Post

Replies

Boosts

Views

Activity

Strategies for Age Assurance using DeclaredAgeRange when installed via MDM
I develop and maintain an app for craft breweries. It is very clearly 18+ due to frequent references of alcohol. Integrating DeclaredAgeRange is pretty straightforward, I should ask for the age signal, and check / require the user to be 18+ to align with my app terms of service. Under the limit, user declined, and unavailable, YOU SHALL NOT PASS. The moment that I introduce the concept of having an 'admin' or 'brewery mode' of that same public app, things break down. Why? Because I would be enabling this brewery or admin mode to run when the app is installed via MDM, and configured via MDM. The downside of this strategy is that Business Essentials for as long as it has listed, has not supported app-based configuration. Neither the legacy configuration, nor the new ManagedApp framework configuration. FB19980558 - Business Essentials: Add Support for Managed App Configuration (via UserDefaults) and newer Managed App Framework (August 2025) FB13398533 - Business Essentials: Add ability to send managed application configuration to an application installed via Apple Small Business Essentials app (November 2023) FB9967549 - Business Essentials: Add ability to send MDM Configuration payload to MDM managed applications (March 2022) There is a real integration issue when trying to use a public app on MDM devices. Making a fully custom app distribution is an option, then don't do Age Assurance in it, but, that doesn't seem to fit with the new regional requirements because even a Custom App is still distributed using App Store technologies and I don't want to argue semantics and play it safe, and a custom app also introduces additional friction for B2B customers that can't just find it on the App Store to buy licenses for the app. In the context of the app being installed via MDM, the user's age range might not be available, after all the device could be 'supervised' and considered company owned--the user might not even be able to sign in. I could be a warehouse iPad shared amongst workers and not really have a singular 'identity'. I'd like Apple to provide a mechanism to enable developers to make apps that do age assurance for standard downloads via DeclaredAgeRange API as it exists today, and, add support for these MDM based installs. I will assume that the App Configuration solution is out of the picture due to the lack of adoption by MDM vendors, including Business Essentials. So the next best thing would be a configuration profile, either a new restriction, or new enablement, that tells the DeclaredAgeRange system missing details. I can't just assume that if I can detect installed via MDM that it is enough and to allow the user to pass when the age signal comes up as notAvailable. I need to go further because of Apple School Manager. With respect to DeclaredAgeRange and MDM I see these scenarios: Installed via Apple School Manager MDM for K-12 - Minor (student) Installed via Apple School Manager MDM for K-12 - Adult (instructor, older student) Installed via Apple School Manager MDM for College - Minor / Adult (student) Installed via Apple School Manager MDM for College - Adult (student | instructor) Then the business side Installed via Apple Business Manager MDM - Adult (employee) Installed via Apple Business Manager MDM - Minor (younger worker, 16+?) In my particular instance, 18+ app with a hard 'you need to be 18' requirement, I'd only want to allow a pass through and more or less 'AgeRangeDeclaration.verifiedByMDM' or something to that nature. I think that Age Assurance should be built into the platform to support ABM and ASM use cases. Assuming that a personal Apple Account can be used by DeclaredAgeRange API when installed via MDM (user-enrolled or supervised), the argument can easily be made to 'just have the user sign in with a personal account'. But for several reasons this won't be feasible at all times. Either due to device restrictions, or a supervised device is shared amongst employees (brewery warehouse / inventory). FB21340165 - DeclaredAgeRange: Add mechanism to determine that no signal is available due to mdm-based install
0
0
30
20h