With iOS 14 devices we can see that Many MDM Commands Fails with error " Couldn’t communicate with a helper application." . This Error is more frequent in InstallApplication , InstallProfile command , but other MDM commads also face the same issue. I have attach sample response from some devices. We have seen this error in previous version of iOS but with iOS 14 these are very frequent. InstallApplication Errors <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>InstallApplication;Collection=51075000000853127</string> <key>ErrorChain</key> <array> <dict> <key>ErrorCode</key> <integer>1005</integer> <key>ErrorDomain</key> <string>DeviceManagement.error</string> <key>LocalizedDescription</key> <string>Could not install app.</string> </dict> <dict> <key>ErrorCode</key> <integer>4097</integer> <key>ErrorDomain</key> <string>NSCocoaErrorDomain</string> <key>LocalizedDescription</key> <string>Couldn’t communicate with a helper application.</string> </dict> </array> <key>Status</key> <string>Error</string> <key>UDID</key> <string>UDID-UDID</string> </dict> </plist> <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>InstallApplication;Collection=33783000002227119</string> <key>ErrorChain</key> <array> <dict> <key>ErrorCode</key> <integer>4099</integer> <key>ErrorDomain</key> <string>NSCocoaErrorDomain</string> <key>LocalizedDescription</key> <string>Couldn’t communicate with a helper application.</string> </dict> </array> <key>Status</key> <string>Error</string> <key>UDID</key> <string>UDIDUDIDUDID</string> </dict> </plist> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>InstallApplication;Collection=51075000000853127</string> <key>ErrorChain</key> <array> <dict> <key>ErrorCode</key> <integer>1005</integer> <key>ErrorDomain</key> <string>DeviceManagement.error</string> <key>LocalizedDescription</key> <string>Could not install app.</string> </dict> <dict> <key>ErrorCode</key> <integer>4097</integer> <key>ErrorDomain</key> <string>NSCocoaErrorDomain</string> <key>LocalizedDescription</key> <string>Couldn’t communicate with a helper application.</string> </dict> </array> <key>Status</key> <string>Error</string> <key>UDID</key> <string>UDID-UDID</string> </dict> </plist> InstallProfile Errors <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>SingletonRestriction</string> <key>ErrorChain</key> <array> <dict> <key>ErrorCode</key> <integer>4099</integer> <key>ErrorDomain</key> <string>NSCocoaErrorDomain</string> <key>LocalizedDescription</key> <string>Couldn’t communicate with a helper application.</string> </dict> </array> <key>Status</key> <string>Error</string> <key>UDID</key> <string>UDIDUDID</string> </dict> </plist> AvailableOSUpdate Error <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>AvailableOSUpdates</string> <key>ErrorChain</key> <array> <dict> <key>ErrorCode</key> <integer>12050</integer> <key>ErrorDomain</key> <string>MCMDMErrorDomain</string> <key>LocalizedDescription</key> <string>The attempt to check for an available update failed.</string> <key>USEnglishDescription</key> <string>The attempt to check for an available update failed.</string> </dict> <dict> <key>ErrorCode</key> <integer>2214</integer> <key>ErrorDomain</key> <string>DeviceManagement.error</string> <key>LocalizedDescription</key> <string>Scan failed.</string> </dict> <dict> <key>ErrorCode</key> <integer>4097</integer> <key>ErrorDomain</key> <string>NSCocoaErrorDomain</string> <key>LocalizedDescription</key> <string>Couldn’t communicate with a helper application.</string> </dict> </array> <key>Status</key> <string>Error</string> <key>UDID</key> <string>UDIDUDIDUDID</string> </dict> </plist> ClearPasscode <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CommandUUID</key> <string>ClearPasscode</string> <key>ErrorChain</key> <array> <dict> <key>ErrorCode</key> <integer>701</integer> <key>ErrorDomain</key> <string>DeviceManagement.error</string> <key>LocalizedDescription</key> <string>The device’s passcode cannot be cleared.</string> </dict> <dict> <key>ErrorCode</key> <integer>4097</integer> <key>ErrorDomain</key> <string>NSCocoaErrorDomain</string> <key>LocalizedDescription</key> <string>Couldn’t communicate with a helper application.</string> </dict> </array> <key>Status</key> <string>Error</string> <key>UDID</key> <string>UDIDUDIDUDID</string> </dict> </plist>

I would like to know on a mdm managed supervised device, how to force use Safari if a user has non-safari browser set as default. can enforcing safari for a domain or web clip be done? even shortcuts now, when using safari it opens whatever is set as default browser. Ironically if same simple shortcut of open URL with Chrome is created it opens with Chrome, regardless if default browser is set to firefox for example this default browser setting is great for personal use but cause issues now for corporate use for me anybody else figure this out? Also affects certificates for our managed devices

