Unable to enrol macOS 27 beta VMs in to Jamf

I've been having trouble with Fleet MDM enrollment when I have a macOS 27 beta 4 VM (on macOS 26.6 host) as I can enroll, but push notifications don't seem to be working so no profiles are pushed to the VM. Works fine if I have a Tahoe 26.6 VM. All provisioning is done via a packer build with manual operator install of the MDM enrollment profile. Raised FB23918943 about this and will try again with beta 5.

Thanks for the reply! Sounds like it's not just me ... Sorry, to clarify my original post, the initial MDM management profile does install but then I get no activity over APNS at all... and for Jamf at least (I'm less experienced with other MDMs), the APNS push after enrol is how the jamf management daemon, Self Service app etc get installed and none of that happens.

So to me it does seem like an APNS issue, I just don't know if it's my fault somehow.

I've also raised a Feeback Assistant ticket for this FB24136873

Still not working with macOS 27 beta 5 26A5406e. Had to install Xcode 27 beta 5 in order to build the VM image on macOS 26.6.1.

Still not working on macOS 27 beta 6

This looks to be an APNS establishment problem, below is gathered from system logs from a freshly installed beta6 VM under Virtualization.framework (host on macOS 26.6.1 with DeviceSupport package installed for macOS 27 Beta)

macOS 27.0 beta 6 (26A5416b), Virtualization.framework guest, 25 min uptime, never MDM-enrolled. apsd cannot generate its SEP-backed device identity key, so it never obtains a BAA cert, and the production APNs courier never connects. Whole cascade takes 0.3 ms and repeats for the life of the boot. Deeply nested duplicate UserInfo elided as [...]; nothing else altered.

1. SEP key generation fails (root cause)

02:26:40.335149 apsd: (CryptoTokenKit) [com.apple.CryptoTokenKit:sepkey] <sepk:* kid=0000000000000000>: (apsd) unable to generate key: error e00002e2(-536870174) ACL=<SecAccessControlRef: dk;ock(true);odel(true);osgn(true);oa(true);okd(true)>

1. Security framework surfaces it as errSecInteractionNotAllowed

02:26:40.335306 apsd: (Security) [com.apple.security:seckey] SecKeyCreateRandomKey_ios failed: Error Domain=NSOSStatusErrorDomain Code=-25308 "Failed to generate keypair" (errKCInteractionNotAllowed / errSecInteractionNotAllowed: / Interaction is not allowed with the Security Server.) UserInfo={NSDescription=Failed to generate keypair, NSUnderlyingError= {Code=-25308 "<sepk:* kid=0000000000000000>: unable to generate key", AKSError=-536870174}}

1. Device identity cannot create its reference key

02:26:40.335383 apsd: (DeviceIdentity) Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." UserInfo={NSUnderlyingError={Code=-1 "Failed to create ref key." UserInfo={NSUnderlyingError={Code=-25308 "Failed to generate keypair" [...]}}}}

1. APNs BAA attestation cert therefore cannot be obtained

02:26:40.335396 apsd: [com.apple.apsd:courier] APSBAAClientIdentityProvider failed to obtain a BAA cert, error: Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." [...]

1. APNs refuses the connection

02:26:40.335454 apsd: [com.apple.apsd:courier] <APSCourierConnectionManager: production>: Stream error occurred for <APSCourierConnection>: Error Domain=APSErrorDomain Code=1 "Told not to connect after fetching server bag: (null) - closing stream"

1. Result: no push channel on any interface

02:26:40.335900 apsd: [com.apple.apsd:courier] <APSCourierConnectionManager: production>: Disconnected in response to connection failure on interface NonCellular. (Consecutive failures: 1) isConnected NO onInterface None shouldUseDualChannel NO criticalReliability NO cmaType 1. Connected on 0 interfaces.

