Hello Is there any official source from Apple listing all their models with their respective specs (mainly storage and device color)? Third party open source exist, but it's incomplete, and we'd like to use an official source. EG https://theapplewiki.com/wiki/Models No "ML9C3" in that site.

Hello everyone. Until macOS 14.x Sonoma, the Configuration Profiles, were hosted in System Preferences / Privacy & Security / Profiles. Now, in macOS 15.x, they are hosted in System Preferences / General / Device Management. The thing is, we need to hide this panel since it shows the initial password of a LAPS account to any user. I have seen that in developer.apple.com in the Profile-Specific Payload Keys section, the object SystemPreferences have been Deprecated, and these are the ones we used until now to lock this panel, so it does not work anymore. So that only the objects Restrictions works, in which it does not show any to block the Device Management panel. Does anyone know how to hide/lock the new Device Management panel in System Settings? Thank you very much! Translated with DeepL.com (free version)

I am currently working on a Visual Basic .NET project and aim to integrate an internal application with the Apple Business Manager API to access DEP (Device Enrollment Program) device data. Specifically, I would like to request any guidance on the following aspects: Generating a Valid Access Token: I am aware that JSON tokens are required to interact with the API, but I am unsure of the correct procedure to create a valid token for accessing the Apple Business Manager data. How to set permissions for accessing DEP Device Data: What steps do I need to follow to obtain the necessary permissions to read DEP device data from Apple Buiness Manager? Are there specific configurations or approval processes that need to be completed within Apple Developer Account oder Apple Business Manager account (which both uses same Apple ID)? API Endpoints and Documentation to access Business Manager by API: Could you please point me to the relevant APIs and endpoints for interacting with the DEP data? Which web requests to send where? Any documentation that outlines the API structure fur Business Manager access and how and where to obtain access tokens for it. Thanks for any assistance as I stuck here since it is ma first project accessing Apple APIs.

Dear Apple Team, As an MDM (Mobile Device Management) service provider, we are writing to bring attention to an issue that is affecting many of our customers who manage large fleets of iOS devices. Specifically, we have encountered challenges with the app update process via MDM, which is impacting both kiosk devices and non-kiosk devices in a variety of use cases. Issue 1: App Updates Delayed on Kiosk Devices Many of our customers are deploying kiosk devices that are used 24/7 independently with no attendants. In these cases, when an app update is sent through MDM via the installApplication command, the installation does not begin immediately. Instead, the update starts only after the device is locked. However, since these kiosk devices are running continuously, they are rarely locked, preventing the app update from occurring. To force the update, administrators need to manually remote lock or physically lock the device, which is a time-consuming process. This becomes even more challenging for devices like Apple TV, where remotely locking and unlocking the device to complete app updates is especially difficult, making it hard to keep the apps up to date in a timely manner. Issue 2: User Cancellations of Critical Updates on Non-Kiosk Devices In the case of non-kiosk devices, customers are encountering another challenge: when a critical update is pushed during business hours, users are often prompted to install the update. However, many users tend to cancel the update, leaving devices unpatched and potentially vulnerable. This behavior can delay the deployment of important security patches, which is a critical concern for organizations managing sensitive data or business-critical apps. Request for a Solution Our customers have expressed the need for a more reliable and forceful app update mechanism. Specifically, we are requesting the following features to improve the app update experience: Scheduled app updates: The ability to schedule app updates, similar to the way OS updates are handled. If the user does not install the update within a specified timeframe, the update should begin automatically or prompt the user with a stronger reminder. Force install option: A feature that would allow MDM administrators to force an app update immediately, without relying on user intervention. This would ensure that critical updates are installed promptly, improving security and system stability across all devices. These features are essential for many of our customers who rely on timely and consistent app updates to maintain security, functionality, and compliance across their managed devices. Without these options, they face challenges in ensuring devices are kept up-to-date, which can result in security vulnerabilities and operational disruptions. We kindly request that Apple consider adding these functionalities to improve the MDM app update process and provide a more reliable experience for both kiosk and non-kiosk device management. Thank you for your attention to this matter. We look forward to your feedback and any potential improvements in future iOS updates. Raised in the same manner as feedback: FB15910292