We are getting this on some devices but cannot figure out device state that leads to this response. These are supervised devices. The App was originally installed using a configurator blueprint using a VPP account. The vast majority of devices change the App to managed with no prompt when one of the following MDM actions are sent, but some devices prompt for an apple id log and fail to make the app managed. The prompt occurs with either an App install/update { "request_type": "InstallApplication", "udid": "00008020-000561A00E68402E", "identifier": "com.*.*.default", "options": { "purchase_method": 1 } } or with a request to make it managed { "request_type": "InstallApplication", "udid": "00008020-000561A00E68402E", "identifier": "com.*.*.default", "change_management_state": "Managed" } in either case we receive the following { "CommandUUID": "d31ec100-dbbe-4801-9795-390b6b6503bf", "ErrorChain": [ { "ErrorCode": 12040, "ErrorDomain": "MCMDMErrorDomain", "LocalizedDescription": "Please log in to your iTunes Store account.", "USEnglishDescription": "Please log in to your iTunes Store account." } ], "Status": "Error", "UDID": "00008020-000561A00E68402E" } We are pretty certain no Apple ID was used locally. In some cases hitting cancel on the prompt allows the MDM on the next request in other cases we found the App must be removed locally on the device and then installed by the MDM. The App cannot be removed by the MDM since its not managed Occurred on both iOS 13.7 &amp; 14.4

When reinstalling MacOS I run into issues in the Remote Management section during installation. After establishing a network connection, I proceed to the Remote Management section of the installation and the setup is failing with an error "Unable to connect to the MDM server for your organisation.". Is there any way how I can resolve this issue manually? Because there is no way how to bypass this step in the setup.

WWDC21 session 10123 shows a screen that implies the guardian instance of your app is able to select apps on your child's device to encourage or to control. In my experience with the API so far I can't see a way to do this. The API only seems to work on the child's phone. Here are my questions: Is there a suggested way to determine whether the app is running on a guardian device? The only way I can see is to attempt AuthorizationCenter.shared.requestAuthorization and check for an error value of .invalidAccountType. But it seems you could get that error for other reasons too. Is there a way to present FamilyActivityPicker on the guardian device but have it show apps on the child's phone? I don't see any thing in the API for selecting a child account to access with `FamilyActivityPicker', it seems to only show the phone's user's apps (or no apps if it's the guardian's phone). After retrieving app tokens from 'FamilyActivityPicker' is there a recommended way to present to the user in the UI? The WWDC session shows an app icon and app name (i.e. "Books" and "Solar System"), but my understanding is that info is hidden from the developer for privacy reasons. So I'm wondering if the example in the session is really feasible.

Hello, After pushing all our CA by mobileiron MDM on iphones and ipads, we noticed that internal website signed by our CA are not trusted, we followed your KB https://support.apple.com/en-in/HT210176 and https://support.apple.com/en-us/HT211025, however while installing all the chain in one file or one by one and pushing it as a certificates config by the MDM to concerned devices the cert alert still exist, same issue by installing the internal root CA directly on apple devices. Do you have any advice? Thanks.

MacOS ver. Monterey 12.1 https://developer.apple.com/documentation/devicemanagement/mdm A device management profile is transmitted to the device with reference to the above link. Both iOS and iPadOS devices operate normally in general enroll and DEP enroll. In MacOS, Enroll operates normally in Userchannels. This time, I purchased a MacMini device equipped with Apple Silicon and tried to test DEP registration, but an error occurs as follows. "unable to decrypt encrypted profile" Should Mac's DEP registration use a different payload profile method? Let me know if you know something to refer to. thank you.

