We’ve run into what looks like a gap in how forceAirDropUnmanaged is enforced on iOS devices. Setup: Device: iOS 17.x (unsupervised, enrolled in MDM) MDM Restriction: forceAirDropUnmanaged = true Managed Open-In restriction also applied (block unmanaged destinations). Verified: from a managed app, the AirDrop icon is hidden in the share sheet. This part works as expected. Issue: When two iOS devices are brought close together, the proximity-initiated AirDrop / NameDrop flow still allows transfer of photos, videos, or files between devices. In this path, forceAirDropUnmanaged does not appear to apply, even though the same restriction works correctly in the standard sharing pane. What I’d expect: If forceAirDropUnmanaged is enabled, all AirDrop transfer paths (including proximity/NameDrop) should be treated as unmanaged, and thus blocked when “Managed Open-In to unmanaged destinations” is restricted. What I observe instead: Share sheet → AirDrop hidden ✅ Proximity/NameDrop → transfer still possible ❌ Questions for Apple / Community: Is this a known limitation or expected behavior? Is there a different restriction key (or combination) that also covers proximity-based AirDrop? If not currently supported, should this be filed as Feedback (FB) to request alignment between share sheet AirDrop and NameDrop enforcement? This behaviour introduces a compliance gap for organisations relying on MDM to control data exfiltration on unsupervised or user-enrolled devices. Any clarification or guidance would be greatly appreciated.

We are implementing the Return to Service (RTS) with App Preservation flow. During testing, we were able to successfully fetch the Bootstrap Token as part of the ADE enrollment process. However, when attempting to initiate the Return to Service command with App Preservation enabled, the following error was returned: [ { "ErrorCode": 12089, "ErrorDomain": "MDMErrorDomain", "LocalizedDescription": "Could not erase device.", "USEnglishDescription": "Could not erase device." }, { "ErrorCode": 66002, "ErrorDomain": "MDMBootstrapTokenErrorDomain", "LocalizedDescription": "Failed to generate LAContext for bootstrap token", "USEnglishDescription": "Failed to generate LAContext for bootstrap token" } ] Below is the sample request (with dummy data). The actual request contained valid values in all fields: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Command</key> <dict> <key>RequestType</key> <string>EraseDevice</string> <key>ReturnToService</key> <dict> <key>Enabled</key> <true /> <key>WiFiProfileData</key> <data>WiFiProfileData</data> <key>BootstrapToken</key> <data>BootstrapTokenValue</data> <key>MDMProfileData</key> <data>MDM Profile Data</data> </dict> </dict> <key>CommandUUID</key> <string>3670</string> </dict> </plist>

ABM has introduced a target date for moving a device from one MDM server to a new one. However, there's nothing in the API for setting that when you use the API to move MDM server Am I missing something or does it just not exist? Thanks Caroline

Issue Description: Apps that support both iOS and tvOS can have different versions in App Store for each type(iOS and tvOS) but same Bundle Identifier and iTunesStoreID/trackID. For example, the iOS version of YouTube has the latest version in App Store as 17.30.3 the tvOS version of YouTube has the latest version in App Store as 2.07.01 This can be verified from two by two specific iTunes look Up API as shown below https://itunes.apple.com/lookup?id=544007664 https://itunes.apple.com/lookup?id=544007664&entity=tvSoftware Sample contentMetadataLookup URL: https://uclient-api.itunes.apple.com/WebObjects/MZStorePlatform.woa/wa/lookup?version=2&id=544007664&p=mdm-lockup&caller=MDM&platform=enterprisestore&cc=us&l=en Queries: What should we do to get the tvOS specific version of an app in contentMetadataLookup URL? The trackViewURL doesn't show tvOS specific version history of the app - https://apps.apple.com/us/app/youtube-watch-listen-stream/id544007664?platform=appleTV . How should we view this the apps' tvOS specific version history? Kindly help us with the queries.

I am distributing my project as Apple Business Manager, but App Availability gives a Cannot Sell warning in my distribution country and I cannot show my application. My country is Türkiye. Why am I having such a distribution problem? Please I would like detailed information on this subject. Is this a software issue or an issue with my application? My application is currently in 1.0.1 Ready for Sale status and I am trying to distribute my application as Private — Available as a custom app on Apple Business Manager.

Hello, We're testing the new allowedExternalIntelligenceWorkspaceIDs key in the MDM Restrictions payload on supervised iPads. According to Apple's documentation, this key expects an "external integration workspace ID", but it's not clear what this specifically refers to. We've tried the following IDs individually (one at a time, as documentation says only one is supported currently): OpenAI Organization ID ChatGPT user email Apple ID used in ChatGPT Google ID used in ChatGPT login The profile installs correctly via MDM and the key is set, but we want to confirm: What exactly is considered a valid "external integration workspace ID" for this key? Is there a way to verify that the restriction is working as intended on the device (e.g. does it limit specific integrations or apps)? Is there an official list of services that currently support this? Any clarification from Apple or other developers with experience on this would be very helpful. Thanks in advance.

