We are testing the ACMECertificate payload in Mac 13.1 beta and getting this error. The same payload when sent to iOS works fine. Any help on this would be appreciated. Thanks. FB Raised: FB11736586 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>70e4b45e3c1e</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadOrganization</key> <string>NewComp</string> <key>PayloadIdentifier</key> <string>4565353a3a84</string> <key>PayloadDisplayName</key> <string>ACME</string> <key>PayloadRemovalDisallowed</key> <true/> <key>PayloadContent</key> <array> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>f84ef110e39b</string> <key>PayloadType</key> <string>com.apple.security.acme</string> <key>PayloadOrganization</key> <string>NewComp</string> <key>PayloadIdentifier</key> <string>f84ef110e39b</string> <key>PayloadDisplayName</key> <string>ACME Configuration</string> <key>DirectoryURL</key> <string>https://acmeserver/acme/acme/directory</string> <key>ClientIdentifier</key> <string>test</string> <key>HardwareBound</key> <true/> <key>KeyType</key> <string>ECSECPrimeRandom</string> <key>KeySize</key> <integer>384</integer> <key>Subject</key> <array> <array> <array> <string>1.2.840.113549.1.9.1</string> <string>test@test.com</string> </array> </array> </array> <key>SubjectAltName</key> <dict> </dict> <key>KeyUsage</key> <integer>5</integer> <key>Attest</key> <true/> </dict> </array> </dict> </plist>

Issue description: In iOS 15+ devices, the enterprise apps ask for update prompt when an update for the app is deployed from MDM even when screen is locked with passcode. The app is running on foreground but the screen is locked in with passcode. Previously, in older iOS versions like iOS 12.0, the enterprise apps will not ask for update prompt when an update is distributed from MDM if screen is locked with passcode(and app running in foreground). Is this an intended behavior or a bug? Kindly help us understand this case. Steps to reproduce. Enroll a iOS (15.0+) device in a MDM. Deploy a enterprise app to device successfully. Open the app in device and lock the screen. Make sure the device has passcode for lock Deploy an update for the same app from the MDM. Expected Result: The app should be installed automatically. Actual Result: The app asks for update prompt in device.

Pre Note: This issue not reproducing so promisingly. We cant find its issue source. Its occurring randomly on devices Step 1: After enrolling the device in MDM . try to send a clear passcode command to device . Command : There will be response from device with below format Response: On Checking the MDM Protocol Reference - Protocol Ref I can only able to see “5013 Cannot clear passcode” with respect to this issue. Other than it nothing can be seen in any apple docs too. We dont know why this issue occurs and it is resolved after any pending os update or ReEnrolling devices to MDM. Is there any suggestion regarding this and why this happens for random devices.

“iPhone Findable After Power Off” - This option is available in unsupervised devices given that Find My iPhone is turned on from iOS 15 (Specific device models) when trying to power off the device.  But this option seems to be not available in Supervised devices. Is there any other way to turn this on in Supervised devices? Kindly confirm Is this the expected behaviour in Supervised devices.

Issue Description: The Get Assets VPP License Management API (both 1.0.0 & 2.0.0) should return the assets with the adamIds of Apps available in App Store. For some location tokens, from this API, we get adamIds that are not available in App Store. The contentMetaData API doesn't return any response for these adamIds and they are not B2B apps too. How can we identify if the adamIds are of the apps that are removed from App Store? Or are we missing anything here? Kindly help us with this case. Get Assets URL: https://vpp.itunes.apple.com/mdm/v2/assets

Hi Apple Community , We are a MDM vendor and have been testing around implementing BYOD User Enrollment. Where in a step we felt good to have a list of managed apple ids associated with an Organization which would be helpful in inserting them in the MDM payload for Account-driven User Enrollment. To do this I have used a managed apple id in Apple Buisness Manager with Roles Content Manager, Device Enrolment Manager and People Manager and a MDM server From the MDM Server I used the token and have generated a auth_session_token and used it as Header X-ADM-Auth-Session to end point https://mdmenrollment.apple.com/account GET to get the account details The response contains list of urls of which `https://mdmenrollment.apple.com/roster/class/person' POST was there which when tried gives ORGANIZATION_NOT_SUPPORTED 400 response. we are unable to retrieve the list of users in a Apple Buisness Manager Account at this point. Is there any ways to achieve what we are tend to do. But in the Roster API