Since 8.2p1 OpenSSH support for FIDO/U2F hardware authenticators, add "ed25519-sk" and "ecdsa-sk" key type. macOS Monterey 12.2 bundled OpenSSH (version: 8.6p1) doesn't include built-in security keys support, but it seems that user can specify middle ware library to use FIDO authenticator-hosted keys (see man ssh-add, man ssh_config and man ssh-agent). I try to implement FIDO security key provider library, but bundled ssh-agent seems don't try to load the implemented library and simply return with "unknown or unsupported key type": $ ssh-agent -d -P "/*" SSH_AUTH_SOCK=SOME_VALUE; export SSH_AUTH_SOCK; echo Agent pid SOME_VALUE; debug1: new_socket: type = SOCKET debug2: fd 3 setting O_NONBLOCK debug1: new_socket: type = CONNECTION debug3: fd 4 is O_NONBLOCK debug1: process_message: socket 1 (fd=4) type 25 debug2: process_add_identity: entering debug1: parse_key_constraint_extension: constraint ext sk-provider@openssh.com debug1: process_add_identity: add sk-ssh-ed25519@openssh.com SHA256:KEY_HASH "KEY_COMMENT" (life: 0) (confirm: 0) (provider: /path/to/libsk-libfido2.so) debug1: new_socket: type = CONNECTION debug3: fd 4 is O_NONBLOCK debug1: process_message: socket 1 (fd=4) type 11 debug2: process_request_identities: entering debug1: process_message: socket 1 (fd=4) type 13 debug1: process_sign_request2: entering Confirm user presence for key ED25519-SK SHA256:KEY_HASH process_sign_request2: sshkey_sign: unknown or unsupported key type User presence confirmed Manually install OpenSSH from third-party (such as MacPorts/Homebrew, or simply build it from source code) works, but third-party OpenSSH can't read passwords stored in Keychain. Is bundled OpenSSH disable hardware key support at build time? Advice most appreciated. Thank you!

Hello everyone, I was trying out Declarative Device Management on my iOS 16 device to get a feeling of how it works. While trying out the new protocol i managed to find some bugs in the behavior of Declarative Device Management. When subscribing to the "passcode.is-compliant" state the device initially sends the state "passcode.is-compliant==false" but will never (even after hours) send "passcode.is-compliant== true", even when the device is definately complying to a complex passcode policy and even when no passcode policy is present. This state also didn't work as a predicate for an activation in the form of "(@state(passcode.is-compliant) == TRUE)". The referenced configuration was never activated even after the device definately complied with the installed passcode policy. When subscribing to the "passcode.is-present" state the device will initially send the correct state but then never update the state even when clearing the passcode and re entering it again multiple times and even after waiting for 10 minutes. When using an activation with predicate "(@state(passcode.is-present) == TRUE)" the device will correctly install the referenced configuration but after removing the passcode it will not remove the configuration even though it should After reenrolling the device and reactivating Declarative Device Management the device reported the state "passcode.is-present==true" even though the device didn't have a passcode present. Can anyone else confirm this behavior? Thanks and have a nice day

Apple prompted users to explicitly test SCEP workflows after the Ventura upgrade. The Apple MacOS 13 Beta 1 Release Notes should cover the changes, but we didn't find any more details. Did Apple release any more information on what was changed? We are currently unable to complete the SCEP workflow on Ventura 13.0 22A380. Up to macOS Monterey the workflow works without any problems. The workflow fails while parsing the PKCSReq response (Diagram #5) with the following error: CertificateService [502:Cert_PI:SCEP:&lt;0xf94c&gt;] Calling SecSCEPVerifyReply()... CertificateService SecCMSMessageSecurityShim is disabled (via feature flags) CertificateService [502:Cert_PI:SCEP:&lt;0xf94c&gt;] SecSCEPVerifyReply() returned 0 certs Error: (null) CertificateService [502:Cert_PI:SCEP:&lt;0xf94c&gt;] SCEP response verification failure details (PKCSReq): CertificateService [502:Cert_PI:SCEP:&lt;0xf94c&gt;] ParseErrorCode : -25293 CertificateService [502:Cert_PI:SCEP:&lt;0xf94c&gt;] ResponseLength : 4961 CertificateService [502:Cert_PI:SCEP:&lt;0xf94c&gt;] ParseErrorText : Failed to verify signed data CertificateService [502:Cert_PI:SCEP:&lt;0xf94c&gt;] Attrs attributes: (null) CertificateService [ERROR] [502:Cert_PI:SCEP:&lt;0xf94c&gt;] SCEP response failed to verify ==&gt; (null) CertificateService [502:Cert_PI:&lt;0xf94c&gt;] &lt;OUTERROR&gt; Failed to verify get certificate response &lt;MDM-SCEP:15002&gt; CertificateService [ERROR] [502:Cert_PI:SCEP:&lt;0xf94c&gt;] [CE] Certificate request failed ==&gt; Failed to verify get certificate response &lt;MDM-SCEP:15002&gt;

The iphone info: OsVersion: iOS 15 Device model: iphone 12 Steps: Install the MDM profile on the iphone. The server pushes the command to install the webclip profile through MDM (the profile is set to not be manually removable). After installing the webclip profile, the webclip icon will appear on the Home Screen of the phone screen. When the webclip is no longer used, remove the webclip profile through MDM. The problem occurs in step 4, the webclip profile is deleted, but the webclip icon still exists on the home screen of the mobile phone, and cannot be removed by tools such as Apple Configurator2. So what causes this phenomenon and how to fix?

