FB9895426 (Apple Device MDM enrolment fails if client certificate is requested during SSL Handshake) Device enrolment fails in an MDM Server configured with client certificate authentication. Upon investigating the issue, we noticed that the device drops the SSL handshake if a client certificate is requested during the handshake. Wireshark Screenshot: From the console logs, we noticed the below error: <MCHTTPRequestor: 0x283b560a0> cannot accept the authentication method NSURLAuthenticationMethodClientCertificate The TLS protocol states that "If no suitable certificate is available, the client SHOULD send a certificate message containing no certificates.". Thus, we expect the MDM client to respond with a "no certificate" response during the SSL handshake. Someone has already raised the same question but there's no reply yet: https://developer.apple.com/forums/thread/680328 https://developer.apple.com/forums/thread/676579 Any help would be appreciated. Thanks in advance.

Hello, I have a working install Home Screen Layout command for a DEP device via an MDM service I work on. The issue is with the system applications. I thought that by specifying a Home Screen Layout via a plist all system applications would appear in alphabetical order on a page / pages beginning after the applications specified for the home screen layout. Instead they appear to fill in gaps in the Home Screen Layout, defeating the point of specifying a layout. Is there a way to configure the system applications to behave in this way? I have attached my working plist (it goes through more formatting to complete the payload, but the content for applications and folders remains). I have also attached images of a device the plist has been applied to. My plist: <array> <dict> <key>Dock</key> <array> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.facebook.Facebook</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.google.b612</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.amazon.AmazonUK</string> </dict> <dict> <key>Type</key> <string>Folder</string> <key>DisplayName</key> <string>Example</string> <key>Pages</key> <array> <array> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.apple.News</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.becrypt.becrypt</string> </dict> </array> </array> </dict> </array> <key>Pages</key> <array> <array> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.apple.MobileSMS</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.mike-ferenduros.Chunky-Comic-Reader</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.argility.flashfigures</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.apple.camera</string> </dict> <dict> <key>Type</key> <string>Folder</string> <key>DisplayName</key> <string>Display Name example</string> <key>Pages</key> <array> <array> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.apple.podcasts</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.linkedin.LinkedIn</string> </dict> </array> </array> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.apple.AppStore</string> </dict> </array> <array> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.microsoft.Office.Outlook</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.apple.Bridge</string> </dict> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.dy.app</string> </dict> </array> <array> <dict> <key>Type</key> <string>Application</string> <key>BundleID</key> <string>com.nhs.online</string> </dict> </array> </array> </dict> </array>

Hi, We have purchased an Apple developer enterprise account for our organization and shared the app download link with our employees. My question is, how to intimate our staff who already installed the app about the latest version of the app? As compared with the Apple store where their app updates/intimate automatically.

Hi, We are creating a Installer package which will be distributed to user through MDM with the InstallApp command. Our distribution package use the Distribution.xml file and InstallerJS to check each flat package version and select the package for install only if there is no receipt or if the already installed package version is older. The package is working fine when using the GUI Installer or through the command line installer. When trying to install the package through MDM, all package which use InstallerJS javascript to decide if it will be install or not will not be selected and thus will not be installed. Is this the expected behaviour? Looking at the install log, I can see that the package selection seems to be done by appstored when installing through MDM. Is appstored not able to understand the InstallerJS script? The documentation specifies that InstallerJS is for the Installer application. https://developer.apple.com/documentation/installer_js If that's the case is there a way to select specific flat package for install when distributing through MDM? Thanks in advance!

I have a Mac Mini 2018 which is not presenting the ABM prompt when I bring my iPhone 12 running Apple Configuration Manager near it. This machine (which has been in use for a few years) has been wiped and has a fresh install of Monterey 12.2 on it. Upon first boot after a fresh reinstall, it goes directly to the "Select your Country or Region" screen (it completely skips the language selection prompt for some reason). I launched ACM on my iPhone 12 and sat it atop the Mac Mini for several minutes, but nothing happened. Is there something I am doing wrong? In case it matters (and knowing my luck, it probably does), I do have the T2 Security Utility configured for "Medium Security" and "Allow Booting from External Media" as I will need to roll back this machine to Catalina after the 30-day grace period completes.

Good morning, We are a startup offering restaurants and retail businesses with a commission free app to help them increase my sale. Can I publish all the apps under my apple developer account (most of them will have the same template) or I will need to publish every app separately in the client's apple developer account?

We recently noticed that, In the TokenUpdate message from a MDM enrolled device, the PushMagic value is empty. The response from device is: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>MessageType</key> <string>TokenUpdate</string> <key>PushMagic</key> <string></string> <key>Token</key> <string>[redacted]</string> <key>Topic</key> <string>[redacted]</string> <key>UDID</key> <string>[redacted]</string> </dict> </plist> This is a MacBookPro9,2 with OS version 10.8.5. We would like to understand whether this is an issue. Or how to handle this.

We are experiencing issues on MDM enrolled devices where the SSL certificates are not trusted after the OS update. We use EnterpriseCA certificate in our server and pushed to devices during enrolment. But after OS update, the CA is missing from the ‘Certificate Trust settings’ in the device, but present under MDM profile. This make the devices to stop communicating with the server. For now we have manually installed the certificate on the devices and enabled full trust. But this involves user intervention and also end user can disable full trust anytime as the option is not greyed out, or remove the certificate from device. We would like to know if there is any other option to push the certificates without user intervention. And also the best practices to avoid this in future. Already we have seen this https://support.apple.com/en-in/HT212962 but it talks only about the Identity certificate. We would like to understand whether SSL certificates are also included in this.

