'Enable ChatGPT' button blued out

[Greg1]

Hey folks, 

I'm having trouble allowing users to use ChatGPT. We allow Apple Intelligence on all machines, and so have all the allow buttons ticked in the Restrictions profile, aside from 'Allow integration with external intelligence services (macOS 15.2 or later, supervised)'.

I've removed a few test machines from the scope of the standard config profile, and duplicated the Restrictions Config profile, and then only included a few test machines, and this time allowed integration with external intelligence services (macOS 15.2 or later, supervised). The initial ChatGPT entry is fine:

but I'm seeing a strange blue box that almost looks like you could press it.

 

If you try to Use ChatGPT with an account, it doesn't allow that too (last screen shot).

Has anybody else experienced this?

[AJPinto]

Have you tried rebooting the devices? Some times with these keys you need to reboot for the setting to apply.

[Greg1]

I have, both machines are on 15.4.1, and it's still the same

[ceeghb]

I've exactly the same as you, have raised a support with Jamf but so far nothing useful....

[Greg1]

@ceeghb Please update the thread if you hear of a fix!

[ceeghb]

will do, you too please

[jtrant]

Are either of you setting the allowedExternalIntelligenceWorkspaceIDs key?

[Greg1]

No, this would potentially be in the next step, but to start with I just want users to be able to turn it on (I turned it on on my personal, non-jamf connected Mac to get an understanding how it looks, and on that machine I can turn it on, and also sign in too, on the unmanaged machine)

[ceeghb]

tried all settings, but yes it's on ATM, makes no difference :(

[ceeghb]

sorry misread, no we don't want users to use workspace ID and we don't have one anyway.

[jtrant]

If I remember correctly, there have been issues reported when setting these features to 'Allow'. What happens if you remove the MDM profile for Apple Intelligence completely?

[Greg1]

Here are my most recent steps.

If I remove all tickboxes relating to Apple Intelligence

Save, and Distribute to all, my Dock reboots (a sign the machine has downloaded the changes), and I am still signed in to Apple Intelligence.

After a reboot, I am still signed in to AI, and ChatGPT is disabled. After a sudo jamf recon, AI is still signed in. Checking the profile, the tags are set to False:

If I manually turn off AI, I can just manually turn it back on.


If I head back to jamf, and turn back on most the AI stuff:

my Dock reboots, the ChatGPT option is then clickable at the bottom of the AI panel, but again, same blued-out box, and I cannot turn on ChatGPT

[Greg1]

If I remove my test machines from the profile (so it is not applied to any machines), then clone the Profile, add the test machines to the copy, then distribute to the test machines, it's exactly the same (as expected)

[jtrant]

Un-checking the options in the Jamf Pro UI will disable those features.

My question is: If you remove the configuration profile related to Apple Intelligence completely does the feature become available? If so, something in your profile is causing this.

I would also recommend using a tool such as iMazing Profile Editor (and signing profiles before uploading) as Jamf Pro has a nasty habit of including other keys when configuring many payloads, including 'Restrictions').

[Greg1]

Eurgh, nasty habits are not something I want after spending €15k a year 😏

[Greg1]

And yes, if I remove the profile that is set to allow ChatGPT, then the option becomes available and ChatGPT is available.

 (ie, if I send the profile to the machine telling it to allow ChatGPT, it is not available)

[ceeghb]

Yes if I remove the config profile the blue button then works as normal, it seems a bug with jamf’s config profile because when you try to enable it, it doesn’t work, but does work if you try to disable Apple Intelligence.

[jtrant]

Recommend you inspect the contents of your profile using System Information on a target Mac to see what's actually getting pushed, or take a look at the profile in System Settings > Device Management.

You're better off using iMazing to create profiles, as I mentioned above.

[ceeghb]

Thanks will do tomorrow, but I did exclude my mac from global config profile, then checked it works, so created as brand new config profile with ONLY the default restrictions and this is what breaks it, should be something so simple but just doesn’t work. :(

[jtrant]

Feel free to post the text from System Information > Profiles on an affected device here. It's probably something Jamf is pushing that it shouldn't. All of my Apple Intelligence profiles were created outside of Jamf Pro, so I haven't run into this.