While reading the documentation at https://developer.apple.com/documentation/devicemanagement (Device Assignment / Profile Management section), I can create (define) a new profile, assign/unassign this newly created profile to device serial numbers and get information about a profile using its profile_uuid. Anyway, I cannot find how to update a profile (for example after attributes modification) and how to delete a profile (a profile I no longer need). Are these operations even possible?

** Hi Community,** We have been testing on using oauth2 for User Enrollment.Where as per doc provided we have supplied the method, authorization-url, token-url, redirect-url, client-id in the 401 response from MDM Server Authorization Request As mentioned the apple client performed authorization request by adding state, login_hint to the Authorization-url and the params mentioned above and successfully received the authorization code after the user makes a login with the IDP. <<<<< Request GET /oauth2/authorization?response_type=code &client_id=XXXXXXXXXX &redirect_uri=apple-remotemanagement-user-login:/oauth2/redirection &state=XXXXXXXXXX &login_hint=useroa@example.com HTTP/1.1 Host: mdmserver.example.com ------- MULTIPLE REQUESTS BETWEEN CLIENT Server ---------- >>>>> Response HTTP/1.1 308 Permanent Redirect Content-Length: 0 Location: apple-remotemanagement-user-login:/oauth2/redirection ?code=XXXXXXXXXX&state=XXXXXXXXXX . Token Request Using the code received from authorization server apple client performs this step to get the access_token and refresh_token.I am using a authorization server created by default in my Okta domain and this step fails. <<<<< Request POST /oauth2/token HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 195 grant_type=authorization_code &code=XXXXXXXXXXXX &redirect_uri=apple-remotemanagement-user-login:/oauth2/redirection &client_id=XXXXXXXXXX >>>>> Response HTTP/2 401 Unauthorized Content-Type: application/json { "error": "invalid_client", "error_description": "Client authentication failed. Either the client or the client credentials are invalid." } When debugged this issue, As per Okta's doc https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/#exchange-the-code-for-tokens The client must specify Their credentials in Authorization header as Authorization : Basic <client_id>:<client_secret> in order to get the access_token And Also as per RFC-6749 https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3 The Confidential Clients must specify their client_id, client_secret provided by the authorization server to receive the access_tokens. May I know how to overcome this issue or did I missed any steps that may include the Authorization header Thanks in Advance,.

We are reading from an Apple API - https://gdmf.apple.com/v2/pmv that we got from: https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf With rapid security updates coming in, We can see the 16.4.1 (a) update out via Settings > Software Update. It appears the Apple’s API response has recently been updated with an additional parameter called “ProductVersionExtra” as shown below. Can someone from Apple please validate that these changes are reliable so we can update the JSON parsing logic at our end?

When supervising a device, I try to install a profile contains the payload type :com.apple.webcontent-filter. The OS displays that: the payload type "com.apple.webcontent-filter" is not permitted. I'm not sure which step went wrong.

Is it necessary to have Supervised device to use blockedAppBundleIDs parameter in MDM - Restrictions Payload? Documentation says device can be made Supervised only through DEP, and DEP or ABM is mainly for organizations or schools not for individuals, I'm developing an application related to parent control where I might have to use blockedAppBundleIDs in the restrictions payload, but it requires supervised device. Is there any way we can do DEP through OTA for individual, old devices ? Any suggestion here ?

Issue Description: We tested App Store app update deployment in an iPad with OS version 16.4.1. We put the app AppLock mode in device using a MDM. Then we pushed a update for the app from MDM. The device didn't update the app but the command was successfully sent from MDM and device acknowledged it. When we removed the app from AppLock mode and closed it, the app updated instantly. For enterprise apps, we have observed that while pushing the app update to devices when it is in AppLock mode, the app closes automatically and the app updates and opens automatically in AppLock mode. But for app store apps this behavior is different like mentioned above. Also, if the app is not in AppLock mode and if the app update is pushed when the app is running in foreground, the device asks for update prompt. If we accept it, the app doesn't update automatically. If we close the app manually, then the app is updated instantly. Kindly educate us on this case on App Store App as to whether this an intended behavior or a bug.

