We're working on an iOS app distributed through the App Store and installed on an MDM-enrolled device. Our MDM server uses InstallApplication to take management of the already-installed and running app. On iOS 27 betas 3 and 4, processing this command causes iOS to terminate the app and its extensions with SIGKILL. The same flow and MDM payload work without terminating the app on earlier iOS versions (iOS <=26). Environment OS: iOS 27 betas 3 and 4 Does not happen: iOS 26 or iOS 16.7.15 Device: iPhone SE 2nd Gen Enrollment: MDM-enrolled device Distribution: App Store app App state: Already installed and running when management is requested MDM command: InstallApplication Minimal MDM command The MDM server sends an InstallApplication command for the already-installed app: Attributes = { Removable = false; }; ChangeManagementState = Managed; Identifier = "APP_BUNDLE_ID"; InstallAsManaged = true; ManagementFlags = 1; RequestType = InstallApplication; We also tested the equivalent command using iTunesStoreID = APP_STORE_ID instead of Identifier, and removing InstallAsManaged. The targeted running app was terminated in the same way. Steps to reproduce Install and launch the App Store app as an unmanaged app. Enroll the iPhone in MDM. While the app is running, send the MDM InstallApplication command to take management of the existing installation. Observe the unified logs for mdmd, appstored, manageddeviced, installcoordinationd, and runningboardd. The issue can also be reproduced by initiating the same server-side flow while the app is already in the background. iOS 27 log sequence The command is accepted and appstored starts the managed-app tasks. manageddeviced then attempts to mark the app as managed using a null persona (this differs from iOS <26): The running app has a valid persona. After the failed mapping, installcoordinationd explicitly asks RunningBoard to terminate the app to disassociate that persona: After termination, removing the valid persona also fails. The managed-app task later reports success despite the mapping failures and termination. Earlier iOS comparison As an example, on iOS 16.7.15, using the same MDM command, **iOS routes the request through dmd with persona: default. The app remains alive and receives managed-app change notifications. Expected The existing installation becomes managed without terminating the running app, consistent with the behavior on earlier iOS versions. Actual manageddeviced tries to associate the app with persona (null) and fails with MIInstallerErrorDomain Code 191. That failure causes installcoordinationd to request termination of the app and its extensions to disassociate their valid persona. runningboardd terminates them with SIGKILL (isUserKill=0). The subsequent removal of the only valid persona fails with Code 242, although the managed-app task later reports success. Documentation checked The payload follows the documented InstallApplication flow for taking management of an existing app: Apple Docs WWDC26 app MDM updates We have not found a malformed field that explains the iOS 27-only failure. More info Detailed logs and additional info can be found on the Feedback report.

Watch and learn the road to our future of anyone’s growing business

Two weeks in a loop and hoping a staff member can step in. I'm enrolling my company, Zawaya GCC Advertising & Marketing (Kuwait), as an organization. My D‑U‑N‑S Number is active and correct, and the legal entity details match. The problem: when I first submitted, the applicant name and verification contact on the enrollment form were entered incorrectly. Both are locked on the submitted application.. there's no field for me to edit them, and my Apple Account name itself is already correct, so this isn't something I can fix on my side. Instead I'm stuck in an automated loop: I get an email asking me to upload documents, I upload them, and the response comes back that the applicant name and verification contact are wrong and must be changed.. the exact thing I can't change. Upload → rejected for the locked fields → asked to upload again. Two weeks, no progress. What I've already tried: Requested the correction through support multiple times (no action taken) Re-uploaded the requested documents several times Requested a phone callback three times.. held 2+ hours each with no answer My ask is a single, simple one: please withdraw/cancel this pending enrollment so I can start a fresh one with the correct applicant name and verification contact. I'm the company owner and haven't been charged, so re-submitting is no problem on my end. Case Number: 102912899650 Enrollment ID: PXJF4634XK I'll update this thread the moment anything moves. Thank you to anyone at Apple who can take a look.

Hello, We applied for the Apple Developer Enterprise Program because we develop internal mobile applications intended only for our employees. Our application was rejected without any specific reason being provided. We have opened multiple support cases through Apple Developer Support, but we have not received a response or clear guidance so far. We fully understand that the Apple Developer Forums may not be able to review or approve enrollment applications directly. However, we would appreciate guidance on how to escalate this issue to the appropriate Apple Developer Enterprise Program Enrollment Team. We are fully prepared to provide any required official documentation, institutional verification, authorization letter, MDM/distribution plan, or technical details. Program: Apple Developer Enterprise Program Use case: Internal employee-only applications Support case numbers: 102**946, 102*283, Thank you for your guidance.

