We are in the process of replacing the TripleDES algorithm with AES in our MDM solution. However, after switching the encryption algorithm, we encountered the following error on Apple devices during enrollment: Error: "-26275 error decrypting response payload (mdmclient(SCEP))" Do Apple devices support AES encryption during the enrollment process, or are there any known limitations that prevent its use? Technical Details: During enrollment, when the device attempts to install the Management Profile, it requests the MDM server to retrieve the device certificate from the SCEP URL. We send the certificate by creating Enveloped CMS content, using TripleDES as the algorithm identifier. If we switch the algorithm to AES, we observe the error mentioned above. We are also using TripleDES when preparing the CMS content for the enrollment profile, which works without issues.

Under iOS 18.0.1, I can't do any development that uses HTTPS, because I can't authorize my generated certificates on my phone. This was not a problem in the past. Normally you AirDrop a root certificate authority to your phone, install the "profile" for it, and then trust it in Settings / General / About / Certificate Trust Authority. Then you can connect to another server on your network that's using the accompanying certificates. But after sucessfully installing two profiles on my phone, neither shows up in Certificate Trust Authority. Anybody else seeing this? This problem, in combo with this one (which prevents running on my Mac as an iPad app) has completely halted my project. I've found reports of this problem that blamed an empty "common name" field in the certs, but that field is populated in both of these.

Could you please provide guidance on what is required to set up an Apple MDM server from scratch? Specifically, I would like to understand the necessary steps, tools, certifications, and best practices involved in the process. Any resources or documentation you could recommend would also be appreciated.

I have a macOS app with Network Extension. It requests VPN permission with the code like this: self.tunnelManager = [NETunnelProviderManager new]; NETunnelProviderProtocol *protocol = [NETunnelProviderProtocol new]; protocol.providerBundleIdentifier = @"com.myapp.macos.tunnelprovider"; self.tunnelManager.protocolConfiguration = protocol; [self.tunnelManager setOnDemandRules:nil]; [self.tunnelManager setOnDemandEnabled:NO]; [self.tunnelManager setEnabled:YES]; [self.tunnelManager saveToPreferencesWithCompletionHandler:^(NSError * _Nullable saveError) {}]; A lot of my app users are businesses and they would like to have pre-install VPN config. We currently do it like this: <array> <dict> <key>PayloadDisplayName</key> <string>MyAppName</string> <key>PayloadType</key> <string>com.apple.vpn.managed</string> <key>UserDefinedName</key> <string>MyAppName</string> <key>VPN</key> <dict> <key>AuthenticationMethod</key> <string>Password</string> <key>ProviderBundleIdentifier</key> <string>com.myapp.macos.tunnelprovider</string> <key>ProviderDesignatedRequirement</key> <string>anchor apple generic and identifier "com.myapp.macos.tunnelprovider" and (certificate leaf[field.1.2.3] /* exists */ or certificate 1[field.1.2.3] /* exists */ and certificate leaf[field.1.2.3] /* exists */ and certificate leaf[subject.OU] = "123")</string> <key>RemoteAddress</key> <string/> </dict> <key>VPNSubType</key> <string>com.myapp.macos</string> <key>VPNType</key> <string>VPN</string> </dict> </array> Now, if the users installs my app first and allows the VPN permission, then MDM will set the profile above to the user, the user will end up with two VPN profiles in settings. They will be called "My App" and "My App 1" At first we thought it's harmless, but users with two VPN profiles sometimes have app update issues, where after update the newer version of client fails to communicate with the older version of tunnel, it cannot even tell it to quit. The tunnel must be force-quit by the user in this case. We suspect two profiles to be the reason for that. Is there a way to make sure duplicate VPN profiles do not happen?

Hello Team, I want to know if there's a way to uninstall System Extension without prompting the user for authorisation. These are ways I found to uninstall System Extension The deactivationRequest api prompts the user for uninstalling System extension. If I use Apple script to drag and drop the application[which is embedded with System Extension] to trash also prompts the user. The only workaround that doesn't prompt is by disabling SIP and using the systemextensionsctl uninstall command. I want to know if there's any other solution that can uninstall System Extension without prompting the user for authorisation. Thanks!

macOS devices- dep enrolled device - configured an email policy and it gets stuck on pending status. The rest of the policies and actions like lock device and scan device are executed successfully. While enrollment using DEP, if there is account creation config present in Dep configuration profile , At the time of enrollment we don't receive the user token and user channel is not present. The keys UserID and EnrollmentUserID in TokenUpdate is not present. As a result we can't successfully push the email policy. Is the inference correct or is there anything else we are missing out.

