Can't apply software updates from Jamf

[sysadmin404]

Hi all,

I am trying to push Software Updates to a smartgroup, but this doesn't seem to go through; I tried many options (Download only, Download and install, Download and schedule to install ecc.) but nothing seems to work. This is happening on Apple Silicon device.

Having a check on the device > History > Operating System History, I see the Software Update failed and the error message:

"AppleSiliconNoEscrowKey".

Running sudo profiles status -type bootstraptoken I see the token is supported and is escrowed, and while running 

sudo profiles validate -type bootstraptoken I see the token has been obtained from the server and is validated.

I am sure I am missing some basic checks, but can't find what.

Has anyone had the same issue?

[AJPinto]

In my experences software update issues are usually related to network configurations. What does /var/log/install.log say on an impacted device?

[sysadmin404]

I see a lot of info in the logs file.. is there any specific term I need to search for? Searching for "software update" or "softwareupdate" returns ~300 results. I am pretty new to Jamf Pro, so I don't know how to proceed for this.

[AJPinto]

Unfortunately the install.log is a mess. You more or less need to read the logs around the OS update events and find stand out.

SUOSUAuthenticationManager should come up around the start of the OS update workflow. This is the authentication to do the thing. softwareupdated is the deamon doing the stuff, and you can pretty much ignore anything not related to softwareupdated.

[mvu]

Is your Jamf on cloud or on-prem?

Wondering if you're using DDM. If so, could try turning off the SOftware Update Feature. Then toggle back on after records clear.

[Shyamsundar]

What is the status of BootStrap Token Escrowed in the Security, It is displayed as Yes or No. 

When I ran sudo profiles status -type bootstraptoken Manually on the device it showed Yes for both Supported on Server and Escrow on Server, but the Bootstraptoken status is displayed as No on the JAMF inventory

have raised a case with JAMF and had a two-level troubleshooting call, Shared the System diagnostic files from the affected devices, and waiting for the update from JAMF. it seems like a PI, 

I would advice raising a case with JAMF, So they know it's more spread.