I was trying to add a bank account, but the page seems to be having issue right now. And browser console showing: container.243b4934f1512a8c.js:2 TypeError: n is not a function at react-dom.production.min.js?3.0.0:2:58035 at unstable_runWithPriority (react.production.min.js?3.0.0:2:8382) at Et (react-dom.production.min.js?3.0.0:2:23750) at lr (react-dom.production.min.js?3.0.0:2:57957) at sr (react-dom.production.min.js?3.0.0:2:60521) at Fr (react-dom.production.min.js?3.0.0:2:73003) at unstable_runWithPriority (react.production.min.js?3.0.0:2:8382) at Et (react-dom.production.min.js?3.0.0:2:23750) at Rr (react-dom.production.min.js?3.0.0:2:70856) at kr (react-dom.production.min.js?3.0.0:2:67013) at react-dom.production.min.js?3.0.0:2:24040 at unstable_runWithPriority (react.production.min.js?3.0.0:2:8382) at Et (react-dom.production.min.js?3.0.0:2:23750) at Pt (react-dom.production.min.js?3.0.0:2:23986) at Ct (react-dom.production.min.js?3.0.0:2:23921) at zl (react-dom.production.min.js?3.0.0:2:114297) at fe (react-dom.production.min.js?3.0.0:2:13978) at HTMLDocument.n (container.243b4934f1512a8c.js:2:302781) (anonymous) @ container.243b4934f1512a8c.js:2 Zn @ react-dom.production.min.js?3.0.0:2 n.payload @ react-dom.production.min.js?3.0.0:2 Vt @ react-dom.production.min.js?3.0.0:2 Vn @ react-dom.production.min.js?3.0.0:2 ic @ react-dom.production.min.js?3.0.0:2 Mr @ react-dom.production.min.js?3.0.0:2 Nr @ react-dom.production.min.js?3.0.0:2 kr @ react-dom.production.min.js?3.0.0:2 (anonymous) @ react-dom.production.min.js?3.0.0:2 unstable_runWithPriority @ react.production.min.js?3.0.0:2 Et @ react-dom.production.min.js?3.0.0:2 Pt @ react-dom.production.min.js?3.0.0:2 Ct @ react-dom.production.min.js?3.0.0:2 zl @ react-dom.production.min.js?3.0.0:2 fe @ react-dom.production.min.js?3.0.0:2 n @ container.243b4934f1512a8c.js:2 container.243b4934f1512a8c.js:2 TypeError: n is not a function at react-dom.production.min.js?3.0.0:2:58035 at unstable_runWithPriority (react.production.min.js?3.0.0:2:8382) at Et (react-dom.production.min.js?3.0.0:2:23750) at lr (react-dom.production.min.js?3.0.0:2:57957) at sr (react-dom.production.min.js?3.0.0:2:60097) at lr (react-dom.production.min.js?3.0.0:2:58303) at sr (react-dom.production.min.js?3.0.0:2:60097) at Fr (react-dom.production.min.js?3.0.0:2:73003) at unstable_runWithPriority (react.production.min.js?3.0.0:2:8382) at Et (react-dom.production.min.js?3.0.0:2:23750) at Rr (react-dom.production.min.js?3.0.0:2:70856) at kr (react-dom.production.min.js?3.0.0:2:67013) at react-dom.production.min.js?3.0.0:2:24040 at unstable_runWithPriority (react.production.min.js?3.0.0:2:8382) at Et (react-dom.production.min.js?3.0.0:2:23750) at Pt (react-dom.production.min.js?3.0.0:2:23986) at Ct (react-dom.production.min.js?3.0.0:2:23921) at zl (react-dom.production.min.js?3.0.0:2:114297) at fe (react-dom.production.min.js?3.0.0:2:13978) at HTMLDocument.n (container.243b4934f1512a8c.js:2:302781)

