DESCRIPTION: A macOS device (Version 13 and above), "passcode-is-present" and "passcode-compliant" status items are unsupported. After the Successful Acknowledged of the DeclarativeManagement command, we receive supported client capabilities from the device as a status report. but while analyzing the device-supported client capabilities details represent those two status items are supported. On analyzing the device respond with an error. "device.identifier.udid" status item provided halfway correct udid value exactly not. HOW TO REPRODUCE: Enroll a macOS device in MDM. Send the DeclarativeManagement Command to macOS 13+ devices. The MDM server responds with a DeclarativeManagement Command that should include the SynchronizationTokens JSON data. The device fetches the declarations manifest from the MDM server. While synchronization, we will subscribe the status items (passcode-is-present,passcode-compliant, device.identifier.udid, mdm.app) as configuration. For example, { "Type":"com.apple.configuration.management.status-subscriptions", "Identifier":"85B5130A-4D0D-462B-AA0D-0C3B6630E5AA", "ServerToken":"59eb13b9-5d51-54b9-8a4b-e8abe37c27ee", "Payload":{ "StatusItems":[ { "Name":"passcode.is-present" }, { "Name":"passcode.is-compliant" }, { "Name":"device.identifier.udid" } ] } } Response the above JSON payload to the device, While requesting the "declaration/configuration/****" details from MDM. Note: Before subscribing to the status items ("passcode-is-present" and "passcode-compliant") via Declarative Management, Passcode Configuration Policy should be applied to the mac device. EXPECTED APP: The Passcode Status reports will provide certain values (true/false). The "device.identifier.udid" status item provides the exact UDID same as Command Response. ACTUAL RESULT: The Passcode Status reports did not provide values (true/false), but we are getting the error- { "Errors":[ { "Reasons":[ { "Code":"Error.UnsupportedStatusValue", "Description":"Cannot report status on “passcode.is-present†because value is not supported." } ], "StatusItem":"passcode.is-present" }, { "Reasons":[ { "Code":"Error.UnsupportedStatusValue", "Description":"Cannot report status on “passcode.is-compliant†because value is not supported." } ], "StatusItem":"passcode.is-compliant" } ] } The "device.identifier.udid" status provided UDID to MDM like { "device":{ "identifier":{ "udid":"b486fc***0***5d77*****4********9e60e00000000" } } } and UDID of Command Responses like <key>UDID</key> <string>B486FC***-5***0-5D77-****4-******9E60E</string> Kindly help us with this case.

Problem Description: We are associating 1000 devices to 25 apps using Associate Assets API - https://vpp.itunes.apple.com/mdm/v2/assets/associate We find the association completion state by two ways. Method 1: Using Event Status API - https://vpp.itunes.apple.com/mdm/v2/status We test the success state of event by continuously polling event status API - until it provides COMPLETE/FAILURE in eventStatus. For the above association, the time taken for event Status to give COMPLETE/FAILURE status for the above API is 30 seconds. Improvement Needed: A new type of notification type can be introduced so that on association event completion, the notification request could return the event status response to MDM server without the need to poll the Event Status API from MDM. Method 2: By Subscribing ASSET_MANAGEMENT notification On subscribing ASSET_MANAGEMENT notification in clientConfig API - https://vpp.itunes.apple.com/mdm/v2/client/config, the asset management notification request is enabled. "notificationTypes": [ "ASSET_MANAGEMENT" ] On performing the association, each notification request reaches the MDM server with response in batch of 100 devices per 1 app. Hence, more than 250 notifications requests(including duplicate requests) reaches the MDM server. This takes around 5 mins to complete provide the association results Improvement Needed: The 100 devices status per 1 app for one notification request could be increased to make lesser notification requests and hence improving the time to receive the association response. Hence, currently the Method 1 - using Event Status API provides the association completion response sooner than the Method 2 (Notifications). So, providing a notification type to subscribe for event Status could reduce the long time to provide all association response in ASSET_MANAGEMENT notification and eliminate the need to poll event status from MDM. Kindly consider this request.