I'm hoping an Apple staff member can help resolve a duplicate organization enrollment. There are two enrollments in progress for the same company (same D-U-N-S Number), and I think the conflict is why neither has gone through. An employee submitted the first enrollment; after a long delay with no response, I (the company's director, with binding authority) submitted a second one by mistake. I'd like to keep only mine and cancel the other. Keep (mine, director): NL6K36DN2S Cancel (employee): 9GPJ38H7T5 D-U-N-S is valid and active, legal name and address match, registered LLC with a live website. I'm happy to provide my ID or our company registration to verify my authority. Could someone review and consolidate these? Thank you.

Requesting com.apple.managed-keychain Entitlement for Enterprise S/MIME Cert Visibility Platform: iOS | Distribution: MDM (Microsoft Intune) | Not App Store We are developing an internal enterprise iOS app (EMS Assist, com.company.supportcompanion) for Company deployed exclusively to Intune-managed devices. Our requirement: Read S/MIME certificates pushed to the device via Intune SCEP profiles to: Confirm cert presence in the MDM-managed keychain Read expiry date (kSecAttrNotValidAfter) to warn users before expiry Distinguish between missing, expired, and valid cert states What we have tried: Standard SecItemCopyMatching query — returns only app-installed certs, not MDM-pushed certs Graph API (deviceConfigurationStates) — confirms profile compliance but does not expose actual cert expiry or keychain presence Our understanding: com.apple.managed-keychain is required for an app to access MDM-managed keychain items on supervised devices, combined with a matching keychain-access-groups entitlement and the cert profile configured as "always available" in MDM. Questions: Is com.apple.managed-keychain the correct entitlement for this use case? Does it apply to SCEP/PKCS-issued certificates specifically, or only other MDM keychain items? Has anyone successfully accessed Intune-pushed S/MIME certs from an iOS app using this entitlement? Any guidance from the community or Apple engineers would be appreciated.

Hello, I initiated my request to migrate from individual to organization account more than a week back. I submitted all the documents but still there is no update. Can you please help me with this and expedite the process. Also if you can give me visibility on the state where its stuck at that would be great. My enrollment ID is NL4N2SPXQB.

Hello, My Paid Apps Agreement has been stuck in "In Process" status since May 16, 2026 — now 9 days with no resolution. I have received no emails from Apple regarding this The agreement has not been rejected The system does not allow me to make any edits I have contacted Apple Developer Support twice with no real response

Hello, I'm evaluating possibility to use virtualization to setup on-permise parallel testing system for a product I work on. My compatibility range is wide, i.e. it would cover macOS 12 - 26, so any testcase needs to be executed on at least 5 different OS versions (and introducing any parallization to the test execution would mean I deal with higher number of VMs). As far as I understand, there is a constraint in Apple Software License, that limits number of OS VM installations per one physical system to 2 (section 2.B.(iii)) in case of OS downloaded from the Internet or through App Store. Clearly these days a single high-end Mac hardware could sustain more than 2 VMs running in parallel. The license also mentions it is also possible to be in a volume or maintenance license program and then the terms of this program apply instead. So I wonder how do people normally deal with the above limitation? What is the path I need to follow if I want to be able to run more than "2 additional copies or instances of" macOS on my VMs?

If I have a macOS devices enrolled in MDM, with a DDM policy defined to deliver passcode settings to the device I can run: sudo pwpolicy -getaccountpolicies to see the configuration on the device. I can subsequently run: sudo pwpolicy -clearaccountpolicies Then all passcode policies applied in my declarations are cleared from the device allowing the user to set and use any password they want with no bearing on the delivered passcode settings. I have left my macOS devices for days on and off network and the pwpolicy data never returns. The passcode settings do not restore on the device until I do one of the following: manually re-push all declarations from MDM log off and log back on reboot the computer It was my understanding that DDM was meant to assess device state and self heal on its own without requiring an MDM service to re-push any commands. Based on this finding this seems broken or I may misunderstand how DDM is supposed to work. macOS version: 26.4.1