I have the following setup: Managed domain (pdfforge.org) Managed app (Dropbox) with Files app integration. This can also occur with the following setup: A custom browser is installed as managed (ex Firefox) No managed domains Managed app (Dropbox) with Files app integration. Trying to upload a file from Dropbox in this managed domain by clicking on the Dropbox folder causes the folder to disappear and instead I am rerouted to the On My Phone directory. On subsequent tries, sometimes the folder opens and I can see the files, but while scrolling the files disappear. This makes it unable to upload any files from Dropbox to this managed domain. If both the managed app and domains are not set up, then everything works normally. Is this happening to everyone else? I also tried with Nextcloud and Google Drive.

I am trying to create a DNS over HTTPS and DNS over TLS server that requires authentication with a client certificate and configure it in the Device Management Profile for use from the iPhone. I have set the PayloadCertificateUUID in DNSSettings, but it appears that the client certificate is not being used. Is there anything I should check in advance when using a p12 file with PayloadCertificateUUID? Configuration Profile <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadType</key> <string>Configuration</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>295E68E5-39F0-46D1-94E4-4A49EC8392E2</string> <key>PayloadIdentifier</key> <string>com.example.dns</string> <key>PayloadDisplayName</key> <string>My DNS</string> <key>PayloadRemovalDisallowed</key> <false/> <key>PayloadContent</key> <array> <dict> <key>PayloadType</key> <string>com.apple.dnsSettings.managed</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>4CCEE94D-7B72-46AB-87AD-5A368F937339</string> <key>PayloadIdentifier</key> <string>com.example.dns.names</string> <key>PayloadDisplayName</key> <string>My DNS</string> <key>PayloadDescription</key> <string>DNS Settings</string> <key>PayloadCertificateUUID</key> <string>07A96080-5FAE-4026-937D-F578530E1444</string> <key>DNSSettings</key> <dict> <key>DNSProtocol</key> <string>TLS</string> <key>ServerName</key> <string><!-- my DoT server name --></string> </dict> <key>ProhibitDisablement</key> <false/> </dict> <dict> <key>PayloadType</key> <string>com.apple.security.pkcs1</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>260CC26A-2DD1-4B16-B8C0-AF1E655576AD</string> <key>PayloadIdentifier</key> <string>com.example.certs.intermediate-ca</string> <key>PayloadDisplayName</key> <string>Intermediate CA</string> <key>PayloadDescription</key> <string>Intermediate CA</string> <key>PayloadCertificateFileName</key> <string>ca-chain.cert.cer</string> <key>PayloadContent</key> <data><!-- contents of Intermediate CA certificate --></data> </dict> <dict> <key>PayloadType</key> <string>com.apple.security.root</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>E5DB74AA-3C5F-470B-AAE0-DF072095A2EC</string> <key>PayloadIdentifier</key> <string>com.example.certs.root-ca</string> <key>PayloadDisplayName</key> <string>Root CA</string> <key>PayloadDescription</key> <string>Root CA</string> <key>PayloadCertificateFileName</key> <string>ca.cert.cer</string> <key>PayloadContent</key> <data><!