These logs are from a Flutter app that is supposed to run on MDM devices too. The full log file is found attached. Can someone help me find what might be the cause of the issue and/or guide me through possible solutions, please? Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Triggered by Thread: 0 Application Specific Information: abort() called Kernel Triage: VM - (arg = 0x0) pmap_enter retried due to resource shortage VM - (arg = 0x0) pmap_enter retried due to resource shortage VM - (arg = 0x0) pmap_enter retried due to resource shortage VM - (arg = 0x0) pmap_enter retried due to resource shortage VM - (arg = 0x0) pmap_enter retried due to resource shortage Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 libsystem_kernel.dylib 0x1d3c50558 __pthread_kill + 8 1 libsystem_pthread.dylib 0x1f48ce118 pthread_kill + 268 2 libsystem_c.dylib 0x19c45a178 abort + 180 3 libswiftCore.dylib 0x107e58028 swift::fatalError(unsigned int, char const*, ...) + 56 4 libswiftCore.dylib 0x107e501c8 checkVersion() + 60 5 dyld 0x1b445b1cc invocation function for block in dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const::$_0::operator()() const + 168 6 dyld 0x1b448daf0 invocation function for block in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const + 172 7 dyld 0x1b44348a0 invocation function for block in dyld3::MachOFile::forEachSection(void (dyld3::MachOFile::SectionInfo const&, bool, bool&) block_pointer) const + 528 8 dyld 0x1b4433c18 dyld3::MachOFile::forEachLoadCommand(Diagnostics&, void (load_command const*, bool&) block_pointer) const + 296 9 dyld 0x1b44331b0 dyld3::MachOFile::forEachSection(void (dyld3::MachOFile::SectionInfo const&, bool, bool&) block_pointer) const + 192 10 dyld 0x1b44868dc dyld3::MachOFile::forEachInitializerPointerSection(Diagnostics&, void (unsigned int, unsigned int, bool&) block_pointer) const + 160 11 dyld 0x1b443f0bc dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const + 432 12 dyld 0x1b443b8d8 dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const + 448 13 dyld 0x1b44345c4 dyld4::PrebuiltLoader::runInitializers(dyld4::RuntimeState&) const + 44 14 dyld 0x1b4437d4c dyld4::Loader::runInitializersBottomUp(dyld4::RuntimeState&, dyld3::Array<dyld4::Loader const*>&) const + 220 15 dyld 0x1b4437d28 dyld4::Loader::runInitializersBottomUp(dyld4::RuntimeState&, dyld3::Array<dyld4::Loader const*>&) const + 184 16 dyld 0x1b4437d28 dyld4::Loader::runInitializersBottomUp(dyld4::RuntimeState&, dyld3::Array<dyld4::Loader const*>&) const + 184 17 dyld 0x1b445b258 dyld4::Loader::runInitializersBottomUpPlusUpwardLinks(dyld4::RuntimeState&) const::$_1::operator()() const + 112 18 dyld 0x1b443d6a0 dyld4::Loader::runInitializersBottomUpPlusUpwardLinks(dyld4::RuntimeState&) const + 304 19 dyld 0x1b4473244 dyld4::APIs::runAllInitializersForMain() + 340 20 dyld 0x1b444703c dyld4::prepare(dyld4::APIs&, dyld3::MachOAnalyzer const*) + 3404 21 dyld 0x1b4444cdc start + 1948 Thread 1: 0 libsystem_pthread.dylib 0x1f48c7b74 start_wqthread + 0 Thread 2: 0 libsystem_pthread.dylib 0x1f48c7b74 start_wqthread + 0 Thread 3: 0 libsystem_pthread.dylib 0x1f48c7b74 start_wqthread + 0 ios.crash

Hello, I want to develop an enterprise application that is distributed via mobile device manager and it seems like I need an Apple Business Manager account so that I can manage a personal test device. If I sign up for the Apple Developer program am I also eligible for an Apple Business Manager account? The current ABM enrollment process requires an organization with a DUNS number, which is currently a roadblock for me.

Steps to replicate Issue: IT Admin has deployed "Appian for Intune" iOS app https://apps.apple.com/us/app/appian-for-intune/id1573771379 to their Microsoft Intune MDM environment through Apple Business Manager using Volume Purchase Program. The IT admin is trying to update the group assignment of this app using below steps: Login to Intune Portal (https://endpoint.microsoft.com/) Go to Apps --> All Apps Search for "Appian for Intune" --> Open app --> Go to Properties Edit Group assignment and try to change the License Type Issue: IT Admin is not able to change License Type during group assignment in the Microsoft Intune console. By default Device licensing type is selected and User Licensing is disabled. IT admin wants to use User Licensing as License Type Please find the attached screenshot. As per IT admin, this issue is only happening for Appian for Intune iOS app. And other iOS apps purchased through Apple Business Manager works fine. Ask: Why is this issue happening ? Do we need to change something in Appian for Intune iOS app.? Is it related to the custom EULA license associated with this app on app store connect ? Please let us know what needs to be done at iOS app level to resolve this issue ? Thanks, Parveen.