Problem Description: We are associating 1000 devices to 25 apps using Associate Assets API - https://vpp.itunes.apple.com/mdm/v2/assets/associate We find the association completion state by two ways. Method 1: Using Event Status API - https://vpp.itunes.apple.com/mdm/v2/status We test the success state of event by continuously polling event status API - until it provides COMPLETE/FAILURE in eventStatus. For the above association, the time taken for event Status to give COMPLETE/FAILURE status for the above API is 30 seconds. Improvement Needed: A new type of notification type can be introduced so that on association event completion, the notification request could return the event status response to MDM server without the need to poll the Event Status API from MDM. Method 2: By Subscribing ASSET_MANAGEMENT notification On subscribing ASSET_MANAGEMENT notification in clientConfig API - https://vpp.itunes.apple.com/mdm/v2/client/config, the asset management notification request is enabled. "notificationTypes": [ "ASSET_MANAGEMENT" ] On performing the association, each notification request reaches the MDM server with response in batch of 100 devices per 1 app. Hence, more than 250 notifications requests(including duplicate requests) reaches the MDM server. This takes around 5 mins to complete provide the association results Improvement Needed: The 100 devices status per 1 app for one notification request could be increased to make lesser notification requests and hence improving the time to receive the association response. Hence, currently the Method 1 - using Event Status API provides the association completion response sooner than the Method 2 (Notifications). So, providing a notification type to subscribe for event Status could reduce the long time to provide all association response in ASSET_MANAGEMENT notification and eliminate the need to poll event status from MDM. Kindly consider this request.

DESCRIPTION: A macOS device (Version 13 and above), "passcode-is-present" and "passcode-compliant" status items are unsupported. After the Successful Acknowledged of the DeclarativeManagement command, we receive supported client capabilities from the device as a status report. but while analyzing the device-supported client capabilities details represent those two status items are supported. On analyzing the device respond with an error. "device.identifier.udid" status item provided halfway correct udid value exactly not. HOW TO REPRODUCE: Enroll a macOS device in MDM. Send the DeclarativeManagement Command to macOS 13+ devices. The MDM server responds with a DeclarativeManagement Command that should include the SynchronizationTokens JSON data. The device fetches the declarations manifest from the MDM server. While synchronization, we will subscribe the status items (passcode-is-present,passcode-compliant, device.identifier.udid, mdm.app) as configuration. For example, { "Type":"com.apple.configuration.management.status-subscriptions", "Identifier":"85B5130A-4D0D-462B-AA0D-0C3B6630E5AA", "ServerToken":"59eb13b9-5d51-54b9-8a4b-e8abe37c27ee", "Payload":{ "StatusItems":[ { "Name":"passcode.is-present" }, { "Name":"passcode.is-compliant" }, { "Name":"device.identifier.udid" } ] } } Response the above JSON payload to the device, While requesting the "declaration/configuration/****" details from MDM. Note: Before subscribing to the status items ("passcode-is-present" and "passcode-compliant") via Declarative Management, Passcode Configuration Policy should be applied to the mac device. EXPECTED APP: The Passcode Status reports will provide certain values (true/false). The "device.identifier.udid" status item provides the exact UDID same as Command Response. ACTUAL RESULT: The Passcode Status reports did not provide values (true/false), but we are getting the error- { "Errors":[ { "Reasons":[ { "Code":"Error.UnsupportedStatusValue", "Description":"Cannot report status on “passcode.is-present†because value is not supported." } ], "StatusItem":"passcode.is-present" }, { "Reasons":[ { "Code":"Error.UnsupportedStatusValue", "Description":"Cannot report status on “passcode.is-compliant†because value is not supported." } ], "StatusItem":"passcode.is-compliant" } ] } The "device.identifier.udid" status provided UDID to MDM like { "device":{ "identifier":{ "udid":"b486fc***0***5d77*****4********9e60e00000000" } } } and UDID of Command Responses like <key>UDID</key> <string>B486FC***-5***0-5D77-****4-******9E60E</string> Kindly help us with this case.

DESCRIPTION: A macOS devices (Version 13 and above), "mdm.app" status item will not be supported. why? HOW TO REPRODUCE: Enroll a macOS device in MDM. Send the DeclarativeManagement Command to macOS 13+ devices. The MDM server responds with a DeclarativeManagement Command that should include the SynchronizationTokens JSON data. The device fetches the declarations manifest from the MDM server. While synchronization, we will subscribe the status items (mdm.app) as configuration. For example, { "Type":"com.apple.configuration.management.status-subscriptions", "Identifier":"85B5130A-4D0D-462B-AA0D-0C3B6630E5AA", "ServerToken":"59eb13b9-5d51-54b9-8a4b-e8abe37c27ee", "Payload":{ "StatusItems":[ { "Name":"mdm.app" } ] } } Response the above JSON payload to the device, While requesting the "declaration/configuration/****" details. EXPECTED RESULT: The "mdm.app" status item responds to the current status of the managed app after sending InstallApplication Command to the device. ACTUAL RESULT: The mdm.app status item response is like the following error- { "Errors":[ { "Reasons":[ { "Code":"Error.UnsupportedStatusValue", "Description":"Cannot report status on “mdm.app†because value is not supported." } ], "StatusItem":"mdm.app" } ] } Any help on this would be appreciated. Thanks.