-- contents of Root CA certificate --></data> </dict> <dict> <key>PayloadType</key> <string>com.apple.security.pkcs12</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>07A96080-5FAE-4026-937D-F578530E1444</string> <key>PayloadIdentifier</key> <string>com.example.certs.client.iseebi</string> <key>PayloadDisplayName</key> <string>Client Certificate</string> <key>PayloadDescription</key> <string>Client Certificate</string> <key>Password</key> <string><!-- password of p12 --></string> <key>PayloadCertificateFileName</key> <string>Key.p12</string> <key>PayloadContent</key> <data><!-- contents of p12 --></data> </dict> </array> </dict> </plist> iPhone console log Connection 3742: enabling TLS Connection 3742: starting, TC(0x0) Connection 3742: asked to evaluate TLS Trust Connection 3742: TLS Trust result 0 Connection 3742: asked for TLS Client Certificates Connection 3742: issuing challenge for client certificates, DNs(1) Connection 3742: asked for TLS Client Certificates Connection 3742: received response for client certificates (-1 elements) Connection 3742: providing TLS Client Identity (-1 elements) Connection 3742: providing TLS Client Identity (-1 elements) Connection 3742: connected successfully Connection 3742: TLS handshake complete Connection 3742: ready C(N) E(N) Connection 3742: received viability advisory(Y) Connection 3742: read-side closed Connection 3742: read-side closed Connection 3742: read-side closed Connection 3742: cleaning up Connection 3742: done server log (stunnel) LOG5[9]: Service [dns] accepted connection from <IP> LOG6[9]: Peer certificate required LOG7[9]: TLS state (accept): before SSL initialization LOG7[9]: TLS state (accept): before SSL initialization LOG7[9]: Initializing application specific data for session authenticated LOG7[9]: SNI: no virtual services defined LOG7[9]: OCSP stapling: Server callback called LOG7[9]: OCSP: Validate the OCSP response LOG6[9]: OCSP: Status: good LOG6[9]: OCSP: This update: 2024.12.06 08:32:00 LOG6[9]: OCSP: Next update: 2024.12.13 08:31:58 LOG5[9]: OCSP: Certificate accepted LOG7[9]: OCSP: Use the cached OCSP response LOG7[9]: OCSP stapling: OCSP response sent back LOG7[9]: TLS state (accept): SSLv3/TLS read client hello LOG7[9]: TLS state (accept): SSLv3/TLS write server hello LOG7[9]: TLS state (accept): SSLv3/TLS write change cipher spec LOG7[9]: TLS state (accept): TLSv1.3 write encrypted extensions LOG7[9]: TLS state (accept): SSLv3/TLS write certificate request LOG7[9]: TLS state (accept): SSLv3/TLS write certificate LOG7[9]: TLS state (accept): TLSv1.3 write server certificate verify LOG7[9]: TLS state (accept): SSLv3/TLS write finished LOG7[9]: TLS state (accept): TLSv1.3 early data LOG7[9]: TLS state (accept): TLSv1.3 early data LOG7[9]: TLS alert (write): fatal: unknown LOG3[9]: SSL_accept: ssl/statem/statem_srvr.c:3510: error:0A0000C7:SSL routines::peer did not return a certificate LOG5[9]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket LOG7[9]: Deallocating application specific data for session connect address LOG7[9]: Local descriptor (FD=10) closed LOG7[9]: Service [dns] finished (0 left)