Anyone aware of a work around for the followiing? Using an unsupervised device. iOS 26.5, MacOS 26.5.1, cfgutil 2.20 (1001.5), App Configurator 2.20 (11B11), on an iMac 2024 and an iPhone 16 Pro cfgutil get-icon-layout works as expected, returning the app layout list. Add an app to any page from the App Library. Rerun the command and a crash is the result. *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** -[__NSArrayM insertObject:atIndex:]: object cannot be nil' *** First throw call stack: ( 0 CoreFoundation 0x00000001854a91c0 __exceptionPreprocess + 176 1 libobjc.A.dylib 0x0000000184f3291c objc_exception_throw + 88 2 CoreFoundation 0x00000001853db9dc -[__NSArrayM insertObject:atIndex:] + 1864 3 cfgutil 0x0000000104cc2df4 cfgutil + 44532 4 cfgutil 0x0000000104cc2ce4 cfgutil + 44260 5 cfgutil 0x0000000104cc2ce4 cfgutil + 44260 6 cfgutil 0x0000000104cc3104 cfgutil + 45316 7 cfgutil 0x0000000104cd3d14 cfgutil + 113940 8 cfgutil 0x0000000104ccee68 cfgutil + 93800 9 dyld 0x0000000184fbfe00 start + 6992 ) libc++abi: terminating due to uncaught exception of type NSException

The new Device Management Service APIs provide support for creating and updating MDM servers programmatically, including updating the public key. However, we could not find a documented API workflow for retrieving, downloading, or renewing the associated Device Management Service token after a public key update. Could you please clarify whether there is an API-supported method for managing the server token ? If such functionality is not currently available, we would like to request support for token management APIs, as this would help enable fully automated MDM onboarding and certificate rotation workflows.

When deploying Macs through Automated Device Enrolment (ADE), we've found that automatic date and time configuration still depends on the Location Services pane in Setup Assistant being enabled. What's particularly interesting is that macOS already determines and pre-selects the correct language and country/region before enrolment begins, which suggests that some form of geographic awareness already exists during setup, whether through GeoIP, network-based location detection, or another mechanism. Despite this, the correct time and time zone are not automatically configured unless Location Services is enabled. For organisations pursuing zero-touch deployments, this creates an unnecessary dependency on a privacy-related feature purely to obtain accurate time settings. Today, administrators often resort to workarounds after enrolment, such as: Using scripts to configure time settings via systemsetup. Modifying the authorisation database to permit automated changes. These approaches introduce additional complexity, require elevated privileges, and create deployment dependencies that should not be necessary for such a fundamental operating system function. If macOS is already geographically aware enough to determine the correct language and region during Setup Assistant, it should also be capable of automatically configuring the correct date, time and time zone without requiring user interaction with Location Services. Benefits would include: True zero-touch and near zero-touch deployment workflows. Fewer Setup Assistant prompts and reduced user interaction. Accurate date, time and time zone configuration immediately after enrolment. Elimination of unnecessary post-enrolment scripting and workarounds. Improved privacy by avoiding the need to enable Location Services solely for time configuration. A more streamlined enterprise deployment experience across all MDM platforms. This would bring date and time configuration in line with the existing automatic language and region detection behaviour already present during ADE and significantly improve Mac deployment workflows at scale. I've already submitted Feedback Assistant report FB21973612 for this enhancement request. This has been a well-known pain point for Mac administrators for many years, particularly for organisations striving to achieve fully automated and consistent provisioning workflows.

I am currently testing Managed Open-In restrictions in an MDM-managed environment on iPadOS 27 beta. I have observed that the restrictions "allowOpenFromManagedToUnmanaged" and "allowOpenFromUnmanagedToManaged", even when set to false, are still being bypassed in certain scenarios. Specifically, I observed two issues: Photos App – Images opened from a managed application can still be saved using the Save to Photos option. Shortcuts App – Custom Shortcuts triggered from the Share Sheet can accept managed content, compress it into an archive, and share that archive with unmanaged applications, effectively bypassing the Managed Open-In restrictions. According to the iPadOS 27 beta release notes, both of these issues were marked as resolved. However, they remain reproducible in my testing on a supervised MDM-enrolled device. I have submitted a detailed report with a sys diagnose log via the Feedback Assistant (FB ID:FB23316986).