Hello Apple dev world and teams , I am experiencing anormal Waiting for Review for our app, now for more than a week and decided to post the issue here and hopefully get help. We had successfully upgraded to organization membership and the process with Apple support was really enchanting really responsive, hoping to have the same experience with this issue for review also.

When I try to sign in Managed Apple ID in supervised device there appears a prompt stating that "Apple ID" is a work account.This account must be signed in as a work account on this device.When I click continue it takes to VPN and device management tab where MDM profile already exists. Note:The managed Apple ID has a ICloud subscription for it. When I remove the subscription for the Apple ID and try to sign in, it works. Kindly help on this or advise on any additional steps required to enable sign in for managed Apple ID in this scenario

Hello ! Currently, we have customers who use about 5,000 devices. In the case of ios26, the phone number is not acquired overall, and 18.x, 17.x, and 16.x are all acquired in half and not acquired in half. https://developer.apple.com/documentation/devicemanagement/deviceinformationcommand/command-data.dictionary/queries-data.dictionary It seems that it is the right behavior not to acquire it on the specification sheet. However, I wonder when it became impossible to acquire. (There are devices that can be acquired and devices that can't be acquired in the same os version.) Will the devices that are being acquired be blocked someday? When it was developed in 2019, it was in a state that could be acquired in full. I would also like to ask if there is an alternative way to get your phone number. Thank you.

Hello Apple Developer Community, We’re building an MDM product (SaaS, multi-tenant). I’d like clarification on the APNs MDM push certificate usage model for service providers (MSPs). Question: Is it acceptable for an MDM vendor to use a single APNs MDM push certificate owned by the vendor to manage devices for multiple, independent customer organizations? Or is it required/recommended that each customer (company) must obtain and use its own APNs MDM push certificate (issued under the customer’s Apple ID) for their tenant? Why we’re asking: We understand that many guides show the process where each customer logs into the Apple Push Certificates Portal with their own Apple ID, uploads a CSR provided by the MDM, and then renews yearly. Practically, for a small team and early-stage deployments, using one vendor-owned certificate across multiple tenants would be simpler. We want to ensure we’re not violating any policy, terms, or technical requirements (e.g., certificate ownership, topic binding, device token isolation, audit/compliance expectations). What we need from Apple (or authoritative sources): An official Apple document or policy that clearly states whether per-customer certificates are mandatory vs strongly recommended for MSP/multi-tenant MDMs. If per-customer is mandatory, please point to the relevant clause or section. If a vendor uses a single certificate for multiple organizations, what risks or consequences should we expect (e.g., compliance issues, supportability, potential program violations, off-boarding problems, etc.)? Context: We’re sending only MDM wake notifications (standard MDM flow). We understand certificates expire yearly and must be renewed with the same Apple ID to avoid device re-enrollment. We want to follow Apple’s best practices while keeping early operations manageable. Any guidance, links to official documentation, or clarification from Apple engineers/moderators would be greatly appreciated. Thank you!

The situation is as follows: Recently, we upgraded from an individual developer account to a company account about 2–3 weeks ago. When it came time to renew the account, it was strange that the fee displayed was $99 instead of $299. We had no way to change this, so we proceeded with the $99 payment. After that, Apple introduced new terms and conditions. When we tried to accept them, the account status did not change at all. I clicked “Accept” many times, but it remained in pending status. When I checked the browser console (F12), I noticed that Apple was returning a 500 error, but this error was not shown anywhere in the UI. I have called and emailed Apple support many times. However, they insist that our company account is already active and that we just need to accept the terms and conditions. Unfortunately, we are unable to accept them due to the error returned by Apple’s system. I explained this to them, but they still insist that we simply follow their instructions. As a result, we are currently stuck and do not know how to proceed so that the account can be fully activated and our app can return to the Apple App Store: We accepted Apple's terms on the 22nd. Organization account with $99, unclear why: I've clicked accept many times but it didn't work (Apple error 500), and the status remains pending: Therefore, I am hoping to get help from this forum in case anyone has experienced a similar issue and found a solution.

Apple Developer Support The situation is as follows: Recently, we upgraded from an individual developer account to a company account about 2–3 weeks ago. When it came time to renew the account, it was strange that the fee displayed was $99 instead of $299. We had no way to change this, so we proceeded with the $99 payment. After that, Apple introduced new terms and conditions. When we tried to accept them, the account status did not change at all. I clicked “Accept” many times, but it remained in pending status. When I checked the browser console (F12), I noticed that Apple was returning a 500 error, but this error was not shown anywhere in the UI. I have called and emailed Apple support many times. However, they insist that our company account is already active and that we just need to accept the terms and conditions. Unfortunately, we are unable to accept them due to the error returned by Apple’s system. I explained this to them, but they still insist that we simply follow their instructions. As a result, we are currently stuck and do not know how to proceed so that the account can be fully activated and our app can return to the Apple App Store: We accepted Apple's terms on the 22nd. Organization account with $99, unclear why: I've clicked accept many times but it didn't work (Apple error 500), and the status remains pending: Therefore, I am hoping to get help from this forum in case anyone has experienced a similar issue and found a solution.

"To receive payments from Apple, you must add a bank account." As an Apple "Individual" developer, can I accept payments to my corporate card?

