Hi Dear Apple experts, I am hitting a problem (observed from Apr-15, maybe earlier) for renewing ABM/DEP token from my MDM server. My renewal steps: Download public key from my MDM server Upload the public key to the ABM Device Management server instance in ABM portal, and download a new token Upload the new token to my MDM server The problem here is at step-2: If upload the public key to an existing ABM Device Management server instance in ABM portal, then the generated token will be rejected by my MDM server with error "Could not find recipient info"; However, if upload the public key to a newly created ABM Device Management server instance, then everything is good. So, looks to me, it is the token issue when renewing an existing ABM MDM instance. Could you please help take a look? Thanks, Wei

Hi Dear Apple Developer, We had some problem to ping iTunes server since Oct-30, 2024. Previously we can ping the VPP server url http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/wa/wsSearch?media=software&entity=software&country=US&lang=en_us&limit=1&term= w/o any issues, but now it failed. Even if I tried to use "https" to access the above url, it still failed with error "This server could not prove that it is ax.itunes.apple.com; its security certificate is from a248.e.akamai.net. This may be caused by a misconfiguration or an attacker intercepting your connection." And finally ended with this error "Access Denied You don't have permission to access "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/wa/wsSearch?" on this server. Reference #18.55503617.1730815948.be1bde3 https://errors.edgesuite.net/18.55503617.1730815948.be1bde3" Same that we had problem to get VPP app details via url: http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/wa/wsLookup?country=us&id=6445849909 Is there any changes to this url recently? Thanks, Wei

I know that Apple provides MDM software update and upgrade commands to force update/upgrade iOS software, but seems we need user interaction to accept some T&C or give passcode when OS upgrade takes place, on some non-DEP devices. My question is, is there any way that non-DEP OS update/upgrade can go forward with zero-user-interaction? FYI: I get the below information from doc https://support.apple.com/en-sg/guide/deployment/depafd2fad80/web: If a device is assigned in Apple School Manager or Apple Business Manager, users won’t need to review and accept updated operating system terms and conditions to complete the update or upgrade. If there is no passcode on the device, you can complete the installation remotely using your MDM solution. If the device has a passcode, after MDM sends the update or upgrade to the device, the device queues the update or upgrade and the user is prompted to enter their passcode in order to start the installation immediately or defer for an overnight installation. Thanks, Wei

Dear Apple experts, One of our departments is asking if we can procure the premium version of some already installed application but with free version. I can see in Apple Business Manager we can add licenses for the free version to be pushed down with VPP. Within the free version, there are options to purchase the premium version. If our department here purchases premium licenses, is there a way we can push a policy or config that will apply the premium license to the free VPP app that we push down to the iPads? Thanks for your suggestions!

Hi Dear Apple expert, I have a DEP profile defined with "allow_pairing" = false and my iOS DEP devices enrolled to DEP program without any issues. After that, I enabled "allow_pairing" in the DEP settings, but this change won't take effect on my enrolled devices. Is there any method/workaround to bypass the pairing issue on the already enrolled devices(no re-enrollment, no factory reset)? Thanks, Wei

When I push a Wi-Fi policy from my MDM server, if I use payload scope= "User", then I will get 2 keychain entries auto-generated; if payload scope="system", then I can only get 1 keychain entry. I have "UserName" defined in Wi-Fi payload, it will be responsible to create an "802.1X Password" keychain entry, but it does not work when set payload scope = "system": UserName host / xxxxxxx Can any expert help look into this? Why the "802.1X password" is not generated when payload scope = "system"?