I have a question regarding MDM functionality for iOS/iPadOS. Background: According to Apple's support page(https://support.apple.com/en-us/125073), since iOS 26.1, "Previous Wi-Fi configurations will be replaced when a new profile is installed." We have observed that because of this change, when we apply a Wi-Fi configuration profile to an iPad via MDM, the manually configured network settings on the device (specifically, "Configure IPv4" and "Configure DNS") are reset to "Automatic". This erases the manually entered IP address, subnet mask, router, and DNS server addresses. Goal: We want to apply a Wi-Fi configuration profile from our MDM server to connect the device to a specific SSID, while preserving the manual IP and DNS settings that have been configured on the device. Question: Is there a way to prevent the IPv4 and DNS settings from being switched from "Manual" to "Automatic" when applying the configuration profile? For example, is there a specific key-value pair we can add to the profile to either preserve the existing manual settings, or to explicitly define manual/static IP settings within the profile itself for iOS/iPadOS? Reference: Sample Configuration Profile Below is a simplified version of the Wi-Fi configuration profile we are currently using. This profile does not contain any keys for IP address configuration. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadContent</key> <array> <dict> <key>PayloadType</key> <string>com.apple.wifi.managed</string> <key>PayloadIdentifier</key> <string>com.apple.wifi.managed.13E2E6B3-D4B9-4E23-888A-524B3ED40C38</string> <key>PayloadUUID</key> <string>13E2E6B3-D4B9-4E23-888A-524B3ED40C38</string> <key>PayloadVersion</key> <integer>1</integer> <key>SSID_STR</key> <string>SSID</string> <key>EncryptionType</key> <string>WPA</string> <key>Password</key> <string>Password</string> </dict> </array> <key>PayloadType</key> <string>Configuration</string> </dict> </plist>

Hi Everyone 🙌 Who knows, additional content that downloads in install time are summarized to total app size in App Store page ? If yes, additional size going to WiFi/Cell download recommendations ? And what the limit ? Will be appreciate of all information, maybe someone using Background Asset extension :pray:

I am looking for guidance on how people have solved this problem/use case. What is the best way to structure a seat based subscription app that an organization can pay for seats for all their users, can be distributed via mdm or via app store and is easy (low friction) to get paid for and started for small companies? I market to a business to buy my app, they want it installed on all 25 devices they have. They use ABM to acquire 25 licenses with and MDM to distribute. The app is currently free to download so ABM charges $0 but has a paywall to use. The paywall is a RevenueCat one and no user account is needed. All entitlements and free trial work great. When it is deployed to the 25 devices, they can either sign up with their own AppleId and own/company credit card, or use a company appleid and company card for all 25 devices to solve the issue but neither are great. Doubtful they would want to pay their money for a company required app on a company phone (don’t blame them). If they share an appleid, my MRR drops to 1/25th since they will just share the purchase. Any suggestions would be greatly appreciated.

Hello, I am facing a recurring issue with Xcode iOS simulator (preview). I want to preview a SwiftUI for iOS in Xcode, but the Simulator app fails to boot up. I receive the following error in Xcode: Cannot Preview in this file. Simulator was shutdown during an update. I have tried the following: Completely uninstalling XCode and deleting all developer data, then reinstalling everthing again. Shutdown and restart Deleting all developer data, deleting XCode cache Reinstalling iOS Simulator runtimes and reconfiguration of simulators. Tested using different simulator and runtime versions. "xcrun simctl --set previews delete al" My reported issues: FB20987522 FB20485454 Thank you Best regards, Jens

Dear Apple Support, We are experiencing an issue where iPhone-only apps (marked as "Designed for iPhone" in the App Store) are not appearing at all in the App Store on newer iPads running iPadOS 26.2 (A16 chip model), including in managed distributions via Apple Business Manager. The app in question is X App, and it works fine on older iPads with previous iPadOS versions. Is there a policy change or stricter enforcement starting from iPadOS 18 or later that prevents iPhone-only apps from being searchable, visible, or assignable on iPad devices (especially supervised/managed ones)? If yes, does the developer need to update the app to Universal or add explicit iPad compatibility in App Store Connect for it to become available again? We would appreciate any official reference or confirmation on this behavior. Thank you for your assistance.

I am beginner to spacial computing and would like to build an enterprise solution for my enterprise on VisionOS. How can I accomplish that?

Issue Description: Apps that support both iOS and tvOS can have different versions in App Store for each type(iOS and tvOS) but same Bundle Identifier and iTunesStoreID/trackID. For example, the iOS version of YouTube has the latest version in App Store as 17.30.3 the tvOS version of YouTube has the latest version in App Store as 2.07.01 This can be verified from two by two specific iTunes look Up API as shown below https://itunes.apple.com/lookup?id=544007664 https://itunes.apple.com/lookup?id=544007664&entity=tvSoftware Sample contentMetadataLookup URL: https://uclient-api.itunes.apple.com/WebObjects/MZStorePlatform.woa/wa/lookup?version=2&id=544007664&p=mdm-lockup&caller=MDM&platform=enterprisestore&cc=us&l=en Queries: What should we do to get the tvOS specific version of an app in contentMetadataLookup URL? The trackViewURL doesn't show tvOS specific version history of the app - https://apps.apple.com/us/app/youtube-watch-listen-stream/id544007664?platform=appleTV . How should we view this the apps' tvOS specific version history? Kindly help us with the queries.

