Unable to enrol macOS 27 beta VMs in to Jamf

I've been having trouble with Fleet MDM enrollment when I have a macOS 27 beta 4 VM (on macOS 26.6 host) as I can enroll, but push notifications don't seem to be working so no profiles are pushed to the VM. Works fine if I have a Tahoe 26.6 VM. All provisioning is done via a packer build with manual operator install of the MDM enrollment profile. Raised FB23918943 about this and will try again with beta 5.

Thanks for the reply! Sounds like it's not just me ... Sorry, to clarify my original post, the initial MDM management profile does install but then I get no activity over APNS at all... and for Jamf at least (I'm less experienced with other MDMs), the APNS push after enrol is how the jamf management daemon, Self Service app etc get installed and none of that happens.

So to me it does seem like an APNS issue, I just don't know if it's my fault somehow.

I've also raised a Feeback Assistant ticket for this FB24136873

Still not working with macOS 27 beta 5 26A5406e. Had to install Xcode 27 beta 5 in order to build the VM image on macOS 26.6.1.

Still not working on macOS 27 beta 6

This looks to be an APNS establishment problem, below is gathered from system logs from a freshly installed beta6 VM under Virtualization.framework (host on macOS 26.6.1 with DeviceSupport package installed for macOS 27 Beta)

macOS 27.0 beta 6 (26A5416b), Virtualization.framework guest, 25 min uptime, never MDM-enrolled. apsd cannot generate its SEP-backed device identity key, so it never obtains a BAA cert, and the production APNs courier never connects. Whole cascade takes 0.3 ms and repeats for the life of the boot. Deeply nested duplicate UserInfo elided as [...]; nothing else altered.

1. SEP key generation fails (root cause)

02:26:40.335149 apsd: (CryptoTokenKit) [com.apple.CryptoTokenKit:sepkey] <sepk:* kid=0000000000000000>: (apsd) unable to generate key: error e00002e2(-536870174) ACL=<SecAccessControlRef: dk;ock(true);odel(true);osgn(true);oa(true);okd(true)>

1. Security framework surfaces it as errSecInteractionNotAllowed

02:26:40.335306 apsd: (Security) [com.apple.security:seckey] SecKeyCreateRandomKey_ios failed: Error Domain=NSOSStatusErrorDomain Code=-25308 "Failed to generate keypair" (errKCInteractionNotAllowed / errSecInteractionNotAllowed: / Interaction is not allowed with the Security Server.) UserInfo={NSDescription=Failed to generate keypair, NSUnderlyingError= {Code=-25308 "<sepk:* kid=0000000000000000>: unable to generate key", AKSError=-536870174}}

1. Device identity cannot create its reference key

02:26:40.335383 apsd: (DeviceIdentity) Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." UserInfo={NSUnderlyingError={Code=-1 "Failed to create ref key." UserInfo={NSUnderlyingError={Code=-25308 "Failed to generate keypair" [...]}}}}

1. APNs BAA attestation cert therefore cannot be obtained

02:26:40.335396 apsd: [com.apple.apsd:courier] APSBAAClientIdentityProvider failed to obtain a BAA cert, error: Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." [...]

1. APNs refuses the connection

02:26:40.335454 apsd: [com.apple.apsd:courier] <APSCourierConnectionManager: production>: Stream error occurred for <APSCourierConnection>: Error Domain=APSErrorDomain Code=1 "Told not to connect after fetching server bag: (null) - closing stream"

1. Result: no push channel on any interface

02:26:40.335900 apsd: [com.apple.apsd:courier] <APSCourierConnectionManager: production>: Disconnected in response to connection failure on interface NonCellular. (Consecutive failures: 1) isConnected NO onInterface None shouldUseDualChannel NO criticalReliability NO cmaType 1. Connected on 0 interfaces.

1. Still true 19 minutes later, with the network reporting healthy

10:45:30 apsd: [com.apple.apsd:courier] APSUserCourier <APSCourierConnectionManager: production> adjusting connection. Connected on 0 interfaces. Current link quality: wwan is unknown; wifi is good

Counts over 25 minutes of uptime: 16 APSBAAClientIdentityProvider failed to obtain a BAA cert 64 sepkey unable to generate key 16 Told not to connect after fetching server bag 350 Connected on 0 interfaces 0 Connected on 1 or more interfaces <-- the channel never forms, at any point

Before going further, I’d like to check one thing. Let’s say you set up a fresh VM and, before you do the MDM thing, you go into System Settings on the VM and into an Apple Account. Does that work?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Sorry for the delay @DTS Engineer yes I can sign in to an Apple Account via System Preferences although the UX doing that has been weird for some time, this time it asked for the SMS sent 2FA code, then asked for again (rejected on second entering), if I quit System preferences and open it again it shows me as signed in with the standard warning that there are certain iCloud things I can't do on a VM. .. I've seen this ever since we could sign in to this on VMs though so I don't think is indicates any other underlying issue, so in the claude output below that's a red herring I think ..

Claude's investigation output follows:

TEST: does signing in to an Apple Account let apsd mint its SEP-backed BAA identity? ANSWER: No. Failures continue, byte-identical, after a confirmed sign-in.

Environment macOS 27.0 beta 6 (26A5416b), Virtualization.framework guest (rockit VM "ggb6-quinn-test") Never MDM-enrolled: "Enrolled via DEP: No / MDM enrollment: No" Boot 14:50:40. Apple Account sign-in completed ~14:59:04. Log captured to 15:03:11. Sign-in confirmed in System Settings UI: account name shown under "Apple Account".

apsd failure counts, whole boot (13 min) 18 APSBAAClientIdentityProvider failed to obtain a BAA cert 72 sepkey unable to generate key 18 Told not to connect after fetching server bag 377 Connected on 0 interfaces 0 Connected on 1 or more interfaces <-- channel never forms

apsd failure counts, AFTER sign-in only (14:59:04 -> 15:03:11) 2 APSBAAClientIdentityProvider failed to obtain a BAA cert 8 sepkey unable to generate key 2 Told not to connect after fetching server bag 11 Connected on 0 interfaces 0 Connected on 1 or more interfaces <-- still never forms Most recent failure 15:02:11, i.e. ongoing at time of capture.

The post-sign-in error is identical to the pre-sign-in error, same codes: sepkey] <sepk:* kid=0000000000000000>: (apsd) unable to generate key: error e00002e2(-536870174) APSBAAClientIdentityProvider failed to obtain a BAA cert, error: Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." (underlying: NSOSStatusErrorDomain Code=-25308 errSecInteractionNotAllowed)

Additional, non-MDM symptom worth noting With the Apple Account signed in, System Settings reports "Some iCloud Data Isn't Syncing". Note this is an inference, not a proven link: iCloud sync depends on the same APNs push channel, and that channel never forms. It is offered because it shows the impact is not MDM-specific -- a first-party Apple service on a signed-in account is also affected on the same guest.

Also observed: no MobileMeAccounts preference domain and no com.apple.gs.appleid.auth keychain item, despite the UI showing the account as signed in. Consistent with an account that cannot complete its service setup.