Hi Team, We are trying to set MDM with NETransparentProxyManager to auto-approve the proxy, but it did not work. We have tried the below Apple document for NETransparentProxyManager. https://developer.apple.com/documentation/devicemanagement/vpn/transparentproxy. Attached is the config file. ApplicationProxy.VPN.mobileconfg.txt could you please suggest how to configure NETransparentProxyManager via MDM?

We are configuring a passcode policy through MDM where the password expiration is set to 2 months for local accounts (not domain joined). Occasionally, we receive prompts to change the password a few days before it expires. Please refer to the image below. We would like to clarify the following: What is the default timing for these reminders? Specifically, how many days before the password expiration do these prompts typically start appearing? Can we adjust the number of days before these reminders appear? If yes, can this adjustment be made through MDM settings or via a script?

When a package is published via MDM using the Install Enterprise app command provided by Apple On one of the devices, this command is failing with com.apple.appstored.xpc exception but works fine on other macOS devices having the same restrictions and OS version. We tried restarting the device and also the appstored process via Activity Monitor but it was in vain. I am attaching system logs that contain the exception and stack trace when the command failed. ExceptionLogs

In our Device Configuration Policy (MDM Policy) We have Excluded Domains that should prevent VPN traffic for that domain but it's not working for iOS 17.5.1 but were working before!

We are using JAMF profile to configure automatic proxy configuration URL on macOS. The configuration looks as following: #scutil --proxy <dictionary> { BypassAllowed : 0 ExceptionsList : <array> { 0 : https://exception.com } FTPPassive : 0 FallBackAllowed : 0 HTTPEnable : 0 HTTPSEnable : 0 ProxyAutoConfigEnable : 1 ProxyAutoConfigURLString : https://pac.com/FailbackWithExclusionsENDUSERS.pac SOCKSEnable : 0 } This configuration works fine with normal network. When user tries to connect to a Captive Portal Network, the captive portal login page does not appear but an error page appears as shown below We need help to identify what is wrong with this configuration causing this error.

Using Apple configurator, I cannot transfer over iPhone 8 ( installed iOS 16.7.8) because of this message: Si è verificato un errore inatteso con “iPhone di Sandro”. Impossibile completare l’operazione. Blocco risorsa evitato [NSPOSIXErrorDomain – 0xB (11)] How can I fix it?

Im experiencing an error code 12026 when trying to install an app with iTunes Store ID 1163307568 and has tried various solutions but is still unable to install the app. Tried revoking the licenses and pushing the apps again but the error prompt persists. We have also tried syncing VPP, checking the app license, and purchasing a mild surplus, but still getting the error.

I appreciate any suggestions on a problem we're having. Here's what's happening: We use Visual Studio to create Xamarin and MAUI apps. We have several apps that all have In-House provisioning profiles attached to the same certificate. Developers upload ipa files to our internal website, so our QA team can install and test them. We have done this in this way for several years. As of a month or so ago, one of these apps will not install after download. Under the app icon on the device there is a download icon before the app name, and tapping the icon receives in the error message, "This app cannot be installed because its integrity could not be verified." Something else that stated around the same time is that while the name of our enterprise certificate "iPhone Distribution OurCompanyName" shows in the Signing Identity dropdown. When we select it and open the list again, the list now also has "Unknown (iPhone Distribution OurCompanyName)" as a selection. Timing can't be a coincidence. It must be connected to the problem. I have made new certificates and provisioning profiles (Ad-Hoc and In-House) several times, but nothing I have tried over the past three days has worked. And, as I mentioned, we have many other apps that work just fine.

Is there a way to deploy a client certificate (mTLS) payload with an Application using MDM? What alternatives are there for accomplishing this? A .p12 is fine if that is the only option, however the app would need to import it into it's keychain and delete the .p12 file (or the MDM would need to do so).

