We have observed that Apple TV doesn't send Ethernet MAC information in DeviceInformation response. (Apple TV is connected to the Ethernet.)
We've confirmed that the following pre requisites are fulfilled on our side.
The queries in Network information queries are available if the MDM host has a Network Information access right. Reference doc - https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf
✓ We have set the maximum access right available (8191).
EthernetMACs - The key to get the Ethernet MAC addresses. This value requires the Network Information access right, and is available in iOS 4 and later, and tvOS 6 and later. Reference doc - https://developer.apple.com/documentation/devicemanagement/deviceinformationcommand/command/queries.
✓ The TV OS version of the device we are referring here is 14+.
✓ The query dictionary contains the EthernetMACs key.
Is this supported for Apple TV devices as mentioned in the documentation?
Please find the attached sample requests and responses.
?xml version="1.0" encoding="UTF-8"?
!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"
plist version="1.0"
dict
keyCommandUUID/key
stringDeviceInformation/string
keyCommand/key
dict
keyRequestType/key
stringDeviceInformation/string
keyQueries/key
array
stringDeviceName/string
stringOSVersion/string
stringBuildVersion/string
stringModelName/string
stringModel/string
stringProductName/string
stringSerialNumber/string
stringDeviceCapacity/string
stringAvailableDeviceCapacity/string
stringBatteryLevel/string
stringCellularTechnology/string
stringIMEI/string
stringMEID/string
stringModemFirmwareVersion/string
stringICCID/string
stringBluetoothMAC/string
stringWiFiMAC/string
stringCurrentCarrierNetwork/string
stringSIMCarrierNetwork/string
stringSubscriberCarrier-Network/string
stringCarrierSettingsVersion/string
stringPhoneNumber/string
stringVoiceRoamingEnabled/string
stringDataRoamingEnabled/string
stringIsRoaming/string
stringSubscriberMCC/string
stringSubscriberMNC/string
stringCurrentMCC/string
stringCurrentMNC/string
stringUDID/string
stringIsSupervised/string
stringIsDeviceLocatorServiceEnabled/string
stringIsActivationLockEnabled/string
stringIsDoNotDisturbInEffect/string
stringiTunesStoreAccountIsActive/string
stringEASDeviceIdentifier/string
stringEthernetMACs/string
stringPersonalHotspotEnabled/string
stringLastCloudBackupDate/string
stringIsCloudBackupEnabled/string
stringIsMDMLostModeEnabled/string
stringServiceSubscriptions/string
stringLanguages/string
stringLocales/string
stringDeviceID/string
stringOrganizationInfo/string
stringAwaitingConfiguration/string
stringMDMOptions/string
stringiTunesStoreAccountHash/string
stringSIMMCC/string
stringSIMMNC/string
stringOSUpdateSettings/string
stringLocalHostName/string
stringHostName/string
stringCatalogURL/string
stringIsDefaultCatalog/string
stringPreviousScanDate/string
stringPreviousScanResult/string
stringPerformPeriodicCheck/string
stringAutomaticCheckEnabled/string
stringBackgroundDownloadEnabled/string
stringAutomaticAppInstallationEnabled/string
stringAutomaticOSInstallationEnabled/string
stringAutomaticSecurityUpdatesEnabled/string
stringIsMultiUser/string
stringMaximumResidentUsers/string
stringPushToken/string
stringDiagnosticSubmissionEnabled/string
stringAppAnalyticsEnabled/string
stringIsNetworkTethered/string
/array
/dict
/dict
/plist
Response to this request
?xml version="1.0" encoding="UTF-8"?
!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"
plist version="1.0"
dict
keyCommandUUID/key
stringDeviceInformation/string
keyQueryResponses/key
dict
keyAwaitingConfiguration/key
false/
keyBluetoothMAC/key
stringxx:xx:xx:xx:xx:xx/string
keyBuildVersion/key
stringxxxxxxx/string
keyDeviceID/key
stringxx:xx:xx:xx:xx:xx/string
keyDeviceName/key
stringxxx/string
keyIsSupervised/key
true/
keyMDMOptions/key
dict/
keyModel/key
stringMR912LL/string
keyModelName/key
stringAppleTV/string
keyOSVersion/key
string14.0.2/string
keyProductName/key
stringAppleTV5,3/string
keySerialNumber/key
stringxxxxxxxxxx/string
keyUDID/key
stringxxxx/string
keyWiFiMAC/key
stringxx:xx:xx:xx:xx:xx/string
keyiTunesStoreAccountIsActive/key
false/
/dict
keyStatus/key
stringAcknowledged/string
keyUDID/key
stringxxx/string
/dict
/plist
Thank you.
