I'm reaching out to discuss a significant issue related to how iOS handles app login sessions, particularly in the context of MDM (Mobile Device Management) and the Outlook app. In our organization, we use MDM to distribute applications, including Outlook, with certificate-based authentication for BYOD (Bring Your Own Device) devices. This setup allows users to log in seamlessly to their accounts. However, we've encountered a concerning behavior: when a user unenrolls from MDM, which automatically removes the distributed apps and certificates, they can later reinstall the app from the App Store and find themselves automatically logged back into their previous accounts without any authentication prompts. Here’s a detailed breakdown of the situation: Initial Installation: Users enroll their devices in MDM, which installs the necessary apps and certificates on those devices. Session Storage: After the initial login, the app stores the session locally on the device. App Deletion: When users un enroll their devices from MDM, it automatically removes the distributed apps and certificates. Reinstallation: Days or weeks later, when they reinstall the Outlook app from the App Store, they find themselves automatically logged back into their accounts. This behavior raises important concerns: Lack of Authentication: The app retaining user sessions even after deletion allows users to access their accounts without re-authentication, which could lead to potential unauthorized access and undermines the effectiveness of certificate-based authentication and two-factor authentication (2FA). Note: This issue is not limited to Outlook; we've observed similar behavior with many other apps. Need for a Solution - Given the implications of this behavior, we are looking for effective solutions to prevent it. Specifically, we need options within the MDM framework to: Restrict Session Retention: Implement settings that ensure any app deleted via MDM will lose all stored sessions and require re-authentication upon reinstallation. Default Settings for MDM-Distributed Apps: Ideally, this would be a default feature for all apps distributed through MDM, ensuring that user sessions are not retained after app deletion. Has anyone else experienced this issue? Are there any existing settings or workarounds within MDM platforms to mitigate this problem? Your insights and experiences would be invaluable as we navigate this challenge. Thank you!

My apple developer account has been changed to organization information but the app store still shows the individual developer name, how to fix it? please help me

We are doing application assignment to personal iOS devices that are enrolled in MDM via User Enrollment. However, we're experiencing some odd behavior when assigning licenses. We are getting back errors from the devices when doing assignments: code: 12064, domain: MDMErrorDomain, description: Could not retrieve licence for the app with iTunes Store ID 422689480. code: 2605, domain: DeviceManagement.error, description: No licence was found for app "com.google.Gmail". However, we are not seeing license exhaustion on the Apple Business Manager side for our location. We are not clear what would cause the 12064 or 2605 errors. We have tried re-sending the command to install the app, and we have tried un-enrolling devices and re-enrolling, as well as updating the VPP Token for the location. We have gathered sysdiagnoses from affected devices, but it's not clear what causes this. What other causes are there for 12064 and 2605 errors? How can we work around these?

We are trying to publish an app on the public App Store that is intended for internal use by our organization. The app does not have a public registration process—accounts are created internally by our organization's system, and users simply sign in. Apple has rejected the app, suggesting to use private distribution methods like Apple Business Manager or the Apple Developer Enterprise Program. However, we would prefer to distribute the app publicly via the App Store for easier access and updates. Has anyone successfully published a public-facing app without a registration feature where account creation is managed internally? Are there any specific strategies or additional features we should add to meet Apple’s requirements while keeping our internal account creation process? Thank you for your insights!

Hello, The issues we previously identified still need your attention. If you have any questions, we are here to help. Reply to this message in App Store Connect and let us know. Review Environment Submission ID: 00fc9b08-3da8-4b89-8810-740174730062 Review date: April 21, 2024 Version reviewed: 1.0 Guideline 3.2.1 - Business - Other Business Model Issues - Acceptable Your app provides financial services but does not meet all the requirements for apps providing these services. Specifically: The app must be published under a seller and company name that is associated with the organization or company providing the services. In this case, your app must be published under a seller name and company name that reflects the Askmefund name. The account that submits the app must be enrolled in the Apple Developer Program as an organization, and not as an individual. These requirements give App Store users confidence that apps offering financial services are qualified to provide these services and will responsibly manage their data. Please provide ownership documentation or modify the vendor seller name. Please Help me.