I bought an iMac 2018 years ago, but it seems that I am having trouble securing it now, which source I have not been able to pin down. I went to turn on FileVault, but saw an unusual procedure flow. I got a message: "Recovery Key A recovery key has been set by your company, school, or institution." I did NOT get this unusual procedure flow with the other macs (MacMini, macbookAir), to which I applied FileVault enable (OK). This iMac has never been under the governance of any company, school, or institution, because I bought it straight out of the Apple Store, right out of the box. But lately, I think that the security of the system has been breached by a hacker. Vitals: Model Name: iMac Model Identifier: iMac18,1 Processor Name: Dual-Core Intel Core i5 Processor Speed: 2.3 GHz Number of Processors: 1 Total Number of Cores: 2 L2 Cache (per Core): 256 KB L3 Cache: 4 MB Hyper-Threading Technology: Enabled Memory: 16 GB System Firmware Version: 529.140.2.0.0 OS Loader Version: 577.140.2~30 SMC Version (system): 2.39f40 Serial Number (system): D25XJ01NH7VF I went ahead & enabled FileVault with this warning statement, listed below, thinking that I could find a workaround. I have tried "sudo fdesetup removerecovery -institutional", and this works for staff, but not for administrators, either terminal in macOS 13.7.8 (22H730), or in Recovery Mode. Can someone enlighten me about what needs to be done to right my iMac's security issue, and help remove what seems to be a breach in my security with the MDM governance installation, which looks out of place because this iMac has always been at my house & never used with any instutition?

I am currently working on mdm.push-token status item subscription via the DDM User Channel while testing on Beta OS 27. I have observed that the User Channel subscription consistently returns the device's push token rather than a unique user-specific push token. This behaviour is persistent across both macOS and Shared iPad environments. Before I conclude that this is a bug, I would like to clarify if this is the expected behaviour for the DDM User Channel. If so, could anyone provide guidance on the correct or alternative method to retrieve a unique, user-specific push token within the DDM framework to ensure proper notification routing? I have submitted a detailed report with a sys diagnose log via the Feedback Assistant (FB ID:FB23214856). Any insights or documentation references would be greatly appreciated.

Hi, I have an app which I would like to test on macOS27, specifically the use of 'Accessibility' permission which is granted via the new DDM payload introduced in macOS27 (com.apple.configuration.app.settings). Problem is once the app is launched once and the consent popup is displayed and a choice is made ('Allow' or 'Not Now') I cannot reset the system so that the popup appears again for test purposes, i.e. is there a command line I can execute similar to 'tccutil reset Accessibility' which would reset the system? Thanks

I entered FB18878081 - July 16, 2025 and FB23195930 - June 16, 2026

Since macOS 14, accessing the current Wi-Fi SSID through CoreWLAN.framework requires both: Location Services to be enabled at the system level. Location permission to be granted to the application. For enterprise security and device-management solutions, this creates a deployment challenge because enabling Location Services system-wide requires administrator privileges and user interaction. Some enterprise use cases, such as Wi-Fi policy enforcement, network compliance, and location-aware security controls, depend on reliable access to the current SSID. On managed Macs, administrators currently have no MDM mechanism to enable Location Services system-wide or pre-authorize location access for specific applications. I reviewed the WWDC26 session "What's New in Managing Apple Devices" and the discussion of the new consolidated privacy consent experience. However, I did not find any new MDM capabilities that address Location Services management for specific apps. Questions: Are there any current MDM payloads or APIs that allow administrators to enable Location Services on supervised/managed Macs? Are there any recommended alternatives for enterprise applications that need access to Wi-Fi SSID information on managed devices? Is Apple considering future MDM enhancements that would allow administrators to enable Location Services and/or grant location access to specific applications in managed enterprise environments? Any guidance on Apple's direction in this area would be appreciated.

Are there any plans to allow wifi-only Apple TV 4K units to be manually enrolled into ASM/ABM like we can do with every other device/OS? I have several that were purchased as gifts but we can not use them as they need to be manually added to ASM. However, it's not yet possible.

Enterprise security products often need to establish trust for a locally generated root CA in order to implement features such as web filtering, traffic inspection, data loss prevention, or compliance controls. Our solution generates a unique CA certificate and private key on each managed Mac. The application then issues leaf certificates as needed and signs them with the device-specific CA. Using a unique CA per device helps avoid the security risks associated with deploying a shared CA private key across all managed endpoints. However, since macOS Big Sur, modifying trust settings for certificates in the System keychain (for example, setting a root CA to Always Trust) requires user interaction and administrator authorization. Even privileged processes cannot silently establish trust for a newly installed root CA. This creates deployment challenges in enterprise environments, particularly when: End users do not have administrator privileges. The CA must be unique per device. The private key must remain accessible to the security application while being protected from other applications. We have considered several approaches, but each appears to have significant limitations: Shared CA across all devices: introduces risk because compromise of the private key affects the entire fleet. Per-device PKCS#12 deployment with private key accessible: other local processes may be able to use the key. Per-device PKCS#12 deployment with private key protected: application access may require additional user approval, reducing deployment automation. Questions: Is there an MDM-supported mechanism for establishing trust for a device-specific root CA without requiring local administrator interaction? Are there recommended enterprise deployment patterns for applications that need both: a device-specific CA private key, and trusted root status for the corresponding CA certificate? Are there plans to expand MDM capabilities related to certificate trust management or keychain trust settings for managed Macs? What is Apple's recommended approach for enterprise security products that need to deploy device-specific trusted CAs while maintaining strong protection of the associated private keys?