The customer is trying to enroll macOS devices to Hexode via Apple Business Manager (without reset). Upon running the command sudo profiles renew -type enrollment, he received the below error. Error: DEP enrollment failed: The cloud configuration server is unavailable. (MDMDeviceEnrollment:103) Upon running the command sudo profiles show -type enrollment in Terminal, he received the following output. Error fetching Device Enrollment configuration: (34006) Error Domain=MCCloudConfigurationErrorDomain Code=34006 "The cloud configuration server is unavailable." UserInfo={CloudConfigurationErrorType=CloudConfigurationFatalError, NSLocalizedDescription=The cloud configuration server is unavailable., NSUnderlyingError=0x6000012f0060 {Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." UserInfo={NSLocalizedDescription=Failed to create reference key., NSUnderlyingError=0x6000012f00c0 {Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create ref key." UserInfo={NSLocalizedDescription=Failed to create ref key., NSUnderlyingError=0x6000012f0150 {Error Domain=NSOSStatusErrorDomain Code=-25308 "failed to generate asymmetric keypair" (errKCInteractionNotAllowed / errSecInteractionNotAllowed:  / Interaction is not allowed with the Security Server.) UserInfo=0x6000009f0440 (not displayed)}}}}}} The device was assigned to the Hexnode server and listed in DEP devices in Hexnode. It seems to be an Intel device and we tried following troubleshooting steps. He said another user tried out the case and was encountering the same errors. He tried the following steps as part of troubleshooting. Installed pending OS updates Re-assigned device to Hexnode server Cleared NVRAM/PRAM Switched networks Turned off firewall and proxies on the device Re-assigned DEP configuration profile to devices Re-configured DEP and APNs Enrolling the device using the enrollment URL does work and he's able to deploy actions as well. He is willing to reset the device and check as well, but he has ~30 devices in ABM that are remote and in use. Since 2 devices encountered the case, he would like to know more about what happened.

We noticed that Apple Login fails if we try to login with Managed Apple ID on iOS 17.2 & 17.3 This issue could have been introduced in iOS 17 but we did not have iOS 17.0 or 17.1 to validate this. There are few prerequisites to this: Should be a supervised device. It can be enrolled in ABM or ASM. Apple ID should be Managed Apple ID Device should have a passcode policy Device should have “allowListedAppBundleIDs” added in the “com.apple.applicationaccess” payload If either of the above conditions are not met, then the issue does not happen. If the device is set up in the above way and we try to login with Managed Apple ID, then the login fails. Please refer the recording at this link: https://drive.google.com/file/d/1XG17loAuH_GB1IyGdwD8txjkHZWqGeD1/view?usp=drive_link We reproduced the issue three times and got the log files: Issue occurred at: 21st March 2024 at 19:54:58 IST a. Log file name: sysdiagnose_2024.03.21_19-55-26+0530_iPhone-OS_iPhone_21D50(07.54.58 pm).tar.gz b. Link: https://drive.google.com/file/d/1nk-cQPrVEZrAUgVmrxPCsSRDd4aNF8eK/view?usp=drive_link Issue occurred at: 21st March 2024 at 19:59:44 IST a. Log file name: sysdiagnose_2024.03.21_20-00-02+0530_iPhone-OS_iPhone_21D50(07.59.44 pm).tar.gz b. Link: https://drive.google.com/file/d/1VPcF77G2SK2c1rBK4S2GbLCAiQEeYPOB/view?usp=drive_link Issue occurred at: 21st March 2024 at 20:03:27 IST a. Log file name: sysdiagnose_2024.03.21_20-03-39+0530_iPhone-OS_iPhone_21D50(08.03.27 pm).tar.gz b. Link: https://drive.google.com/file/d/1zlLLMd0ugJoiZtmpWlarREFDl1vjZoWP/view?usp=drive_link During the above tests, this was the setup Passcode Policy: a. requireAlphanumeric: true b. minLength: 13 c. allowSimple: false allowListedAppBundleIDs: This can be anything but atleast one of them should be enabled. For example a. com.apple.AppStore b. com.apple.MobileAddressBook c. com.apple.calculator d. com.apple.camera e. com.apple.DocumentsApp f. com.apple.facetime What results I expected: The user should be able to login without an issue What results I actually saw: The user does not login We also created a ticket in Feedback assistant in March but haven't received any response: FB13694721

