Can't install app over cellular (app icon is dark, text says Waiting...)

I'm trying to install an Enterprise App from our MDM, and the installation works over Wifi, but over cellular (and through Wifi, connected to cellular hotspots), we're unable to install it.

Upon connecting it to a Mac and inspecting the messages on the console, I see

appstored[164] <Error>: [UPP1234A123/<bundle-id>]: Denying start, implicitly denied cellular by evalulator

(the misspelling "evalulator" is reproduced exactly)

Why is installation over cellular denied? How is iOS detecting that the iOS is connected through a cellular connection? What workarounds are available?

Hey @tngacker,

Do you happen to know how large the IPA file is that is attempting to be pushed by the MDM to the mobile client? Is it possible that you are hitting a size limit for installing over cellular?

Hopefully this helps!

Hi @ChuckMN,

Thanks for your reply. I feel like its not the size limit issue because the IPA file size is only 4MB. Do you have any other idea? Thanks!

Hey @tngacker & @zhengjuf,

So there is tons of complexity when changing from a WiFi network to a cellular network. Hopefully there is more than 1 device facing the issue to help diagnose where the actual issue is. Also, if you have any additional logs to share from the mobile client, this might be beneficial but understand the confidentiality.

Below are a few thoughts.

  • The cellular network is taking a drastically different path that WiFi altogether. Does the MDM network support both IPv4 and IPv6?
  • Does the application download on ANY WiFi network or just a managed network that is being pushed to the device?
  • WiFi is often "inside" of a Firewall where cellular needs to go through the "Firewall" to get to your content. In order to initiate an application install through MDM, that request goes through Apple services, the streaming of the data itself which is being triggered by appstored during the install process is a stream to where the content is hosted. Are you using a Cloud MDM or a local hosted MDM? Do you have a way to determine if you can get access to the data through a cellular connection?
  • Is the location where the content hosted following all of the TLS requirements and using a valid certificate?
  • Are other applications (Enterprise) applications able to install successfully where this one is not? What are the differences between them if some can install successfully and others cannot?

WiFi and Cellular are using completely different networking paths to get to the content and that is where the problem is most likely lying if one works and one does not. We just need to rule out all of the places where a cellular connection is different from Wifi.

Hopefully this helps in some way!

Thanks @ChuckMN!

On iPads where we don't have Single-App Mode enabled, we will get a popup that says Download "<App>" Using Cellular Data? Using data over a cellular network may incur additional fees..

If we click OK to approve that, the download and installation proceeds smoothly, so is it fair to eliminate issues to do with connectivity to the app download server or TLS certificates?

Is there some way of suppressing this popup and permitting downloads from the MDM?

Hey @tngacker,

This is some good investigative work!

I do think this rules out any connection issues to the data stream from a networking perspective! The device is getting blocked before it can even open up the stream.

Are the devices that you are working with Supervised by chance? If so, I wonder if it would be possible to set another device restriction in order to prevent the user from being prompted with this?

https://support.apple.com/guide/mdm/supervised-restrictions-for-iphone-and-ipad-mdm54960f92a/web

Modify personal Hotspot settings

Modify eSIM settings

Modify cellular plan settings

Modify cellular data app settings

However, I would definitely open up a Feedback with Apple on this as it is a unique edge case.

https://feedbackassistant.apple.com

What I imagine you as the admin are expecting to happen would be for the application to be installed and for the device to go into single-app mode, but due to the "user" having control over the cellular plan you are not able to accomplish this. If the device is supervised and one of the above restrictions cant help with this I think Apple would consider making a change to the protocol to support your use case.

Hopefully one of the above restrictions can help get this solved for you!

Can't install app over cellular (app icon is dark, text says Waiting...)
 
 
Q