The user in our Organization are not allowed to have admin permissions on their macs. They also use Eduroam to connect to the wireless network. When they change their password, which hapends every 90 days, sometimes the pop-up to re-enter the password doesn't work. Sice they are not admin on the computer, they are not able to forget the network to re-join with new credentials. Is there a Config Profile that would allow standar user to change network settings? if not, is there a group that would allow it, similar to lpadmin for allowing standar user to change printer settings?

Is there any roadmap for getting classroom to work with MDMs and standard accounts? I know it works for mobile accounts as well as having teachers/students sign into their Apple Account. We have moved away from mobile accounts and would still like compatibility with MDM instad of having everyone sign in.

What is the state of the Active Directory in macOS Golden Gate. We've had issues in both Tahoe and Sequoia like login timeouts with OpenDirectory/ActiveDirectory, UID collisions between usernames, etc. We still need it for lab logins. If I missed something and there is a new way for students to login and logout easily on lab workstations that doesn't involve AD, I'd be all for it. Platform SSO and other auth methods are great for faculty and staff but labs are another story. So I'm curious what will be the best practice going forward.

In an MSP environment, we manage hundreds of Mac based client organizations. It would be really helpful to have support in the Apple Business API for automating APNS certificate and ADE / Apps & Books token renewal. Thanks!

Is there any planned enhancement in Declarative Device Management (DDM) to support enforceable software update maintenance windows for macOS and iPadOS in education environments? With 1000+ devices, it is not feasible to guarantee all devices are updated outside school hours. Some devices will inevitably be powered off during deadlines, then later turned on during the school day, triggering updates and a 60-minute install/reboot countdown. This results in devices updating during lessons, which disrupts teaching and is exactly what we need to avoid. Ideally, updates should only be allowed to install and reboot once a device is inside an approved maintenance window, regardless of when it becomes available or comes back online. Feedback has been provided via MDM account.

We develop an education-focused app used on institutionally managed iPads deployed through Apple School Manager and MDM. While schools can purchase and deploy the app, they cannot purchase or assign feature add-ons delivered through standard In-App Purchases. As a result, some premium features are unavailable on managed devices. What is Apple’s recommended approach for providing premium feature add-ons in educational and MDM-managed deployments? Is there any support for assigning or redeeming non-consumable In-App Purchases through Apple School Manager or MDM? Are Offer Codes supported for Managed Apple Accounts or managed devices? If not, what is the recommended path forward for developers serving educational institutions? We would appreciate any guidance on current best practices.

OS update info within sysdiagnose is relatively helpful as it stands right now, but with the addition of Machine Learning updates via Global Settings, diagnosing what the device is thinking becomes a little bit more difficult. The SoftwareUpdateSubscriber channel gives some good info, but oftentimes it's not too insightful when an issue is happening. Let's say a device leveraging ML Global Settings isn't updating, and it's been about two weeks since a new applicable minor OS version dropped. The sysdiagnose says that it has the Global Settings in place, so it knows it needs to do the update this way. SoftwareUpdateSubscriber doesn't seem to report any error. So, what else could be the problem? Where can we look? This makes things difficult to troubleshoot for those of us who are self-help focused, especially me, being in an MDM vendor support team. The process is no fault of anyone in particular, but sometimes a resolution is needed asap, and submitting feedback isn't meant for immediate assistance. So, rounding everything out, I'd love to be able to see absolutely everything that updates on devices are thinking, ideally in a 'as organized as it can be' way, to help aid self-help resolutions. Related FB: FB18106259

Did Apple add support to any of the ManagedApp features in business console? I didn't see anything in the release announcement earlier this year and haven't seen anything obvious in the UI. According to the dev videos from last year, ManagedApp is the go to framework for developers to expose MDM admins to configurations, passwords, certificates, and more. This seems like a gap. Happy to continue to file feedback for this capability if it wasn't part of this summers announcements.