MDM iOS Dev
Users receive reputation points by contributing quality content to the forums.
Posts include post and replies published on the forums.
Post authors can mark replies as Accepted to indicate successful solutions.
Apple Developer Forums admins can mark replies as Apple Recommended to indicate an approved solution
Last seen
User for
Post
Replies
Boosts
Views
Activity
Apple had deprecated some of the payload keys device management Profile Specific Payload instead they are given new keys for it blacklistedAppBundleIDs is deprecated and blockedAppBundleIDs added Apple Developer Doc
Are deprecated and new keys are working on the upcoming iOS, iPadOS & Mac.?
When are the deprecated keys going to not support permanently?
We are unable to find a key in the MDM's Device information query response that tells us whether a mac uses T1 or T2 security chip.
Is there a way to deduce this with the device information response we are already receiving?
Thank you.
Hi, We recently noticed that the following Macbook models have the same Model Identifier:
MacBook Air (13-inch, Early 2015)
MacBook Air (13-inch, 2017)
Model Identifier: MacBookAir7,2.
Source
It causes a little confusion to know what model a device is. Is there any other key available in MDM's DeviceInformation to distinguish different Macbook models?
Thanks in advance.
I have an issue where app store app deployed to devices in MDM with App lock policy profile is not updating when the update is pushed from MDM.
Instruction:
Enroll the device(AppleTVs) in MDM, then apply App Lock profile with any one app store app to the device.
After profile is applied successfully and the app is installed, try to push an update for the app from MDM to the device
Expected Result:
The app must be updated to the newer version.
Actual Result:
The app doesn't update in the device.
We are trying to push a WiFi mobile config to a fleet of devices. Before mass deployment, we tried manually installing the WiFi mobile config in one Mac device.
During manual profile installation
It asks for a username-password. (Please see the image)
I just click Install without providing anything.
The device auto-joins with the WiFi, without asking for username and password
We then pushed the same exact mobile config file via a MDM solution, and the profile installs fine.
But the device doesn't auto-join the WiFi, and when I choose the WiFi network, it asks for a username and password, even though I have configured SystemModeCredentialsSource to be ActiveDirectory
We have double-checked that there're no changes made to mobile config when deployed via MDM.
Mobile Config:
<dict>
<key>AutoJoin</key>
<true/>
<key>SetupModes</key>
<array>
<string>System</string>
<string>Loginwindow</string>
</array>
<key>EAPClientConfiguration</key>
<dict>
<key>AcceptEAPTypes</key>
<array>
<integer>25</integer>
<integer>21</integer>
</array>
<key>PayloadCertificateAnchorUUID</key>
<array>
<string>UUID_here</string>
<string>UUID_here</string>
<string>UUID_here</string>
</array>
<key>TTLSInnerAuthentication</key>
<string>MSCHAPv2</string>
<key>SystemModeCredentialsSource</key>
<string>ActiveDirectory</string>
</dict>
<key>EncryptionType</key>
<string>WPA2</string>
<key>HIDDEN_NETWORK</key>
<false/>
<key>PayloadDescription</key>
<string>Configures Wi-Fi settings</string>
<key>PayloadDisplayName</key>
<string>Wi-Fi</string>
<key>PayloadIdentifier</key>
<string>com.test.wifi1</string>
<key>PayloadType</key>
<string>com.apple.wifi.managed</string>
<key>PayloadUUID</key>
<string>UUID_here</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>SSID_STR</key>
<string>Test</string>
</dict>
As a trial and error, We tried providing empty username-password and false to OneTimeUserPassword, in the EAPClientConfiguration, but still when connecting to the WiFi, I'm prompted for username and password.
<key>OneTimeUserPassword</key>
<false/>
<key>UserName</key>
<string></string>
<key>UserPassword</key>
<string></string>
We are stuck in this for days. Any help would be appreciated. Please free feel to ask for more details if needed. Thanks in advance.