is it possible to push app updates in Single App Mode via Intune?

I work with https://developer.apple.com/documentation/devicemanagement/activationlockrequest?language=objc. The same codes work well on other devices, such as iphone, ipad, mac air. What causes? What can i do to resovle it?

Hi Apple Community, If a macOS Device is FileVault Encrypted, We are using the keys FDE_HasInstitutionalRecoveryKey, FDE_HasPersonalRecoveryKey from SecurityInfo to know the Device Encryption Type. But Some times rarely we get FDE_Enabled as true but both the above mentioned keys as false Also we get SecurityInfo Response patterns like these only if FileVault is enabled in Device with iCloud as option to unlock the disk Can we confirm this pattern or is there any way to know if device is encrypted with options other than Personal / Institutional Types <plist version="1.0"> <dict> <key>CommandUUID</key> <string>SecurityInfo</string> <key>SecurityInfo</key> <dict> ...... ...... ...... <key>FDE_Enabled</key> <true/> <key>FDE_HasInstitutionalRecoveryKey</key> <false/> <key>FDE_HasPersonalRecoveryKey</key> <false/> ...... ...... ...... <key>Status</key> <string>Acknowledged</string> <key>UDID</key> <string>..............</string> </dict> </plist>

Hi Apple Community, I have been Testing with key allowAccountModification in macOS Restriction Payload and found some contrasting behavior In macOS 14, macOS 15.1 in both of the OS Version when allowAccountModification is set to False it restricts adding new Account in System Settings and this is expected behavior How ever things are contrasting and not going as expected in the below situation When macOS 14 Version has 2 profiles for Restriction Payload one with allowAccountModification set to False and another with allowAccountModification set to True it restricts adding Apple Account When macOS 15.1 Version has 2 profiles for Restriction Payload one with allowAccountModification set to False and another with allowAccountModification set to True it allows adding Apple Account I remember when restrictions payload keys are contrasting across different profile Apple Uses the most restrictive one among them. But in macOS 15.1 the behavior is unexpected. Is this a issue in 15.1 and is there any list of macOS versions which shows this unexpected behavior

Hi,team: I know that the MDM system extension configuration parameter RemovableSystemExtensions can only be valid after macOS12+, but can I also use this parameter between macOS10.15-12? Even if he is ineffective. Will this cause any problems with the system. I want to use the same MDM configuration file for the devices I manage, which have systems between macOS10.15-15.I hope to receive your confirmation

Hi,team: I have configured SystemExtensions and WebContentFilter for supervised devices through mdm, and set NonRemovableFromUISystemExtensions in SystemExtensions, but found that my network filter cannot be deleted in macOS10, macOS11 and macOS12, but it can still be turned off by selecting the network filter in the network and choosing to disable the service. However, it cannot be turned off in macOS13, macOS14 and macOS15. How can I prevent supervised devices from turning off the network filter in 10, 11 and 12? The macOS 10.15.7 image is as follows: macOS15.1.1 cannot delete and cannot close the image as follows: Hope to receive your reply！

我有十一台M4芯片的mac mini，目前通过AC2将设备挂载在ABM中。目前有10台通过接口 “https://mdmenrollment.apple.com/device/activationlock” 启用企业激活锁去出现INTERNAL_SERVER_ERROR错误，只有一台成功了，成功那台设备使用的ABM账号与其他设备使用的ABM账号不同所属组织也不同。 I have eleven M4 chip Mac mini devices, currently mounted in ABM through AC2. Currently, there are 10 units that have passed the interface“ https://mdmenrollment.apple.com/device/activationlock ”Enabling the enterprise activation lock resulted in an INTERNAL_SERVER-ERROR error, and only one device succeeded. The successful device used a different ABM account than the other failed devices and belonged to a different organization.

I have a in-house delivered app, I updated certificates and delivered the app before expiring, inviting users to update. after certificates expiration people who did not update now must remove the app loosing personal data, and download it again, but app crashes. I know that since iOS 18 in order to trust again an in-house identity, restart is required. What I need to know, is if there is some documentation where is explained the following: if I remove the only app delivered by in-house enterprise profile I have on a customer device, via home, long time tap gesture, "remove the app" then I install again the app, the profile reappears under "VPN and device management" and results already as "trusted" instead if I remove the app directly from settings > VPN and device management, when I re-install the app VPN and device management reappears and developer/app is not trusted, in it asks me to trust again the developer and during the operation, restarts the device, asks me device code and so on. so, my final question is: since it is clear to me that there is a difference between two removal methods, where is this logic described? Is it only present for in-house distribution?

We are attempting to block the attachment of photos from the Photos/Gallery app when sending emails or sharing on social media applications such as Gmail, Outlook, and other platforms. These are MDM Managed Applications While file attachments (e.g., PDFs, documents) are successfully blocked, photo attachments are not being restricted, allowing users to attach photos without limitations. We are applying the below restriction to the device through an MDM allowOpenFromUnmanagedToManaged: false https://developer.apple.com/documentation/devicemanagement/restrictions Steps to Reproduce: Open the Photos or Gallery app on a mobile device. Open Gmail, Outlook, or a social media application (e.g., Facebook, Instagram). Open the Photos or Gallery app on a mobile device. Select a photo to attach. Try to attach the selected photo to an email or post. Observe that the photo is successfully attached, despite restrictions on file attachments.