“iPhone Findable After Power Off” - This option is available in unsupervised devices given that Find My iPhone is turned on from iOS 15 (Specific device models) when trying to power off the device.  But this option seems to be not available in Supervised devices. Is there any other way to turn this on in Supervised devices? Kindly confirm Is this the expected behaviour in Supervised devices.

Pre Note: This issue not reproducing so promisingly. We cant find its issue source. Its occurring randomly on devices Step 1: After enrolling the device in MDM . try to send a clear passcode command to device . Command : There will be response from device with below format Response: On Checking the MDM Protocol Reference - Protocol Ref I can only able to see “5013 Cannot clear passcode” with respect to this issue. Other than it nothing can be seen in any apple docs too. We dont know why this issue occurs and it is resolved after any pending os update or ReEnrolling devices to MDM. Is there any suggestion regarding this and why this happens for random devices.

Issue Description: The Get Assets VPP License Management API (both 1.0.0 & 2.0.0) should return the assets with the adamIds of Apps available in App Store. For some location tokens, from this API, we get adamIds that are not available in App Store. The contentMetaData API doesn't return any response for these adamIds and they are not B2B apps too. How can we identify if the adamIds are of the apps that are removed from App Store? Or are we missing anything here? Kindly help us with this case. Get Assets URL: https://vpp.itunes.apple.com/mdm/v2/assets

Issue description: In iOS 15+ devices, the enterprise apps ask for update prompt when an update for the app is deployed from MDM even when screen is locked with passcode. The app is running on foreground but the screen is locked in with passcode. Previously, in older iOS versions like iOS 12.0, the enterprise apps will not ask for update prompt when an update is distributed from MDM if screen is locked with passcode(and app running in foreground). Is this an intended behavior or a bug? Kindly help us understand this case. Steps to reproduce. Enroll a iOS (15.0+) device in a MDM. Deploy a enterprise app to device successfully. Open the app in device and lock the screen. Make sure the device has passcode for lock Deploy an update for the same app from the MDM. Expected Result: The app should be installed automatically. Actual Result: The app asks for update prompt in device.

Hi Apple Community , We are a MDM vendor and have been testing around implementing BYOD User Enrollment. Where in a step we felt good to have a list of managed apple ids associated with an Organization which would be helpful in inserting them in the MDM payload for Account-driven User Enrollment. To do this I have used a managed apple id in Apple Buisness Manager with Roles Content Manager, Device Enrolment Manager and People Manager and a MDM server From the MDM Server I used the token and have generated a auth_session_token and used it as Header X-ADM-Auth-Session to end point https://mdmenrollment.apple.com/account GET to get the account details The response contains list of urls of which `https://mdmenrollment.apple.com/roster/class/person' POST was there which when tried gives ORGANIZATION_NOT_SUPPORTED 400 response. we are unable to retrieve the list of users in a Apple Buisness Manager Account at this point. Is there any ways to achieve what we are tend to do. But in the Roster API

DESCRIPTION:  An iOS app - (WhatsApp Business) is not getting updated in device when update is deployed. The InstallApplication command is sent to device successfully and it is Acknowledged but the app is not updating. On analyzing the device logs in console we are getting the error- ["This installation was canceled by the user." UserInfo={NSLocalizedFailureReason=User canceled., NSLocalizedDescription=This installation was canceled by the user] for the app. This is a supervised device and app was not open in foreground too. So ideally the app should update silently without any user interruption but it says that user cancelled. There is no prompt in device too. We are unable to remove and re-install the app since app data will be lost.  HOW TO REPRODUCE:  Enroll a iOS device in MDM.  Deploy a VPP App Store App using MDM to the device.  Wait for an update in App Store and then deploy the update to device of the same VPP App Store app from MDM.  EXPECTED RESULT:  The app should be updated in device.  ACTUAL RESULT:  The app is not updated in device. (Error found in device - This installation was canceled by the user] for the app) InstallApplication Command From MDM: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>InstallApplication;Collection=51084000003072065</string> <key>Command</key> <dict> <key>RequestType</key> <string>InstallApplication</string> <key>iTunesStoreID</key> <integer>1386412985</integer> <key>InstallAsManaged</key> <true/> <key>ManagementFlags</key> <integer>5</integer> <key>Options</key> <dict> <key>PurchaseMethod</key> <integer>1</integer> </dict> <key>ChangeManagementState</key> <string>Managed</string> </dict> </dict> </plist> InstallApplication Response From Device <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>InstallApplication;Collection=51084000003072065</string> <key>Identifier</key> <string>net.whatsapp.WhatsAppSMB</string> <key>State</key> <string>Managed</string> <key>Status</key> <string>Acknowledged</string> <key>UDID</key> <string>*****</string> </dict> </plist> Kindly help us with this case.