We are trying to push a WiFi mobile config to a fleet of devices. Before mass deployment, we tried manually installing the WiFi mobile config in one Mac device. During manual profile installation It asks for a username-password. (Please see the image) I just click Install without providing anything. The device auto-joins with the WiFi, without asking for username and password We then pushed the same exact mobile config file via a MDM solution, and the profile installs fine. But the device doesn't auto-join the WiFi, and when I choose the WiFi network, it asks for a username and password, even though I have configured SystemModeCredentialsSource to be ActiveDirectory We have double-checked that there're no changes made to mobile config when deployed via MDM. Mobile Config: <dict> <key>AutoJoin</key> <true/> <key>SetupModes</key> <array> <string>System</string> <string>Loginwindow</string> </array> <key>EAPClientConfiguration</key> <dict> <key>AcceptEAPTypes</key> <array> <integer>25</integer> <integer>21</integer> </array> <key>PayloadCertificateAnchorUUID</key> <array> <string>UUID_here</string> <string>UUID_here</string> <string>UUID_here</string> </array> <key>TTLSInnerAuthentication</key> <string>MSCHAPv2</string> <key>SystemModeCredentialsSource</key> <string>ActiveDirectory</string> </dict> <key>EncryptionType</key> <string>WPA2</string> <key>HIDDEN_NETWORK</key> <false/> <key>PayloadDescription</key> <string>Configures Wi-Fi settings</string> <key>PayloadDisplayName</key> <string>Wi-Fi</string> <key>PayloadIdentifier</key> <string>com.test.wifi1</string> <key>PayloadType</key> <string>com.apple.wifi.managed</string> <key>PayloadUUID</key> <string>UUID_here</string> <key>PayloadVersion</key> <integer>1</integer> <key>SSID_STR</key> <string>Test</string> </dict> As a trial and error, We tried providing empty username-password and false to OneTimeUserPassword, in the EAPClientConfiguration, but still when connecting to the WiFi, I'm prompted for username and password. <key>OneTimeUserPassword</key> <false/> <key>UserName</key> <string></string> <key>UserPassword</key> <string></string> We are stuck in this for days. Any help would be appreciated. Please free feel to ask for more details if needed. Thanks in advance.

Hi, I'm trying to get an APNS certificate from the APNS portal, but I'm unable to upload the plist file. Once I choose the plist file and click Upload, nothing happens. Is somebody else facing such issue? I've tried different browsers, and different machines, nothing is working. Any help would be appreciated. Getting some console error -&gt; "pError is not defined" Thanks

My device info is iPhone11 , ios14.6。After I download some app from AppStore, I see that the app size on the device setting storage space page is larger about 11 megabytes than the showed size on the AppStore detail page (while mostly the former is smaller about 5 megabytes than the latter)。So, I want to know , what reasons can result in this case happened ? How can my app enjoy this effect ？

Trying to use the new Apple Configurator and I am seeing it is not going to work on any macOS device below Monterey. This was not mentioned in https://developer.apple.com/videos/play/wwdc2021/10297/ at all. Our company has not moved to Monterey and I am testing on an older device that has Big Sur.

Apple introduces MDM to subscribe to certain events in Apple business manager Apps and Books through specifying the URL in "notificationUrl" filed during client context command. What the best way to design it for a closed network MDM Server How does it work for MDM with a self-signed certificate or enterprise certificate? Will it cause any SSL issues?

Hi, recently we purchased an additional 100 ipads for our school. Unfortunately, they were purchased without my involvement under a apple business account. I need to move them to my apple school manager account so I can manage them with the current mdm and ipads in apple school manager.

According to the Apple Developer Enterprise Program Eligibility the companies can only "Use the program only to create proprietary, in-house apps for internal use, and to distribute these apps privately and securely to employees within the organization" but these companies (Thunkable or Wix) allow to anyone export an app and install in the phone for example https://www.wix.com/branded/apps/ios

I'm using JamfPro Cloud to try out the new Enrollment Flow "Account Driven User Enrollment". I have one domain exsample.com. After authenticating that domain with ABM, I created one user. Then I built apache as a web server for that domain. I set it to be accessible via https and set the JamfPro cloud Enroll URI with ".well-known/com.apple.remotemanagement" as JSON. Then I tried signing in with an exsample.com ABM user from settings> general> VPN and Device Management on my iPhone, and when I ran the apachetop command on the target server and confirmed the request to ".well-known/com. apple.remotemaagement". But then I get the following error: "Your Apple ID does not hae proper privillages to perfom this action" Does this Enrollment Flow assume that the MDM server is on-premise? What's missing in our settings?

I want to publish white label apps for my clients. some of them are not ready to create their own apple developer program account. can I push apps for them with an enterprise account and make the apps available through my website?

This is a translation of Japanese into English by Google. We develop and operate Enterprise App in-house. One day, when I updated one device to iOS 14, the enterprise app couldn't be installed. -The official version of the device that cannot install apps is iOS 14.6. -The distribution method is OTA (On The Air). -A website for installation is available. -The app can be installed on iPads with iOS 13 or lower. -The .ipa file is placed on the IIS server. -The security of the IIS server is TLS 1.2. If you have any other information you need, please leave a comment.