Since the release of macOS 14.0, we have encountered issues with the Content Filtering MDM Payload. This problem is unusual but can be resolved by restarting the system. Prerequisites: macOS 14 or higher Any Mac with a Silicon (ARM) processor Restrictions Payload and Parental Content Filtering Payload must be installed on the device, either manually or through any MDM service Issue Details: When the Parental Content Filtering Payload is removed after installation, it causes internet issues, and browsers display "The site can't be reached". This affects applications as well, with Safari being the only application that continues to work. The issue can be resolved by either re-adding the Content Filtering Payload or restarting the Mac. Links: Restriction Payload: https://drive.google.com/file/d/1buwLFgbjTRXij9ZSv1QrDeRnWbFfKNtq/view?usp=drive_link Content Filtering Payload: https://drive.google.com/file/d/1eAJiBg4N__dML65MRDH7hYCocuTqOCcu/view?usp=drive_link System Logs: https://drive.google.com/drive/folders/1hKKNAoMn_4x1CqMTxz1bPrUucCbftjO9?usp=drive_link Screen Recording: https://drive.google.com/file/d/1uS8CJqe9p9DG9XzhUnIsY35eme4Dxs60/view?usp=drive_link

Hello all, this may not be the right place to get answers for this but not sure where else to put it. Currently we are using the Apple Software lookup service to fetch available iOS updates that can be used to push updates through Declarative Management. This works fine however we have are now running into an issue https://gdmf.apple.com/v2/pmv, does not have a valid SSL certificate, which during the prototyping phase was fine as we turned off SSL cert validation to get the feature to work. Now that we are moving to make this a formal development we need to turn this on, but obviously with the URL having an invalid cert this causes all requests to throw invalid certificate errors (specifically that the root cert isn't trusted, this can also be seen when navigating to the url in a browser. Specifically it returns NET::ERR_CERT_AUTHORITY_INVALID) Is there any chance that the SSL cert for this API can be fixed?

My application supports Custom URL Schema which is used to perform an open operation. My application is used as a helper app for MDM, hence it will be installed as a Managed Application. I want only the other Managed Applications to be able to invoke the Custom URL Schema and not allow it for unmanaged applications. Is there any such provision provided by Apple MDM protocol?

Trying to enroll a device, but during the installation of the enrollment profile getting the error message - The profile (com.xxxxxx.mdm:c1c8048f-1450-447 3-8bba-1c714c4ce492) could not be installed due to an unexpected error. CPProfileManager:-65002"

Hi, It may be a stupid question, but we really wonder if there is a way for MDM to push a unique mTLS cert to our iOS application or if it can populate a client certificate in the iOS where our application can access it. Like browser app, how do browser mTLS certs get pushed? Thanks, Ying

Hi Does anyone know why the ‘allowVPNcreation’ restriction available to supervised devices doesn’t apply to third-party apps? This Support page says it should: https://support.apple.com/en-gb/guide/deployment/dep0f7dd3d8/web Thanks

My application supports Custom URL Schema which is used to perform an open operation. My application is used as a helper app for MDM, hence it will be installed as a Managed Application. I want only the other Managed Applications to be able to invoke the Custom URL Schema and not allow it for unmanaged applications. Is there any such provision provided by Apple MDM protocol?

Hi All, I'm trying to figure out why there's something tucked in the release notes for macOS 15b1 and iOS 18b1 saying: “• Profile-based User Enrollment is no longer supported in macOS 15. For User Enrollment, sign in with a Managed Apple Account in Settings.” If I'm reading this correctly, "UIE" or User Initiated Enrollment in Jamf parlance, will not be possible on macOS 15 and iOS18 going forward... But, there is ZERO mention of this in the video about what's new for Management, or what's new for IT document. I work in higher ed, and sadly, we get a lot of out of band purchases that aren't ADE eligible. And we've been told for years, and continue to be told, that Managed Apple ID's aren't appropriate for Higher Ed. So this is a big deal if this is being removed, and I find it disturbing it's being tucked away in release notes rather than being broadcast in every location. Heck, for small shops that don't have ASM or ABM, this means no MDM (they won't have managed Apple Accounts to enroll, they won't have ADE)? I happen to use a free Jamf Now system for home managing some personal home devices... I won't be able to do this with macOS 15/iOS 18?