Hello there, I Have an Apple developer enterprise subscription. I need to put my app on app store in order to deliver it by Citrix secure hub it seems to be necessary for me using "volume purchase program". it seems to be necessary connecting citrix store with apple business manager On these premises, I followed docs and went on App Store Connect site, but there is no "my apps" section on the page as I expected, I can find only a unique section "Users and accesses" and two tabs "people" and "integrations" **How can I submit my app? why exactly I'm not seeing the same on different profile? ** here what I see:

Hello, We have filtering logic that is being loaded into PacketTunnelProvider network extension for processing web traffic. The issue we are facing is the 50MB cap is being hit after browsing a few websites and the OS terminates the PacketTunnelProvider. What would be the best way to tackle this problem? A few ideas come to mind and would appreciate any support on them: using IPC (Inter Process Communication) to move the filtering logic back to the main app (if this is possible) we could move the filtering in Filter Control Provider however the limitation on there is that we cannot perform HTTP response modification which is imperative for the workings of the filtering. We have same solution working fine on Android and app is using about 270MB in worst case (however in Android there is no limit to network extension as the VPN provider runs inside the app) The project target market is in excess of 50,000 devices We would appreciate any support on the matter.

The customer's ABM account has been locked，i can't get token with DEP Server Token.Is there any ways to release device from ABM with some api or softwares. I hope no remote management page during the activation process settings after i restore factory settings. Thanks in advance.

The api url :https://deviceservices-external.apple.com/deviceservicesworkers/escrowKeyUnlock The document url: https://developer.apple.com/documentation/devicemanagement/device_assignment/activation_lock_a_device/creating_and_using_bypass_codes We use the api for past 1+ years, it works well. The api returns 404 not found response since 2022.12.02 <title>404 Not Found</title> </head> <body> <center> <h1>404 Not Found</h1> </center> <hr> <center>Apple</center> </body> </html> We contact apple support via email, but no useful response;

Hello, is there any plan to add a new service type for Privacy Preferences Policy Control profile to allow apps deployed via MDM on Organization owned devices to access local network without prompting end user on Sequoia ? This would be very welcome, especially in education world where students are good at finding on how to block the tools they are supposed to use. I created FB14540495 for reference. Thanks !

I have been running ABM to synchronize devices for some time now, but in recent days, when using the interface for synchronization, the response from the interface to the device's' Device-Assigned-by 'field has changed. The official website should return' The email of the person who assigned the device. 'However, what I received was a string of numbers, such as 275xxxxx, which corresponds to the ABM user's ID. Some devices may change the field to email again when synchronizing, but unfortunately some devices will always have these numbers. How can I recover the email?

I have been running ABM to synchronize devices for some time now, but in recent days, when using interface synchronization, the device's "assembly_assigned-by" field responded by the interface has changed. The official website should return "The email of the person who assigned the device." However, what I received was a string of numbers, such as 275xxxxxxxx. Some devices may change the field to email again when synchronizing, but unfortunately some devices will always have these numbers. How can I recover the email? https://mdmenrollment.apple.com/server/devices https://mdmenrollment.apple.com/devices/sync

When syncing newly added or modified devices in the Apple Business Manager (ABM) portal using the POST request to https://mdmenrollment.apple.com/devices/sync, we are getting an issue when the ABM server account has more than 1000 devices. The response consistently includes 1000 devices, with the ‘more_to_follow’ flag always set to true and the ‘cursor’ value changing. However, subsequent ABM syncs for other devices result in duplicate devices being included in the response, and the ‘more_to_follow’ flag never becomes false. As more_to_follow is always true, we try to hit api continuously. Please refer this for sync API details which is causing issue: https://developer.apple.com/documentation/devicemanagement/sync_the_list_of_devices This issue appears to originate from the Apple ABM side. Any help would be of great use. Thanks in advance.

Hi, My employer has Apple developer account and they want to distribute the application through Microsoft Intune for employees only. However when I checked the MS Intune distribution documentation they have mentioned we should have Apple Enterprise account and distribute the app as In house/ Ad hoc app. To distribute the app through Intune we need to use their wrapping tools which needs IPA generated through enterprise certificate and profile. Employer also has Apple Business Manager account and as per Apple documentation we can distribute the app in organization through ABM. Its really confusing to finalize which path to follow. I need your help to guide me in right direction.