We are experiencing issues on MDM enrolled devices where the SSL certificates are not trusted after the OS update.
We use EnterpriseCA certificate in our server and pushed to devices during enrolment. But after OS update, the CA is missing from the ‘Certificate Trust settings’ in the device, but present under MDM profile. This make the devices to stop communicating with the server.
For now we have manually installed the certificate on the devices and enabled full trust. But this involves user intervention and also end user can disable full trust anytime as the option is not greyed out, or remove the certificate from device. We would like to know if there is any other option to push the certificates without user intervention. And also the best practices to avoid this in future.
Already we have seen this https://support.apple.com/en-in/HT212962 but it talks only about the Identity certificate. We would like to understand whether SSL certificates are also included in this.
We recently noticed that, In the TokenUpdate message from a MDM enrolled device, the PushMagic value is empty. The response from device is:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>MessageType</key>
<string>TokenUpdate</string>
<key>PushMagic</key>
<string></string>
<key>Token</key>
<string>[redacted]</string>
<key>Topic</key>
<string>[redacted]</string>
<key>UDID</key>
<string>[redacted]</string>
</dict>
</plist>
This is a MacBookPro9,2 with OS version 10.8.5.
We would like to understand whether this is an issue. Or how to handle this.
FB9895426 (Apple Device MDM enrolment fails if client certificate is requested during SSL Handshake)
Device enrolment fails in an MDM Server configured with client certificate authentication.
Upon investigating the issue, we noticed that the device drops the SSL handshake if a client certificate is requested during the handshake.
Wireshark Screenshot:
From the console logs, we noticed the below error:
<MCHTTPRequestor: 0x283b560a0> cannot accept the authentication method NSURLAuthenticationMethodClientCertificate
The TLS protocol states that "If no suitable certificate is available, the client SHOULD send a certificate message containing no certificates.".
Thus, we expect the MDM client to respond with a "no certificate" response during the SSL handshake.
Someone has already raised the same question but there's no reply yet:
https://developer.apple.com/forums/thread/680328
https://developer.apple.com/forums/thread/676579
Any help would be appreciated. Thanks in advance.
In a iPad device with OS Version 15.1, when deploying a app store app through MDM, the InstallApplication command receives "License Not Found" error in response. The app is not purchased through VPP and the "PurchaseMethod" key is not set in InstallApplication request command.
I have attached a sample request and response of InstallApplication commands.
InstallApplication command:
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CommandUUID</key>
<string>InstallApplication;Collection=xxxx</string>
<key>Command</key>
<dict>
<key>RequestType</key>
<string>InstallApplication</string>
<key>iTunesStoreID</key>
<integer>xxxx</integer>
<key>ManagementFlags</key>
<integer>5</integer>
<key>Configuration</key>
<dict>
<key>ServerName</key>
<string>xxxx</string>
<key>ServerPort</key>
<string>xxxx</string>
<key>UDID</key>
<string>xxxx</string>
<key>ErID</key>
<string>xxxx</string>
<key>IsLanguagePackEnabled</key>
<string>true</string>
<key>authtoken</key>
<string>********</string>
<key>SCOPE</key>
<string>MDMOnDemand/MDMCloudEnrollment</string>
<key>Services</key>
<dict>
<key>urls</key>
<dict>
<key>IOSNativeAppServlet</key>
<string>xxxx</string>
<key>DeviceRegistrationServlet</key>
<string>xxxx</string>
<key>IOSCheckInServlet</key>
<string>xxxx</string>
<key>AppCatalogServlet</key>
<string>xxxx</string>
<key>MDMLogUploaderServlet</key>
<string>xxxx</string>
<key>mdmDocsServlet</key>
<string>xxxx</string>
<key>DFSDownloadURL</key>
<string>xxxx</string>
</dict>
<key>token_name</key>
<string>********</string>
<key>token_value</key>
<string>********</string>
</dict>
<key>IsSyncServerEnabled</key>
<true/>
<key>IsAnnouncementEnabled</key>
<true/>
</dict>
<key>ChangeManagementState</key>
<string>Managed</string>
</dict>
</dict>
</plist>
InstallApplication Response:
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CommandUUID</key>
<string>InstallApplication;Collection=xxxx</string>
<key>ErrorChain</key>
<array>
<dict>
<key>ErrorCode</key>
<integer>1005</integer>
<key>ErrorDomain</key>
<string>DeviceManagement.error</string>
<key>LocalizedDescription</key>
<string>Could not install app.</string>
</dict>
<dict>
<key>ErrorCode</key>
<integer>9610</integer>
<key>ErrorDomain</key>
<string>ASDServerErrorDomain</string>
<key>LocalizedDescription</key>
<string>License not found</string>
</dict>
</array>
<key>Status</key>
<string>Error</string>
<key>UDID</key>
<string>xxxx</string>
</dict>
</plist>
We are facing issues in VPP Client Configuration API ( POST: https://vpp.itunes.apple.com/mdm/VPPClientConfigSrv ).
