We are seeing an issue with Jamf Pro MDM enrollment on macOS 27 running as a virtual machine using VirtualBuddy / Apple Virtualization Framework. The VM itself successfully completes the initial User-Initiated MDM enrollment: Enrolled via DEP: No MDM enrollment: Yes (User Approved) MDM server: https://slsp.jamfcloud.com/mdm/ServerURL The VM also has valid hardware identifiers: Model Identifier: VirtualMac2,1 Chip: Apple M3 (Virtual) Serial Number: present Hardware UUID: present Provisioning UDID: present The Jamf SCEP process completes successfully and the Bootstrap Token is also successfully sent to the Jamf MDM server with HTTP 200. However, the device never becomes fully manageable in Jamf Pro. The Jamf Management Framework is not installed, the jamf binary is missing, MDM commands are not processed, and Jamf Pro reports the device as not managed / without MDM capability. While investigating mdmclient and apsd, I noticed that the APNs public token remains null: Delivering publicToken from apsd: (null) asked for publicToken, got (null) Looking deeper into the apsd logs shows that the failure appears to occur while macOS is attempting to create the identity required for APNs: APSSystemTokenInfo no token info found in keychain APSBAAClientIdentityProvider attempting to fetch BAA certs APSBAAClientIdentityProvider fetching BAA cert SEPClientObject: createKey unable to generate key SecKeyCreateRandomKey_ios failed Code=-25308 "Failed to generate keypair" Failed to create reference key APSBAAClientIdentityProvider failed to obtain a BAA cert After this failure, apsd reports that it does not have an identity available for the connection: underlying identity provider has identity to connect? NO user courier ready to connect? NO told not to connect! The APNs token consequently remains unavailable: APSSystemTokenInfo no token info found in keychain Cached token: (null) No token found in keychain for environment production setting publicToken:(null) I also checked the VM's I/O Registry. AppleKeyStore is present and active, and the VM exposes the expected Apple virtual platform components, including AppleVirtualPlatformIdentityService and AppleVirtualPlatformProvisioningService. The system identifies itself as: VirtualMac2,1 Apple M3 (Virtual) virtual machine for ARM-v8.4 with Apple Silicon extensions However, the APNs identity creation still fails when apsd attempts the SEP-backed key operation. The VM otherwise appears healthy from a boot security perspective: Secure Boot: Full Security System Integrity Protection: Enabled Signed System Volume: Enabled Kernel CTRR: Enabled This issue has also been reproducible for us across multiple macOS 27 builds, including earlier beta builds and the RC. At this point it looks like the MDM enrollment itself succeeds, but macOS 27 inside the VM is unable to create the cryptographic identity required by APNs. Without the APNs device token, the MDM push channel never becomes functional. Has anyone else observed the same SEPClientObject: createKey / APSBAAClientIdentityProvider failure on macOS 27 virtual machines? I would also be interested to know whether this is a known limitation or regression in the macOS 27 Virtualization Framework / virtual platform implementation, particularly around APNs device identity generation.