentication profile to the device again via cellular. It then remembers it and will connect. But as soon as the device reboots and sometimes it does not even need to reboot it will forget it. What could be going on with this?