For some VPP token, the "clientContext" key in the response says "token being used in v2" instead of giving a proper clientContext. These VPP tokens aren't actually added in any other MDM than ours. But it gives this as response. Also, we didn't use the new API for setting VPP Client Configuration too. We are seeing this issue for some VPP tokens in random. We would like to understand this behaviour in VPP tokens.
We are trying to connect macOS devices to Wi-Fi using Wi-Fi configuration profile in MDM. EAP type is PEAP - MSCHAPv2 with both System and LoginWindow setup modes enabled, but unfortunately devices are getting stuck in connecting phase of the Wi-Fi without actually getting connected. We have also send the Sysdiagnose logs to Apple feedback assistance(Ref ID:FB9965644)
Please find the configuration we have used below
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadUUID</key>
<string>5f9c93d0-f2b4-45b2-9367-e65a52d1f1a9</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadOrganization</key>
<string>MDM</string>
<key>PayloadIdentifier</key>
<string>com.mdm.0583c3c2-4fe2-414a-9bc6-87467f0fef02.MacOSWifi</string>
<key>PayloadDisplayName</key>
<string>Wifi_Corp</string>
<key>PayloadRemovalDisallowed</key>
<true/>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadUUID</key>
<string>f962f11d-6524-4061-b93b-82975dd7512b</string>
<key>PayloadType</key>
<string>com.apple.wifi.managed</string>
<key>PayloadOrganization</key>
<string>MDM</string>
<key>PayloadIdentifier</key>
<string>f962f11d-6524-4061-b93b-82975dd7512b</string>
<key>PayloadDisplayName</key>
<string>Wifi Profile Configuration</string>
<key>SSID_STR</key>
<string>--SSID Over Here--</string>
<key>AutoJoin</key>
<true/>
<key>SetupModes</key>
<array>
<string>System</string>
<string>Loginwindow</string>
</array>
<key>HIDDEN_NETWORK</key>
<false/>
<key>EAPClientConfiguration</key>
<dict>
<key>AcceptEAPTypes</key>
<array>
<integer>21</integer>
<integer>25</integer>
</array>
<key>EAPFASTUsePAC</key>
<false/>
<key>EAPFASTProvisionPAC</key>
<false/>
<key>EAPFASTProvisionPACAnonymously</key>
<false/>
<key>UserName</key>
<string>---UserName Over here---</string>
<key>UserPassword</key>
<string>--Password Over here--</string>
<key>TTLSInnerAuthentication</key>
<string>MSCHAPv2</string>
<key>PayloadCertificateAnchorUUID</key>
<array>
<string>b68ceae9-5752-44a3-887c-4dd422428f3d</string>
</array>
</dict>
<key>EncryptionType</key>
<string>Any</string>
<key>ProxyType</key>
<string>None</string>
</dict>
<dict>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadUUID</key>
<string>b68ceae9-5752-44a3-887c-4dd422428f3d</string>
<key>PayloadType</key>
<string>com.apple.security.root</string>
<key>PayloadOrganization</key>
<string>MDM</string>
<key>PayloadIdentifier</key>
<string>b68ceae9-5752-44a3-887c-4dd422428f3d</string>
<key>PayloadDisplayName</key>
<string>iOS Certificate Policy</string>
<key>PayloadContent</key>
<data>
-----Trust Certificate Data Here---
</data>
<key>PayloadCertificateFileName</key>
<string>----Certificate file name.cer----</string>
</dict>
</array>
</dict>
</plist>
After Energy Saver mobileconfig file with Display sleep time as 1 and System Sleep time as 2 successfully, and then when you change the settings in System Preference->Energy Saver manually. The time that was set manually takes effect instead of what MDM has set for MacBook Pro(Intel Chip tried in both Sierra as well as Monterey). Please find the mobileconfig that we tried below.