Hi Apple Team & Community, The new Introduction of Platform SSO during ADE Enrollment is Great And we tried implementing this. As a Rule mentioned in the Documentation Initially MDM Server should send 403 response with Response Body adhering to ErrorCodePlatformSSORequired when HTTP Header for MachineInfo request contains MDM_CAN_REQUEST_PSSO_CONFIG and set to true There are contradictory claims mentioned in Document, In Process Platform SSO Required Response it is mentioned that MDM Server should send body as JSON Object for ErrorCodePlatformSSORequired Example below >>>>> Response HTTP/1.1 403 Forbidden Content-Type: application/json Content-Length: 558 { "code": "com.apple.psso.required", "description": "MDM Server requires the user to authenticate with Identity Provider - BY MEMDM", "message": "The MDM server requires you to authenticate with your Identity Provider. Please follow the instructions provided by your organization to complete the authentication process - BY MEMDM", "details": { "Package": { "ManifestURL": "https://platform-sso-node-server.vercel.app:443/manifest" }, "ProfileURL": "https://platform-sso-node-server.vercel.app:443/profile", "AuthURL": "https://platform-sso-node-server.vercel.app:443/auth" } } But in the same Document a Sample HTTP Response was Provided but seems to be XML format as below >>>>> Response HTTP/1.1 403 Forbidden Content-Type: application/xml Content-Length: 601 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Code</key> <string>com.apple.psso.required</string> <key>Details</key> <dict> <key>ProfileURL</key> <string>https://mdmserver.example.com/psso.mobileconfig</string> <key>Package</key> <dict> <key>ManifestURL</key> <string>https://mdmserver.example.com/psso-app.plist</string> </dict> <key>AuthURL</key> <string>https://idp.example.com/authenticate</string> </dict> </dict> </plist> From Github I assume that both Response Types are welcomed hence I tried with Both Followed in JSON Mode, I redirected the HTTP request if MachineInfo contains MDM_CAN_REQUEST_PSSO_CONFIG and set to true to https://platform-sso-node-server.vercel.app/redirectedDEPJSON Followed in XML Mode, I redirected the HTTP request if MachineInfo contains MDM_CAN_REQUEST_PSSO_CONFIG and set to true to https://platform-sso-node-server.vercel.app/redirectedDEPXML In both Response Modes OS is not proceeding after and a error Stating Enrollment with Management Server Failed , Forbidden request (403) appears Can someone kindly guide on where I missed, or is this any OS Bug in Tahoe 26?

I have an app on the App Store that includes in-app purchases (a subscription tier). An organization has expressed interest in deploying our app across their devices using Apple Business Manager (ABM) and Intune (MDM) as a VPP-managed app. They would like to purchase and distribute the subscription-based Pro features through Apple Business Manager, but as far as I understand, in-app purchases are not currently supported in VPP deployments. Is there any recommended approach to enable Pro features in this setup? Would appreciate guidance or best practices from others who’ve handled similar use cases. Thanks in advance!

Hello i need help to update my developer account to enterprice account how change o how update the my account ?

I am the sole administrator of a paid company Apple Developer account, and as of today I’m completely locked out everywhere: I cannot sign in to App Store Connect, developer.apple.com, or even account.apple.com. Every login attempt returns either “Please verify your account information and try again” or “This account is locked and can’t be used.” I have never changed my password, Two-Factor Authentication is enabled and delivering codes, there are no pending agreements or banking/tax forms, and I see no unrecognized devices in my account. I’ve tried multiple networks, browsers, and devices, and I’ve already contacted Apple Support—yet no explanation or resolution has been provided. This total lockout is preventing our app submissions from moving forward and putting our entire release schedule at risk. I need: A clear, specific reason why my corporate Developer account has been locked. Any immediate steps or known workarounds to restore full access. Advice from anyone who has faced the same unexplained lockout.

During MDM Automated Device Enrollment of Apple TV, the web view defined by configuration_web_url is not working. We are using the web view to display the usage policy for all devices. While the web view functions correctly for other devices, it is resulting in an error specifically for Apple TV. Could you please clarify whether Apple plans to implement support for this feature on Apple TV in the future or if it will not be supported? Referring to configuration_web_url in: https://developer.apple.com/documentation/devicemanagement/profile

Apple iPad Air device failing to enroll through ABM with "failed to retrieve configuration" error. This error occurs while reaching Apple ABM for fetching MDM server enrollment details. When we checked console logs when enrolling the device we found following error: ​default 13:54:07.229022+1000 teslad Error: Error Domain=MCCloudConfigurationErrorDomain Code=34004 "The cloud configuration server is unavailable or busy." UserInfo={NSLocalizedDescription=The cloud configuration server is unavailable or busy., CloudConfigurationErrorType=CloudConfigurationFatalError} default 13:54:07.229120+1000 Setup Service completed default 13:54:07.230096+1000 Setup Could not retrieve cloud configuration. Error: <Error domain: MCCloudConfigErrorDomain, code 33001>\ Feedback raised along with screenshot and console logs as well : FB17785513. Please analyse this issue and reply back to us.