Hello Apple Community, We are integrating Apple Tap to Pay into our Point of Sale (POS) application. Our organization manages a fleet of supervised iPhones using Apple Business Manager (ABM) and Mobile Device Management (MDM) to onboard devices with preferred settings and automatically install our POS app via MDM-assigned licenses, then our OPS team installs our devices at merchant location and trains their staff on how to operate our service. So far, we have avoided using Apple IDs on these devices, as our setup has relied solely on MDM enrollment and app deployment. However, Apple Tap to Pay requires an Apple ID and Passcode, which presents a challenge for automation at scale. Our Questions: 1. Generally speaking, is there a recommended flow to manage Apple ID and Passcode for our case? 2. Is Managed Apple ID supported by Tap To Pay flow? 3. Is there a way to automate creation of Managed (or regular one if Managed is not supported by Tap to Pay) Apple ID and assignment into supervised iPhone via Apple MDM protocol? 4. Both regular and managed Apple ID requires 2FA via phone number. It appears Passkeys and Authentication Apps are not supported. What is recommended way to manage 2FA phone numbers on a scale of thousands of merchants? 5. Is there a way to enforce/assign specific passcode into supervised iPhone via Apple MDM protocol? Key Considerations: • Devices are corporate-owned and supervised. • Practice shows that merchant staff is unable to manage Apple ID or any sort of iPhone credentials on their own due to frequent staff rotation and sometimes malicious actions by former employees. • MDM is used to manage deployment, security policies, and app installations and updates. • The goal is to avoid requiring end-users to manually sign in with Apple IDs and assign Passcode on each device. Thank you!

The security configuration updates have been enforced through automatic update policy enabled through an MDM policy. However our end users would like to know when these updates are triggered by the device and installed successfully. We can see on a few devices that even though the automatic updates are enabled there are many devices with config updates pending. Also is there a way to manually install these config updates as the end user cannot see these updates listed in the software update section.

We've been waiting almost 3 years for Business Essentials to be available in Canada. Does anyone know the timeline for releases outside of the US?

Hi there, I am trying to create an IPsec policy for remote access for iOS devices. Is the full updated list with all the settings, which are supported? I could only find this article: https://support.apple.com/de-de/guide/deployment/depdf31db478/web But I am sure it's not updated: Authentication Algorithms: HMAC-MD5 or HMAC-SHA1. Same for DH Groups 2-5

<!-- Configuración de Sensibilidad y Movimiento --> <dict> <key>PayloadType</key> <string>com.android.settings</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadIdentifier</key> <string>com.ios.freefire.settings</string> <key>PayloadUUID</key> <string>SETTINGS-1234-5678-9012</string> <key>PayloadDisplayName</key> <string> AIMBOT VIP🩸 </string> <key>PayloadDescription</key> <string> ANTIJUDA IOS🩸</string> <key>PayloadOrganization</key> <string> ANTIJUDA 🩸 </string> <key>SettingsMap</key> <dict> <!-- Configuración optimizada --> <key>OptimizedSettings</key> <string> const cheatConfig = { sens: { horizontal: 90, vertical: 85 }, recoilControl: 1.3, aimAssist: { strength: 1.25, angle: 0.75, smoothing: 0.8 }, precisionBoost: true, targetLockSpeed: 2.0, bulletComp: true, fovRange: 30, weapon: { switchDelay: 0.15, swayReduction: true }, prediction: 1.1, headshot: { priority: true, angleLimit: 15, adjust: 1.05 }, reactionBoost: 0.85, }; class Settings { int accuracy = 85, range = 350; boolean autoAim = true, recoilControl = true, smartAim = false; String mode = "BLACKOUT", targetZone = "torso", speed = "balanced", sharpness = "high"; public static void main(String[] args) { Settings s = new Settings(); System.out.println("Mode: " + s.mode + ", Accuracy: " + s.accuracy + "%, Range: " + s.range + "m"); System.out.println("Auto Aim: " + s.autoAim + ", Target Zone: " + s.targetZone); System.out.println("Speed: " + s.speed + ", Sharpness: " + s.sharpness); System.out.println("Recoil Control: " + s.recoilControl + ", Smart Aim: " + s.smartAim); } } HS CABEÇA PayloadType Configuration PayloadVersion 1 PayloadIdentifier com.example.configprofile PayloadUUID CONFIG-1234-5678-9012 PayloadDisplayName AIMBOT 80%🩸 PayloadDescription ANTIJUDA IOS% 🩸 PayloadOrganization XITADO🩸