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Energy Saver</string>
<key>PayloadIdentifier</key>
<string>com.286E9EC9-588D-4BDC-B90C-F4FBAC58A2F0.com.apple.MCX.24D336A4-FE03-493F-81B6-C4CEB640F58F</string>
<key>PayloadType</key>
<string>com.apple.MCX</string>
<key>PayloadUUID</key>
<string>24D336A4-FE03-493F-81B6-C4CEB640F58F</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>com.apple.EnergySaver.portable.ACPower</key>
<dict>
<key>Disk Sleep Timer</key>
<integer>5</integer>
<key>Display Sleep Timer</key>
<integer>1</integer>
<key>System Sleep Timer</key>
<integer>2</integer>
</dict>
<key>com.apple.EnergySaver.portable.BatteryPower</key>
<dict>
<key>Disk Sleep Timer</key>
<integer>5</integer>
<key>Display Sleep Timer</key>
<integer>1</integer>
<key>System Sleep Timer</key>
<integer>2</integer>
</dict>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Energy Saver</string>
<key>PayloadIdentifier</key>
<string>A5406D19-83C6-45B2-B6D2-EF9AF9D59EA8</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>803ABA57-F75B-42EB-9849-15D7EAE7B7FA</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
requireManagedPasteboard - boolean If true, copy and paste functionality respects the allowOpenFromManagedToUnmanaged and allowOpenFromUnmanagedToManagedrestrictions. Also available for user enrollment.
As it is suggested , It doesn't allow the text to be copied from managed apps and pasted in any unmanaged app and also ViceVersa.
But there is an another way to get the text to other Unmanaged/Managed App by highlighting a text from mail content and click on the 'share' option leads the text to be opened in the destination App.
Steps:
Pushed a Managed Account to Native Mail App.
Pushed a Restriction with "requireManagedPasteboard"
Opened a Mail and highlighted the text contents
Click on Share Option . It will list all the app (both Managed and Unmanaged ) to share the text.
I clicked on Notes App. The Highlighted Text got moved to the Notes App.
The Same when tried to Copied and pasted in Notes App. It says "Enabled Restriction for Copy/Paste "
Attached the screenshot where does the "Share" Option appear.
Kindly check whether this is the default behaviour or anything am i missing?
We have sent the payload for restricting all the apps except Youtube and MEMDM app . Payload is listed below.
The Problem is we are restricted all the apps except the apps that were offloaded before . the icon of the offloaded apps appears in the homescreen.
Attached the Screenshot for the above offloaded icons with multiapp kiosk enabled
Is this the expected behaviour?
Or anything am i missing. Can anyone help me with this?
Payload Sent to the Device :->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadUUID</key>
<string>------------</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadOrganization</key>
<string>-----</string>
<key>PayloadIdentifier</key>
<string>----------------</string>
<key>PayloadDisplayName</key>
<string>MultiApp Kiosk</string>
<key>PayloadRemovalDisallowed</key>
<true/>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadUUID</key>
<string>----------------</string>
<key>PayloadType</key>
<string>com.apple.applicationaccess</string>
<key>PayloadOrganization</key>
<string>MDM</string>
<key>PayloadIdentifier</key>
<string>---------------</string>
<key>PayloadDisplayName</key>
<string>AppLock Whitelist Policy</string>
<key>whitelistedAppBundleIDs</key>
<array>
<string>com.google.ios.youtube</string>
<string>com.manageengine.mdm.iosagent</string>
<string>com.apple.webapp</string>
</array>
<key>allowListedAppBundleIDs </key>
<array>
<string>com.google.ios.youtube</string>
<string>com.manageengine.mdm.iosagent</string>
<string>com.apple.webapp</string>
</array>
</dict>
</array>
</dict>
</plist>