1. Still true 19 minutes later, with the network reporting healthy

10:45:30 apsd: [com.apple.apsd:courier] APSUserCourier <APSCourierConnectionManager: production> adjusting connection. Connected on 0 interfaces. Current link quality: wwan is unknown; wifi is good

Counts over 25 minutes of uptime: 16 APSBAAClientIdentityProvider failed to obtain a BAA cert 64 sepkey unable to generate key 16 Told not to connect after fetching server bag 350 Connected on 0 interfaces 0 Connected on 1 or more interfaces <-- the channel never forms, at any point

Before going further, I’d like to check one thing. Let’s say you set up a fresh VM and, before you do the MDM thing, you go into System Settings on the VM and into an Apple Account. Does that work?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Sorry for the delay @DTS Engineer yes I can sign in to an Apple Account via System Preferences although the UX doing that has been weird for some time, this time it asked for the SMS sent 2FA code, then asked for again (rejected on second entering), if I quit System preferences and open it again it shows me as signed in with the standard warning that there are certain iCloud things I can't do on a VM. .. I've seen this ever since we could sign in to this on VMs though so I don't think is indicates any other underlying issue, so in the claude output below that's a red herring I think ..

Claude's investigation output follows:

TEST: does signing in to an Apple Account let apsd mint its SEP-backed BAA identity? ANSWER: No. Failures continue, byte-identical, after a confirmed sign-in.

Environment macOS 27.0 beta 6 (26A5416b), Virtualization.framework guest (rockit VM "ggb6-quinn-test") Never MDM-enrolled: "Enrolled via DEP: No / MDM enrollment: No" Boot 14:50:40. Apple Account sign-in completed ~14:59:04. Log captured to 15:03:11. Sign-in confirmed in System Settings UI: account name shown under "Apple Account".

apsd failure counts, whole boot (13 min) 18 APSBAAClientIdentityProvider failed to obtain a BAA cert 72 sepkey unable to generate key 18 Told not to connect after fetching server bag 377 Connected on 0 interfaces 0 Connected on 1 or more interfaces <-- channel never forms

apsd failure counts, AFTER sign-in only (14:59:04 -> 15:03:11) 2 APSBAAClientIdentityProvider failed to obtain a BAA cert 8 sepkey unable to generate key 2 Told not to connect after fetching server bag 11 Connected on 0 interfaces 0 Connected on 1 or more interfaces <-- still never forms Most recent failure 15:02:11, i.e. ongoing at time of capture.

The post-sign-in error is identical to the pre-sign-in error, same codes: sepkey] <sepk:* kid=0000000000000000>: (apsd) unable to generate key: error e00002e2(-536870174) APSBAAClientIdentityProvider failed to obtain a BAA cert, error: Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." (underlying: NSOSStatusErrorDomain Code=-25308 errSecInteractionNotAllowed)

Additional, non-MDM symptom worth noting With the Apple Account signed in, System Settings reports "Some iCloud Data Isn't Syncing". Note this is an inference, not a proven link: iCloud sync depends on the same APNs push channel, and that channel never forms. It is offered because it shows the impact is not MDM-specific -- a first-party Apple service on a signed-in account is also affected on the same guest.

Also observed: no MobileMeAccounts preference domain and no com.apple.gs.appleid.auth keychain item, despite the UI showing the account as signed in. Consistent with an account that cannot complete its service setup.

the UX doing that has been weird for some time

Indeed. I’ve encountered similar problems and filed my own internal bug about them (r. 183435509).

As to your main issue (FB24136873, FB23918943), I’m still digging into that (delayed because I was OOO last week).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Added FB24608345 with some diagnostics from a VM running macOS 27 beta 8 on a host running macOS 26.6.2. I've installed the latest Xcode beta to allow me to build the VM and still hit the APNs issue. More details are in the Markdown document attached to the feedback. Getting this fixed before GA would be good as our automation workflow depends on getting the VM registered with the MDM server so that we can approve network extensions, etc.

AI analysis of the VM...