Multiple payloads are allowed for App notification settings payload for macOS devices, but for iOS/iPadOS devices they are not allowed. And this restricts us to maintaining/keep track of a single profile having app notifications payload. May I know the reason behind this? Reference : https://developer.apple.com/documentation/devicemanagement/notifications

When we use Migration Assistant to transfer data from one machine to another or when restoring a backup, it breaks the MDM enrollment. Upon checking, we found that as the Identity Certificate in the KeyChain isn't available, the MDM agent is unable to initiate the communication. Is there any way to avoid behavior like this? Thanks in Advance.

We are testing the ACMECertificate payload in Mac 13.1 beta and getting this error. The same payload when sent to iOS works fine. Any help on this would be appreciated. Thanks. FB Raised: FB11736586 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>70e4b45e3c1e</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadOrganization</key> <string>NewComp</string> <key>PayloadIdentifier</key> <string>4565353a3a84</string> <key>PayloadDisplayName</key> <string>ACME</string> <key>PayloadRemovalDisallowed</key> <true/> <key>PayloadContent</key> <array> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>f84ef110e39b</string> <key>PayloadType</key> <string>com.apple.security.acme</string> <key>PayloadOrganization</key> <string>NewComp</string> <key>PayloadIdentifier</key> <string>f84ef110e39b</string> <key>PayloadDisplayName</key> <string>ACME Configuration</string> <key>DirectoryURL</key> <string>https://acmeserver/acme/acme/directory</string> <key>ClientIdentifier</key> <string>test</string> <key>HardwareBound</key> <true/> <key>KeyType</key> <string>ECSECPrimeRandom</string> <key>KeySize</key> <integer>384</integer> <key>Subject</key> <array> <array> <array> <string>1.2.840.113549.1.9.1</string> <string>test@test.com</string> </array> </array> </array> <key>SubjectAltName</key> <dict> </dict> <key>KeyUsage</key> <integer>5</integer> <key>Attest</key> <true/> </dict> </array> </dict> </plist>

Issue Description : Incase, if the app version for the iOS and iPadOS differs like iOS and tvOS how can we get the iPadOS app details in ContentMetaDataLookUp API.  sample contentMetadataURL for iOS : https://uclient-api.itunes.apple.com/WebObjects/MZStorePlatform.woa/wa/lookup?version=2&id=544007664&p=mdm-lockup&caller=MDM&platform=enterprisestore&cc=us&l=en Kindly help us with this case.

In VPP License Mgmt 2.0.0+ API endpoint for creating users - (POST https://vpp.itunes.apple.com/mdm/v2/users/create), what is the use of "email" & "managedAppleId" - keys? We are able to accept the invitation link in any apple id other than the one given during creation of user. Kindly help us understand the purpose of these two keys and how they should be used (separately/together).

In the given WWDC22 video, it is mentioned that if a slot is eSIM, then EID will be returned in that slot’s response. Reference: https://developer.apple.com/videos/play/wwdc2022/10045/#:~:text=During%20WWDC%202021%2C%20we%20introduced,platform%20support%20and%20new%20features Above video’s transcript text: But when tested with iPhone 13 and iPhone 14 models, the ServiceSubscription response contains EID only in any one of the slots in ServiceSubscription query in DeviceInformation   How can we know which SIM slot supports eSIM ?  How can one know which slot’s IMEI should be given to network operator for configuring eSIM ?

Description: Apps over 200MB will not be automatically downloaded in iOS device when deployed from MDM if "Ask If Over 200MB" is set under General -> App Store -> Mobile Data -> App Downloads. Is there a setting available for MDM to force enable "Always Ask" under General -> App Store -> Mobile Data -> App Downloads in iOS devices ? Kindly help us on this use case.