I develop and maintain an app for craft breweries. It is very clearly 18+ due to frequent references of alcohol. Integrating DeclaredAgeRange is pretty straightforward, I should ask for the age signal, and check / require the user to be 18+ to align with my app terms of service. Under the limit, user declined, and unavailable, YOU SHALL NOT PASS. The moment that I introduce the concept of having an 'admin' or 'brewery mode' of that same public app, things break down. Why? Because I would be enabling this brewery or admin mode to run when the app is installed via MDM, and configured via MDM. The downside of this strategy is that Business Essentials for as long as it has listed, has not supported app-based configuration. Neither the legacy configuration, nor the new ManagedApp framework configuration. FB19980558 - Business Essentials: Add Support for Managed App Configuration (via UserDefaults) and newer Managed App Framework (August 2025) FB13398533 - Business Essentials: Add ability to send managed application configuration to an application installed via Apple Small Business Essentials app (November 2023) FB9967549 - Business Essentials: Add ability to send MDM Configuration payload to MDM managed applications (March 2022) There is a real integration issue when trying to use a public app on MDM devices. Making a fully custom app distribution is an option, then don't do Age Assurance in it, but, that doesn't seem to fit with the new regional requirements because even a Custom App is still distributed using App Store technologies and I don't want to argue semantics and play it safe, and a custom app also introduces additional friction for B2B customers that can't just find it on the App Store to buy licenses for the app. In the context of the app being installed via MDM, the user's age range might not be available, after all the device could be 'supervised' and considered company owned--the user might not even be able to sign in. I could be a warehouse iPad shared amongst workers and not really have a singular 'identity'. I'd like Apple to provide a mechanism to enable developers to make apps that do age assurance for standard downloads via DeclaredAgeRange API as it exists today, and, add support for these MDM based installs. I will assume that the App Configuration solution is out of the picture due to the lack of adoption by MDM vendors, including Business Essentials. So the next best thing would be a configuration profile, either a new restriction, or new enablement, that tells the DeclaredAgeRange system missing details. I can't just assume that if I can detect installed via MDM that it is enough and to allow the user to pass when the age signal comes up as notAvailable. I need to go further because of Apple School Manager. With respect to DeclaredAgeRange and MDM I see these scenarios: Installed via Apple School Manager MDM for K-12 - Minor (student) Installed via Apple School Manager MDM for K-12 - Adult (instructor, older student) Installed via Apple School Manager MDM for College - Minor / Adult (student) Installed via Apple School Manager MDM for College - Adult (student | instructor) Then the business side Installed via Apple Business Manager MDM - Adult (employee) Installed via Apple Business Manager MDM - Minor (younger worker, 16+?) In my particular instance, 18+ app with a hard 'you need to be 18' requirement, I'd only want to allow a pass through and more or less 'AgeRangeDeclaration.verifiedByMDM' or something to that nature. I think that Age Assurance should be built into the platform to support ABM and ASM use cases. Assuming that a personal Apple Account can be used by DeclaredAgeRange API when installed via MDM (user-enrolled or supervised), the argument can easily be made to 'just have the user sign in with a personal account'. But for several reasons this won't be feasible at all times. Either due to device restrictions, or a supervised device is shared amongst employees (brewery warehouse / inventory). FB21340165 - DeclaredAgeRange: Add mechanism to determine that no signal is available due to mdm-based install

Hi everyone, I’m trying to verify something mentioned in the WWDC session “Explore enhancements to your spatial business app.” At timestamp 3:36, the presenter states: “You can now access your enterprise license files directly within your Apple Developer account.” I’ve checked every section of my Developer account, including: • Membership and Agreements • Certificates, Identifiers & Profiles • App Store Connect • Additional Resources • Account settings …but no UI or section exposes these enterprise license files. Since the Vision Entitlement Services framework actively checks these licenses (for example, mainCameraAccess entitlement approval), I need to confirm the location of the new license file. Could someone from Apple or anyone who has seen this feature clarify: 1. Where exactly do these enterprise license files appear in the Developer account UI, or 2. Whether this feature has not rolled out yet? Any guidance or screenshots from those who have access would be invaluable. Thanks,