Hi everyone, We are currently integrating Apple DDM into our existing MDM system and encountered an issue where an update to a declaration failed with the message: "Activation xxxxx is missing configurations." While we know how to fix the issue, I'm quite concerned about potential impacts. An incorrect activation could deactivate the current one, leading to the automatic removal of all profiles and apps. Given that unexpected server errors can occasionally occur, this could significantly impact end-users if their apps are suddenly removed. I'm looking for a way to prevent activations from "failing to update then lost everything" or a safer method to deploy updated version of activations, especially given the potential for unexpected server errors or logic bugs. This could significantly affect end-users if their apps suddenly disappear. If anyone has any insights, thoughts, or best practices to share regarding activation updates, I would greatly appreciate your input. Leo Chan

I would like to contact about an issue with the iOS 18 update. With the release of the new iPhone 16, camera controls have been added. however, when using MDM, there is an issue where the camera control button settings change after blocking and unblocking the camera. 1. If the camera control button is originally set to 'Camera', when you block and unblock the camera through MDM, the button setting changes to 'None'. Shouldn't the camera control settings be maintained even after blocking and unblocking the camera? If this is a known issue, can you tell me when it will be fixed and updated?

Opening a fresh post as the other seem old/abandoned. I’m trying to add a fail-safe URLprobe to DNS setting profile (DNS over http) for the case that the iPhone/iPad connects to a wifi hotspot with captive portal without internet access. I use OnDemandRules to circumvent known problematic SSID names a specific (wildcard) domains - both working just fine and the requests are falling-back to a system resolver for such a requests. I’ve added a URLStringProbe which supposed to check availability of the internet. The probe should trigger on 200 OK response code and use the DNSSettings or fallback to a system resolver in the case of any other outcome, according to the documentation: A URL to probe. If this URL is successfully fetched (returning a 200 HTTP status code) without redirection, this rule matches. https://developer.apple.com/documentation/devicemanagement/dnssettings/ondemandruleselement https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf Tested on iPhone 14 (iOS 18.1) but it doesn’t work. I’m using Clouflare https://1.1.1.1/index.html for the sake of simplicity and do some adjustment in IP/path for testing purposes using https to enforce TLS (to avoid hijack/MitM from a captive portal) using a direct IP (in this case Cloudflare) so I don't need to resolve a domain to execute the probe itself Anyway, I’ve changed the URL for a testing purposes to return either 404, redirect or timeout and in all cases cases the probe acts the same way like for 200 OK response. My expectation is that probe should test negative and go to next rule which is &lt;key&gt;Action&lt;/key&gt; &lt;string&gt;Disconnect&lt;/string&gt; and thus use the system resolver which will allow