Prestage Enrolment - Last Sync

We have a similar issue. I noticed that our DEP was showing an error connecting to the server. Although the Token was not expired, I went ahead and uploaded the latest public key to the apple business portal and downloaded and installed a new Token.
Under 'All settings> DEP' I see that we are syncing with Apple every 5 minutes as expected.
However, our pre-stage has not synced in over an hour.

mine hasn't synced since the 13th, but is still working as normal. that date obviously coincides with my hosted service being upgraded.

Another thing i've noticed is that the additional administrator account created in my DEP prestage is still created, however the account is hidden. The box to hide it is NOT checked, and this only recently began happening, almost randomly.

Same "issue" here. Our pre-stage enrollment hasn't synced since the 03/25.

I just ran into this yesterday. This might not be the solution but I created a new public key and uploaded it to Apple Business Manager and downloaded a new token and uploaded it to Jamf to update it and within a couple of minutes everything was good. Again I’m not sure this is the definitive solution but it worked for me.

Hi Arivera,

Tried what you recommended, still no luck.

Also can't seem to add devices to certain pre-stage enrolments.

If i setup a new prestage then i get a jamf server error.

Hi @arivera ,
I also went through this process as you can see from my original post, however, even though everyting is functioning as expected, the "last sync" field has not updated since the Token was updated. Are you seeing the same?

@simon.brooke does Apple Business Portal show that it has recently
connected to your MDM?

Response from Jamf Support. Appears our environment is operating normally since update 10.11.

"The token sync which syncs devices assignments and settings in the DEP prestages will happen every 5 minutes. That was the new update with DEP prestage refactoring in 10.11. So if we add or remove a device to a prestage that will get updated on the back end during the next token sync. But the "Last Sync" time won't actually update until the DEP prestage settings themselves update. When we make changes to the actual settings in the General pane, such as changing steps that are skipped or not, the phone number, display etc. then that will kick off an update of the DEP prestage settings themselves and that field will then update at next token sync. We will then see a new message in the interim stating "Awaiting next sync". Making changes to other panes will not initiate a new sync of the prestage as those settings are not being sent to Apple, only the General pane settings."

I've seen the same thing here but it's been 10 days for me. I even created a new Prestage Enrollment with no luck.

Not to hijack your post but I am seeing the last sync as 4/13 but whats even weirder is just in Prestage Enrollment my Save button is not active. Anyone else seeing that?

@simon.brooke have you been able to fix the problem? I've been having pre-stage issues for a few weeks. New Macs added to the DEP wont pick up the pre-stage groups even though they are scoped to it.

@bruth85 I was seeing this as well. I'd not be able to save the first time try, if I do a refresh I'm able to save the changes.

@a.simmons just an update on the save option not working. Working with Jamf Support found that they are currently having issues with Chrome when there is an ad-blocker enabled on the browser it messes with the Save on PreStage environment. If you use another browser or incognito mode you are able to save just fine.

@a.simmons I just recieved an update the other day that the issue should be resolved in 10.12 when they release it.

We're massively affected by this.

DEP Tokens show they sync without issues, but our PreStage Profiles are having issues. Devices are not DEP enrolling as they're not pulling a Device Enrollment Configuration. So on Apple's Device Enrollment server/service side, it doesn't know the device is assigned to a PreStage.

Every time we have a DEP Issue after an Jamf Pro Upgrade, support wants us to renew our Tokens, but we have roughly ~100 Tokens (because we have that many Sites, so we have to have that many DEP Tokens, but I am working to consolidate these). It's not feasible for us to renew our DEP Tokens at the drop of a hat, mostly because we have to rely on oodles of Site Admins to do this for every Site/DEP Token.

And this time they want us to REPLACE all of the DEP Tokens.....? Sigh...

Every upgrade we have another DEP issue. Oh and every time they touch something in DEP, they break being able to move devices between DEP Tokens without having to unassign it from the original PreStage first.... This has been going on since v9.100.0... -_-

Having the same issue, currently running 10.9.0

Thanks @bruth85 We havent been able to use the DEP process since the start of April, since Jamf upgraded our cloud server to 10.11. We have an open ticket with Support but we have made no progress so far. I've been forced to go back to using Thin Imaging.

Yeah, I'm not getting any where either. Jamf Support just wants us to replace our DEP Tokens, which is always their requested action and has never resolved an issue. I just spent an hour today it today, because of the number of tokens we have and no change in behavior.

@bruth85 Thank you for this bit of information. Been banging my head all day wondering why my pre-stage was not working since I got to 10.12. I noticed it hadn't updated for 2 days, but when I checked the general DEP config page, it was syncing normally. Launched the JSS in Edge and saved the prestage, not it actually synced right away and my device enrolled no problem. What a stupid problem. FYI, I came from 10.10.1 and did not have this problem until 10.12. Must be related to how they changed DEP syncing in 10.11.

My main issue was that we had a DEP PreStage that was assigned to a Site that didn't have a DEP Token.

Now we can DEP Enroll new devices, but still seeing other issues with PreStages:

1. "Automatically Assign New Devices" does not seem to be honored
2. Devices have to be unassigned from a PreStage before a device can be reassigned to the DEP Token

I did notice that in my case, the PreStage enrolment only syncs once I change any settings on its configuration. It's not syncing when adding or removing computers manually.

This week I had to create a new PreStage enrolment profile with 5 computers that were assigned to different profiles. When checking the scope for this new profile, these computers were checked in there however, when checking the same computers in the DEP settings, they were still stuck to their old profiles.

To me it's either a bug on the Jamf Cloud system or in the 10.11 or 10.12. I'm saying it because after seven years using Jamf Pro in an internal server, we migrated in April to the Cloud. Our internal server was still running 10.8 and I've never had this issue before. Also, our tokens were created in April with the migration, so the token might not be the issue either.

I've also opened a ticket with the support and hopefully it can be solve this coming week.

I hope it helps you guys too.

Thanks,
Luis

I had all the issues described above since 24 May but as suggested, I re uploaded my token from ASM to JAMF and it started working.

Had our DEP token stop talking to Jamf sometime in the last 24hrs, reuploaded it and it's talking to ASM now but our prestage still hasn't synced for a solid hour. Tried to modify some of the pre-stage enrollment settings but still no dice.

I am experiencing these issues starting this week (we don't PreStage often and just noticed this behavior on Wednesday). Currently at 10.11. I have followed all the suggestions here:
Downloading new Public Key from JSS
Uploading new Public Key to ASM
Downloading new token from ASM, then uploading into JSS DEP.

Reassigned device just to start cleanly.
Scoped device to the PreStage (newly created)

My Sync dates in both PreStage, DEP and ASM all are current.

Still, No PreStage action from Setup assistant.

Can anyone confirm if upgrading to 10.12 has resolved this?

Cheryl

@ctarbox upgrading to 10.12 didn't fix the problem for us. Our Jamf server is hosted in the cloud and Jamf support ended up finding a corrupt entry in the database pointing to DEP token that is no longer in use. Once the removed the corrupt entry it started working correctly.

DEP Tokens that are missing info and/or have been invalidated, will cause issues.

PreStage Profiles that are assigned to a Site that does not have a DEP Token will cause issues. This was a bug (you were able to delete a DEP Token that had an associated PreStage) in a recent version of Jamf Pro. Jamf fixed it in a more recent version of Jamf Pro. However, what they failed to do, is to check if you're currently affected by it....which leads to a new problem.

We are having the same issue here over a month ago on that last sync. Has there been any developments on how we can get our Enrollments syncing again?