Hi @Cooldude1259 — that log line points to the app-install restrictions, not to a Siri / Apple Intelligence restriction and not to Private Cloud Compute.
SAD is appstored's non-MDM system-app download path. When Siri AI is on, generativeexperiencesd asks appstored to install com.apple.SiriApp (Campo) on demand. That request is not an MDM InstallApplication command, so it does not get the MDM override that Jamf-delivered apps get — it is evaluated against the ordinary app-install restrictions, and one of them is returning "prohibited" for that bundle ID. Hence installID(s): [] and the silent failure on every 27.x build.
Check the com.apple.applicationaccess (Restrictions) payload actually installed on the device, in this order:
1. allowAppInstallation = false — the prime suspect. In Jamf Pro: Configuration Profile > Restrictions > Apps > "Installing apps using Apple Configurator and iTunes" set to Restrict. If false, users cannot install or update apps by any method other than Jamf Pro / MDM, and MDM commands are the exception that can override it. Campo is not MDM-delivered, so it falls straight into the block.
2. allowUIAppInstallation = false — "Installing apps using App Store" set to Restrict. Schools usually restrict this together with #1, so check both keys in the raw profile, not just the Jamf UI labels.
3. Only if both of those are allowed: App Usage = "Only some apps allowed" (allowListedAppBundleIDs, or in iPadOS 27 the declarative com.apple.configuration.app.settings AllowedApps). If that list is present and com.apple.SiriApp is not in it, add it — and confirm it is not in blockedAppBundleIDs / DeniedApps either.
allowAssistant, allowSiriAI = false, and the PCC restrictions are not it: those stop the capability or the request itself, they do not produce an appstored install refusal after the capability check has already passed with CampoNotInstalled as the only missing item — which is exactly what you are seeing.
A quick isolation test for your admin: exclude one test iPad from that Restrictions profile (or clone it with both app-install restrictions allowed, plus com.apple.SiriApp added to the allowlist if one is in use), reboot, then toggle Siri AI off and on. Campo should download, the Siri app should appear, and the capability check should clear. That confirms it without touching any other profile.
One trade-off to flag to your admin: allowAppInstallation has no per-bundle-ID exception, so if #1 is the culprit there is no narrow "allow only SiriApp" switch in the legacy Restrictions payload — keeping the fleet-wide App Store lockdown and enabling Siri AI are mutually exclusive, unless the allowlist in #3 turns out to be what is blocking it. Lifting the restriction just for an enrolment window will install Campo, but its later updates use the same SAD path and will be blocked again once the restriction is re-applied.
— Justin (Jamf Certified Expert, Jamf 400)