the system to detect a captive portal and display sign-in popup to the captive portal Any idea where might be the issue? Example 1 - with all rules &lt;key&gt;DNSSettings&lt;/key&gt; &lt;dict&gt; &lt;key&gt;DNSProtocol&lt;/key&gt; &lt;string&gt;HTTPS&lt;/string&gt; &lt;key&gt;ServerURL&lt;/key&gt; &lt;string&gt;https://dnsserverexample.com/v1/something/id/dns-query&lt;/string&gt; &lt;key&gt;ServerAddresses&lt;/key&gt; &lt;array/&gt; &lt;key&gt;SupplementalMatchDomains&lt;/key&gt; &lt;array/&gt; &lt;/dict&gt; &lt;key&gt;ProhibitDisablement&lt;/key&gt; &lt;true/&gt; &lt;key&gt;OnDemandRules&lt;/key&gt; &lt;array&gt; &lt;dict&gt; &lt;key&gt;Action&lt;/key&gt; &lt;string&gt;Disconnect&lt;/string&gt; &lt;key&gt;SSIDMatch&lt;/key&gt; &lt;array&gt; &lt;string&gt;whitelistedSSID1&lt;/string&gt; &lt;string&gt;whitelistedSSID1&lt;/string&gt; &lt;/array&gt; &lt;/dict&gt; &lt;dict&gt; &lt;key&gt;Action&lt;/key&gt; &lt;string&gt;EvaluateConnection&lt;/string&gt; &lt;key&gt;ActionParameters&lt;/key&gt; &lt;array&gt; &lt;dict&gt; &lt;key&gt;DomainAction&lt;/key&gt; &lt;string&gt;NeverConnect&lt;/string&gt; &lt;key&gt;Domains&lt;/key&gt; &lt;array&gt; &lt;string&gt;*.whitelisteddomainexample.com&lt;/string&gt; &lt;string&gt;*.whitelisteddomainexample2.com&lt;/string&gt; &lt;/array&gt; &lt;/dict&gt; &lt;/array&gt; &lt;/dict&gt; &lt;dict&gt; &lt;key&gt;URLStringProbe&lt;/key&gt; &lt;string&gt;https://1.1.1.1/index.html&lt;/string&gt; &lt;key&gt;Action&lt;/key&gt; &lt;string&gt;Connect&lt;/string&gt; &lt;/dict&gt; &lt;dict&gt; &lt;key&gt;Action&lt;/key&gt; &lt;string&gt;Disconnect&lt;/string&gt; &lt;/dict&gt; &lt;/array&gt; &lt;/dict&gt; Example 2 - just URL probe and fail-open for iphone &lt;key&gt;DNSSettings&lt;/key&gt; &lt;dict&gt; &lt;key&gt;DNSProtocol&lt;/key&gt; &lt;string&gt;HTTPS&lt;/string&gt; &lt;key&gt;ServerURL&lt;/key&gt; &lt;string&gt;https://dnsserverexample.com/v1/something/id/dns-query&lt;/string&gt; &lt;key&gt;ServerAddresses&lt;/key&gt; &lt;array/&gt; &lt;key&gt;SupplementalMatchDomains&lt;/key&gt; &lt;array/&gt; &lt;/dict&gt; &lt;key&gt;ProhibitDisablement&lt;/key&gt; &lt;true/&gt; &lt;key&gt;OnDemandRules&lt;/key&gt; &lt;array&gt; &lt;dict&gt; &lt;key&gt;URLStringProbe&lt;/key&gt; &lt;string&gt;https://1.1.1.1/index.html&lt;/string&gt; &lt;key&gt;Action&lt;/key&gt; &lt;string&gt;Connect&lt;/string&gt; &lt;/dict&gt; &lt;dict&gt; &lt;key&gt;Action&lt;/key&gt; &lt;string&gt;Disconnect&lt;/string&gt; &lt;/dict&gt; &lt;/array&gt; Also I’ve tried to debug similar issue in the past on MacOS. I’ve tried to add debug profiles NetworkDiagnostic.mobileconfig and mDNSResponder.mobileconfig but I don't see any logs related to OnDemandRules processing - any clue how to get some insight into the rules processing/evaluation?

There is a change log in Safari 18 Beta mentioning that you can now via MDM control Safari's extensions state and make an extension be enabled after you've installed it - "Added support for Device Management of extension enabled state, private browsing state, and website access on Managed Devices. (113051857)" However I could not find any documentation for it, I need to know what to set in my plist/mobileconfig file. Does anyone know (or maybe apple is here as well and can help) where would this be documented? Thanks!