Hello, I’ve run into an issue with a configuration profile on my supervised iPhone. I’m wondering if anyone here might be able to help? The profile contains the allowListedAppBundleIDs key within the restrictions payload. My Apple Watch is paired with the iPhone. The iPhone was supervised manually with Apple Configurator, hence the Apple Watch has not been directly supervised itself. The profile works completely as expected when installed on the phone. As soon as the profile is installed on the iPhone, I can witness the apps on the Apple Watch rearrange themselves as some apps are hidden. So clearly the profile is applying its restrictions to the Apple Watch to some degree. My issue however is that apps listed in the whitelist are hidden from the Watch. The apps that are missing from my Watch are Walkie Talkie, Find My Items, Find My Friends, Messages, Alarm, Remote, Now Playing, Sleep, Meditation and Heart Rate. This is despite the following bundle IDs being listed in the whitelist array: com.apple.findmy.findpeople, com.apple.findmy.finddevices, com.apple.HeartRate, com.apple.SessionTrackerApp, com.apple.NanoWorldClock, com.apple.findmy.finditems, com.apple.Mind, com.apple.NanoOxygenSaturation, com.apple.watchmemojieditor com.apple.NanoSleep com.apple.NanoNowPlaying com.apple.noise com.apple.tincan com.apple.NanoRemote com.apple.NanoAlarm com.apple.private.NanoTimer com.apple.NanoStopwatch I’ve done some testing, but not sure what I’ve found really. I’ve so far identified 3 scenarios. Scenario 1: I have the whitelist profile installed on the iPhone. I download an app that appears in the whitelist from my watch (or at least its iPhone version does). The apps show up on the iPhone automatically and can be launched there. These apps cannot be launched on the watch. Scenario 2: I downloaded a few apps to my watch, that didn’t automatically install on my iPhone at the same time. They were on the whitelist. These ones couldn’t be launched from my Watch. I then downloaded them to the iPhone and they could be launched there (since they were on the whitelist). Scenario 3: A couple of 3rd party apps on the whitelist could be downloaded and launched from the watch with the whitelist installed. It seems as though there are different kinds of Apple Watch app and this is what I’ve read elsewhere. First of all there are Watch-only apps, which do not automatically install a companion iPhone app. Secondly there are companion apps, which when installed from the Watch App Store download their companion app to the iPhone in the background. Someone please correct me - I’m bound to be overlooking something here. So maybe the apps that when installed from Watch automatically install on iPhone and can only be launched from the iPhone have a separate bundle ID for their Watch app which I haven’t included? Apps that are on the whitelist AND do not automatically install an iPhone app AND can be launched from the Watch, include: solstice What3words So maybe these do not need a companion app, but have the same Bundle ID as their iPhone app? However, I’m still not sure why many stock Apple Watch apps are missing from the Watch…. The most obvious answer is that I’ve got their Bundle IDs wrong, but I don’t think I have given I extracted the bundle IDs from the App Store pages of the Apple WatchOS apps. I noticed at this Apple Support page (https://support.apple.com/en-gb/guide/deployment/dep34c5cd30f/1/web/1.0) that there is no mention of whitelisting or blacklisting apps on WatchOS using MDM, yet something definitely happens on the watch when the configuration profile is installed on the iPhone. Furthermore, if I tap on a configuration profile, which comprises a blacklist, on my iPhone it will ask me if I want to install it on the iPhone or Watch. The same pop-up question doesn’t happen when the profile contains a whitelist. All this to say, I’m massively confused as to why I can’t get this working. I’d really appreciate anyone’s advice which is bound to be expert. Thank you