[MDM] Enterprise and VPP application installs do not work

Hello, I am currently testing the com.apple.configuration.app.managed declaration, and have failed to get it to work with either VPP OR Enterprise apps.

(Testing is being conducted on an iPhone XR with iOS 17.3.1)

VPP:

Initially errors where returned due to not having a license for the device, so I have set it up to fetch a license before the declaration is return to the device. Said declaration is as follows (I have attempted to switch from Device to User VPP type, as well as attempting to use BundleID or AppStoreID but all have the same result:

{
    "Identifier": "BBC_Test_Install",
    "Payload": {
        "AppStoreID": "377382255",
        "InstallBehavior": {
            "Install": "Required",
            "License": {
                "VPPType": "Device"
            }
        }
    },
    "ServerToken": "...",
    "Type": "com.apple.configuration.app.managed"
}

The configuration above successfully applies on to the device, and can be seen in the configurations tab in Settings. The install is unsuccessful however, as the app.managed subscription item returns the following result:

    "app" : {
      "managed" : {
        "list" : [
          {
            "state" : "failed",
            "declaration-identifier" : "BBC_Test_Install",
            "identifier" : "uk.co.bbc.newsuk",
            "name" : "BBC News - UK & World Stories"
          }
        ]
      }
    }

The device does not provide any additional information, it was initially returning the following reason when I did not request a licence before the install: "code" : "Error.LicenseNotFound" but this has disappeared now that a licence is requested before hand. No other information can be gleaned so I am at a bit of a loss. It should be noted, I am wipping my device between each test, just to try and get it working on a "fresh" application before attempting to deal with updating the declaration.

Enterprise:

This also does not seem to be behave, the configuration states a successful application, but it cant be seen in the declrations tab within general settings:

             "active" : true,
            "identifier" : "Enterprise_Test_Install",
            "valid" : "valid",
            "server-token" : "..."

The associated configuration is as follows:

{
    "Identifier": "Enterprise_Test_Install",
    "Payload": {
        "InstallBehavior": {
            "Install": "Required"
        },
        "ManifestURL": "https://my.domain/web/mdm/ios/enterpriseplistgenerator/bundle.id"
    },
    "ServerToken": "...",
    "Type": "com.apple.configuration.app.managed"
}

I have had previous success installing enterprise apps through MDM commands so I would have assumed the ManifestURL should have worked the same. The above URL does cause the device to make a secondary request for the application manifest, which returns the following:

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
 <dict>
  <key>items</key>
  <array>
   <dict>
    <key>assets</key>
    <array>
     <dict>
      <key>kind</key>
      <string>software-package</string>
      <key>url</key>
      <string>https://my.domain/web/mdm/ios/enterpriseipa/bundle.id</string>
     </dict>
    </array>
    <key>metadata</key>
    <dict>
     <key>bundle-identifier</key>
     <string>bundle.id</string>
     <key>kind</key>
     <string>software</string>
     <key>subtitle</key>
     <string>testapp</string>
     <key>title</key>
     <string>testapp</string>
    </dict>
   </dict>
  </array>
 </dict>
</plist>

Which the device then does nothing with (app.managed does not report back anything). When installing the enterprise app through MDM commands the above plist does cause the device to make a secondary call to fetch the applications IPA.

Some additional information, help, or insight would be useful, as from my perspective the declaration does not seem to work at all.

Replies

Edit: I seem to be able to side load an application into DM, by first downloading the application with MDM, then sending down a configuration with the matching application. I have tested this by doing that first, then removing the DM application declaration, which causes the VPP app to be uninstalled, but Direct DM install does not work

Could you please file a feedback report and include a sysdiagnose from the device. Do one for the AppStore case and another for the enterprise app. We will need to look at the logs to try and determine what is going wrong.

Add a Comment

I am doing an MDM signature and would like to collaborate with you(2270132732mailbox)