The original text is in Chinese, and below is the content translated using OpenAI. 問題描述： 因為一些因素，所以公司申請了兩個企業憑證，其中Entity Name一樣，但Team ID不一樣。現在發現iPhone16系列裝置的使用者，無法同時使用兩個憑證打包出來的APP，不是都會閃退就是其中一個會閃退。 重現問題的逐步說明： 測試的情況有兩種： 從iPhone16之前的裝置轉移資料到iPhone16，這兩個APP打開都會閃退 直接在iPhone16安裝這兩個APP，則第一個安裝的APP可以正常使用，第二個安裝的APP會閃退。如果想要切換能使用的APP，需要到 一般－VPN與裝置管理－INNOLUX CORPORATION ，點擊”刪除App”，然後更換安裝順序。 如果是舊裝置升級到iOS 18，則不會有該問題 期望的結果： 兩個APP都能正常使用 實際看到的結果： 如果是舊裝置移轉資料到iPhone16，則都會閃退：如果是直接在iPhone16安裝這兩個APP，則第一個安裝的APP可以正常使用，第二個安裝的APP會閃退。 OpenAI Translation： Problem Description: Due to certain factors, the company applied for two enterprise certificates, which have the same Entity Name but different Team IDs. It has now been discovered that users of the iPhone 16 series devices are unable to use apps packaged with both certificates simultaneously; either both apps crash or one of them crashes. Step-by-Step Reproduction of the Issue: There are two testing scenarios: Transferring data from a device prior to the iPhone 16 to the iPhone 16 results in both apps crashing upon opening. Directly installing both apps on the iPhone 16 allows the first installed app to function normally, while the second installed app crashes. To switch to the functioning app, one must go to Settings - VPN &amp; Device Management - INNOLUX CORPORATION, click "Delete App," and then change the installation order. If an older device is upgraded to iOS 18, this issue does not occur. Expected Result: Both apps should function normally. Actual Observed Result: If data is transferred from an older device to the iPhone 16, both apps crash. If both apps are directly installed on the iPhone 16, the first installed app works normally while the second installed app crashes.

With iPhone 16, there is Camera Control page when setting up a phone. In https://developer.apple.com/documentation/devicemanagement/skipkeys?language=objc, there is listed skip keys for different setup pages, but there is no mention of Camera Control. Is there skip key for Camera Control? If there is, what is it?

Hello team! I am trying to update an app via MDM on macOS sequoia. It has always worked fine for me since macOS 13. But now I get this error in the console when trying to update the app: Preflight canceled with coordinator: (null) error: Error Domain=ASDErrorDomain Code=663 "The app is running and we don't have the context to quit it, failing install." UserInfo={NSDebugDescription=The app is running and we don't have the context to quit it, failing install.} Always updated even if the app was open without problems before macOS 15. Regards

We are facing issue SSO from some days its was working fine few days before. In apple devices, we are facing issue that once user enters the username and password, it is asking again when user logs in. All things were fine no changes in system only thing, this issue started happening for may be iOS 16 updated. We have implemented SSO using Microsoft AD. Things working for all other OS (Windows, Android) except iOS.

So I'm tryin to install an blank application on my device but It doesn't show on the Run on Target in Xcode, but when I look at manage run destination it shows my device?

I was able to successfully pass a PAT token challenge with my iPhone in iOS 18. However, after installing a corporate profile via Google Device Policy, it no longer passes the challenge. Is this expected? I.e. does Apple consider a device with a profile to be less secure than one without it?

I was checking the operation of items that are now available on devices with iOS 18 or later, but when I distribute to Shared iPad devices, the following 3 items are not installed on the device and cannot be controlled. allowiPhoneMirroring allowPersonalizedHandwritingResults allowWritingTools Please let us know the following. Are the above 3 items available on Shared iPad? If so, please tell us how to solve the problem that the items are not installed on the Shared iPad device and the control does not work. The specifications of the device used are as follows OS : iOS18.1 beta3 Model : iPad Air 13-inch(M2)

New Local Network Privacy Setting has been added in Privacy &amp;amp; Security Section of system Settings. I just want to know if this permission be managed through MDM mobileconfig profile. Let me know if any suggestions are there, in respect to this.

On the "What's new for enterprise in iOS 18" page here: https://support.apple.com/en-am/121158, one of the new features mentioned is: "On supervised devices, organizations can disable a user’s ability to hide and lock apps." Despite reviewing the developer documentation surrounding device management (https://developer.apple.com/documentation/devicemanagement), as well as going through the latest changes to schema definitions (https://github.com/apple/device-management), I have been unable to find a restriction that corresponds to this functionality. This is a feature that I'd like to implement, has anyone found any details about this restriction and what key may need to be inserted in the restrictions payload to use it?

I am trying to use Apple Intelligence on a shared iPad. I cannot use Apple Intelligence even though I have registered my Apple Acount. Apple Intelligence does not appear in the device settings. Please tell me the following Can I use Apple Intelligence on my Shared iPad device? If so, is it an expected behavior that Apple Intelligence settings are not displayed on the Shared iPad device? The specifications of the devices used are as follows OS: iPadOS 18.1 beta3 Model: iPad Air-13inch(M2)