Issue : When applied applock policy to the device, device not shutting down on long press of the power button and volume button. Shut down happens well when the profile is removed from the device. When tested in iPhone, this worked well when the profile is applied Steps to Reproduce : In iPad 16.3 OS , Payload : <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>01d6d9a0-740f-40e4-a521-b97e3d452547</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadOrganization</key> <string>MDM</string> <key>PayloadIdentifier</key> <string>com.mdm.b4033cca-328f-4eab-8bbe-b9224a6ab4ed.singleKioks</string> <key>PayloadDisplayName</key> <string>single Kioks</string> <key>PayloadRemovalDisallowed</key> <true/> <key>PayloadContent</key> <array> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>8533f5c1-fbb6-49fb-88bb-b3cbda8e8bb1</string> <key>PayloadType</key> <string>com.apple.app.lock</string> <key>PayloadOrganization</key> <string>MDM</string> <key>PayloadIdentifier</key> <string>8533f5c1-fbb6-49fb-88bb-b3cbda8 èe8bb1</string> <key>PayloadDisplayName</key> <string>AppLock Policy</string> <key>App</key> <dict> <key>Options</key> <dict> <key>DisableTouch</key> <false/> <key>DisableDeviceRotation</key> <false/> <key>DisableVolumeButtons</key> <false/> <key>DisableRingerSwitch</key> <false/> <key>DisableSleepWakeButton</key> <false/> <key>DisableAutoLock</key> <true/> <key>EnableVoiceOver</key> <false/> <key>EnableZoom</key> <false/> <key>EnableInvertColors</key> <false/> <key>EnableAssistiveTouch</key> <false/> <key>EnableSpeakSelection</key> <false/> <key>EnableMonoAudio</key> <false/> <key>EnableVoiceControl</key> <false/> </dict> <key>UserEnabledOptions</key> <dict> <key>VoiceOver</key> <false/> <key>Zoom</key> <false/> <key>InvertColors</key> <false/> <key>AssistiveTouch</key> <false/> </di µct> <key>Identifier</key> <string>com.apple.AppStore</string> </dict> <key>Identifier</key> <string>com.apple.AppStore</string> </dict> </array> </dict> </plist> -> I have applied the following kiosk profile to the device . -> When pressing the Power button(top Button) and a side volume button, It doesnt shut down the device. -> Whereas, the device when the above profile is removed. the same buttons lead to shut down. -> Same way this was not an issue for the iPhone devices (only iPads doesnt shut down when this profile is applied) Have attached the sysdiagnose logs for the iPad (affected). Kindly help with this case.

We have a device which does not communicate with our MDM server. When we checked the console logs we found that device receives the push notification but does not respond to MDM server. When a restart is performed, it again communicates. From time to time it stops working and we have to restart to bring back communication. Feedback has been raised with sysdiagnose - FB12062214 Any help would be appreciated.

Apple App Store apps that are not purchased in ABM (Non VPP apps) fails while deployed to macOS and tvOS devices from MDM. Since, we can install apps directly from App Store of macOS and tvOS devices just like iOS devices, kindly help us understand why the non VPP apps fails when distributed to tvOS and macOS from devices.

Hi Apple Team, We tend to update the MDM profile Supplied to the Mobile Devices when the Name of the organisation was changed by the customer we change the value of PayloadOrganization. When it comes to User Enrollment The organisation name will be shown in Settings Tab and also in Profiles Page. After performing update in MDM profile The Organisation name in the profile's page have been updated but The Organisation name in settings tab wasn't updated Old Name : APNS_ORG_NAME New Name : NEWNAME1

Description: <key>allowSpotlightInternetResults</key> <dict> <key>value</key> <false/> </dict> <key>allowAssistant</key> <dict> <key>value</key> <false/> </dict> I have added the restriction profile with the above restriction keys and values . along with a App Lock Policy locked to a single app. The problem am facing is, the app was locked to a particular app as per the policy . But User can able to open safari preview search view using the spotlight search. Atached Screenshot for the safarii preview in App Lock Policy Enabled Device

https://developer.apple.com/documentation/devicemanagement/homescreenlayout With Respect to the above link, we have deployed HomeScreenLayout Policy to device with iPadOS Version 16.4. Irrespective of all the os's, we cant able to restrict the App Library , whatever we do. Attached screenshot of the App Library shown in Home screen Layout. Is it possible to restrict this or not . Can anyone help on this.