The macOS 27 guest's virtualized Secure Enclave fails to generate the BAA attestation keypair (sepk: unable to generate key, kid=0000000000000000). Without BAA certs, apsd's courier connection is refused at the identity step, so APNs never comes up and MDM push is dead. The first profile only installs because enrollment-profile delivery doesn't depend on push.

Added FB24608345 with some diagnostics

Hey hey, that was just what I was about to ask for (-:

Just to be clear, the sysdiagnose log you attached is from the guest, right? Because in this case that’s what we need.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hey Quinn, I've just attached a sysdiagnose from a fresh golden gate beta8 VM to FB24136873

I raised FB on the VM so the sysdiagnose is from the guest rather than the host. Let me know if you need the host side too.

Added sysdiagnose after reproducing the problem on a macOS 27 RC host and VM to FB24608345

I too have run into this. Recent 27.0.1 update does not address the issue.

We are seeing an issue with Jamf Pro MDM enrollment on macOS 27 running as a virtual machine using VirtualBuddy / Apple Virtualization Framework.

The VM itself successfully completes the initial User-Initiated MDM enrollment:

Enrolled via DEP: No
MDM enrollment: Yes (User Approved)
MDM server: https://slsp.jamfcloud.com/mdm/ServerURL

The VM also has valid hardware identifiers:

Model Identifier: VirtualMac2,1
Chip: Apple M3 (Virtual)
Serial Number: present
Hardware UUID: present
Provisioning UDID: present

The Jamf SCEP process completes successfully and the Bootstrap Token is also successfully sent to the Jamf MDM server with HTTP 200.

However, the device never becomes fully manageable in Jamf Pro. The Jamf Management Framework is not installed, the jamf binary is missing, MDM commands are not processed, and Jamf Pro reports the device as not managed / without MDM capability.

While investigating mdmclient and apsd, I noticed that the APNs public token remains null:

Delivering publicToken from apsd: (null)
asked for publicToken, got (null)

Looking deeper into the apsd logs shows that the failure appears to occur while macOS is attempting to create the identity required for APNs:

APSSystemTokenInfo no token info found in keychain
APSBAAClientIdentityProvider attempting to fetch BAA certs
APSBAAClientIdentityProvider fetching BAA cert

SEPClientObject: createKey
unable to generate key

SecKeyCreateRandomKey_ios failed
Code=-25308 "Failed to generate keypair"

Failed to create reference key

APSBAAClientIdentityProvider failed to obtain a BAA cert

After this failure, apsd reports that it does not have an identity available for the connection:

underlying identity provider has identity to connect? NO
user courier ready to connect? NO
told not to connect!

The APNs token consequently remains unavailable:

APSSystemTokenInfo no token info found in keychain
Cached token: (null)
No token found in keychain for environment production
setting publicToken:(null)

I also checked the VM's I/O Registry.

AppleKeyStore is present and active, and the VM exposes the expected Apple virtual platform components, including AppleVirtualPlatformIdentityService and AppleVirtualPlatformProvisioningService.

The system identifies itself as:

VirtualMac2,1
Apple M3 (Virtual)
virtual machine for ARM-v8.4 with Apple Silicon extensions

However, the APNs identity creation still fails when apsd attempts the SEP-backed key operation.

The VM otherwise appears healthy from a boot security perspective:

Secure Boot: Full Security
System Integrity Protection: Enabled
Signed System Volume: Enabled
Kernel CTRR: Enabled

This issue has also been reproducible for us across multiple macOS 27 builds, including earlier beta builds and the RC.

At this point it looks like the MDM enrollment itself succeeds, but macOS 27 inside the VM is unable to create the cryptographic identity required by APNs. Without the APNs device token, the MDM push channel never becomes functional.

Has anyone else observed the same SEPClientObject: createKey / APSBAAClientIdentityProvider failure on macOS 27 virtual machines?

I would also be interested to know whether this is a known limitation or regression in the macOS 27 Virtualization Framework / virtual platform implementation, particularly around APNs device identity generation.