When making a GET request to the ABM Account API at https://mdmenrollment.apple.com/account, we receive a response that includes an org_email field. However, we’ve noticed that the value of org_email varies. Sometimes it corresponds to an account with the role of Administrator, while other times it comes from account with roles Device Enrolment Manager, Content Manager and People Manager. We seek clarification on the following points: Which roles determine the org_email sent in the response? Is the org_email coming in API response always same or does it change when we hit the APIs in multiple times. org_email in this response: https://developer.apple.com/documentation/devicemanagement/accountdetail

Im experiencing an error code 12026 when trying to install an app with iTunes Store ID 1163307568 and has tried various solutions but is still unable to install the app. Tried revoking the licenses and pushing the apps again but the error prompt persists. We have also tried syncing VPP, checking the app license, and purchasing a mild surplus, but still getting the error.

We are trying to develop an app with AppClip functionality because we believe that launching an app with AppClip as the driving force is very good. Since it will be an app for employees, we plan to distribute it via MDM and links, so we will not publish it on the AppStore. I know you said in a past forum that you did not support AppClip 3 years ago, but I would like to know what the current status is. https://developer.apple.com/forums/thread/652854

Hello, I am having trouble distributing the internal app to the Apple Business Manager via the AppStore private distribution. == Steps to reproduce == Create a new app on AppStore Connect Set it as a private distribution and specify the organisation ID Submit the build to the review The app review is approved and "Ready to Distribute" On the distribution tab, it says "This app was removed from sale from the App Store. Go to Pricing and Availability to add it back to the App Store." Sign-in to the Apple Business Manager Enable the custom app in the Apple Business Manager settings Expected: 7-A. The app is listed under the Custom App Observed: 7-B. There is no app listed under the Custom App section == Questions == Is there any other steps for the successful private distribution? Does the organisation receive any email from the App Store Connect to accept the private distirubion? Is there any way to see the status of the custom app from the developer? Is there any Apple support contact I can confirm the status of the app? Thank you for your help in advance!

The customer is trying to enroll macOS devices to Hexode via Apple Business Manager (without reset). Upon running the command sudo profiles renew -type enrollment, he received the below error. Error: DEP enrollment failed: The cloud configuration server is unavailable. (MDMDeviceEnrollment:103) Upon running the command sudo profiles show -type enrollment in Terminal, he received the following output. Error fetching Device Enrollment configuration: (34006) Error Domain=MCCloudConfigurationErrorDomain Code=34006 "The cloud configuration server is unavailable." UserInfo={CloudConfigurationErrorType=CloudConfigurationFatalError, NSLocalizedDescription=The cloud configuration server is unavailable., NSUnderlyingError=0x6000012f0060 {Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." UserInfo={NSLocalizedDescription=Failed to create reference key., NSUnderlyingError=0x6000012f00c0 {Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create ref key." UserInfo={NSLocalizedDescription=Failed to create ref key., NSUnderlyingError=0x6000012f0150 {Error Domain=NSOSStatusErrorDomain Code=-25308 "failed to generate asymmetric keypair" (errKCInteractionNotAllowed / errSecInteractionNotAllowed:  / Interaction is not allowed with the Security Server.) UserInfo=0x6000009f0440 (not displayed)}}}}}} The device was assigned to the Hexnode server and listed in DEP devices in Hexnode. It seems to be an Intel device and we tried following troubleshooting steps. He said another user tried out the case and was encountering the same errors. He tried the following steps as part of troubleshooting. Installed pending OS updates Re-assigned device to Hexnode server Cleared NVRAM/PRAM Switched networks Turned off firewall and proxies on the device Re-assigned DEP configuration profile to devices Re-configured DEP and APNs Enrolling the device using the enrollment URL does work and he's able to deploy actions as well. He is willing to reset the device and check as well, but he has ~30 devices in ABM that are remote and in use. Since 2 devices encountered the case, he would like to know more about what happened.