[ceeghb]

Interestingly when checking what's been pushed I don't even see the AI settings when they're enabled, perhaps this is normal, as when I DO restrict them I then see this reflected in settings;

Not sure if that's normal i.e. only disabled/disallowed settings get pushed?

[ceeghb]

so done some testing with imazing, updated the Manifest Repository Update successfully and could see AI under 'other' tab.

Behaves like config profile pushed via Jamf, if allowed no settings are pushed but restrict something and it appears, but still doesn't fix my problem :(

[jtrant]

Please provide the text from the following PLIST on an affected machine:

/Library/Managed\ Preferences/com.apple.applicationaccess.plist

[ceeghb]

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>allowCloudKeychainSync</key>
<true/>
<key>allowPasswordSharing</key>
<true/>
<key>allowAssistant</key>
<true/>
<key>allowFingerprintForUnlock</key>
<true/>
<key>allowCloudBookmarks</key>
<true/>
<key>allowInternetSharingModification</key>
<true/>
<key>allowRapidSecurityResponseInstallation</key>
<true/>
<key>forceDelayedMajorSoftwareUpdates</key>
<false/>
<key>allowTimeMachineBackup</key>
<true/>
<key>allowActivityContinuation</key>
<true/>
<key>allowAccountModification</key>
<true/>
<key>allowWritingTools</key>
<true/>
<key>forceClassroomAutomaticallyJoinClasses</key>
<false/>
<key>allowCloudPhotoLibrary</key>
<true/>
<key>allowRapidSecurityResponseRemoval</key>
<true/>
<key>allowCloudPrivateRelay</key>
<true/>
<key>forceUnpromptedManagedClassroomScreenObservation</key>
<false/>
<key>allowCloudMail</key>
<true/>
<key>allowPasswordProximityRequests</key>
<true/>
<key>allowScreenShot</key>
<true/>
<key>allowUniversalControl</key>
<true/>
<key>allowCloudDocumentSync</key>
<true/>
<key>allowARDRemoteManagementModification</key>
<true/>
<key>PayloadUUID</key>
<string>B7278DCD-A12D-4EA6-B0C5-FF5007A0CFAD</string>
<key>allowBluetoothSharingModification</key>
<true/>
<key>allowExternalIntelligenceIntegrationsSignIn</key>
<true/>
<key>allowCloudAddressBook</key>
<true/>
<key>allowCloudDesktopAndDocuments</key>
<true/>
<key>allowMediaSharingModification</key>
<true/>
<key>allowRemoteScreenObservation</key>
<true/>
<key>enforcedFingerprintTimeout</key>
<integer>172800</integer>
<key>allowMusicService</key>
<true/>
<key>allowExternalIntelligenceIntegrations</key>
<true/>
<key>allowRemoteAppleEventsModification</key>
<true/>
<key>allowCloudReminders</key>
<true/>
<key>allowCamera</key>
<true/>
<key>allowCloudNotes</key>
<true/>
<key>allowFingerprintModification</key>
<true/>
<key>allowiPhoneMirroring</key>
<true/>
<key>allowStartupDiskModification</key>
<true/>
<key>allowNotesTranscriptionSummary</key>
<true/>
<key>forceClassroomUnpromptedScreenObservation</key>
<false/>
<key>allowUIConfigurationProfileInstallation</key>
<true/>
<key>forceBypassScreenCaptureAlert</key>
<false/>
<key>forceClassroomUnpromptedAppAndDeviceLock</key>
<false/>
<key>allowGenmoji</key>
<false/>
<key>forceAirPrintTrustedTLSRequirement</key>
<false/>
<key>allowEraseContentAndSettings</key>
<true/>
<key>allowedExternalIntelligenceWorkspaceIDs</key>
<array>
</array>
<key>allowCloudFMM</key>
<true/>
<key>allowImagePlayground</key>
<false/>
<key>forceDelayedSoftwareUpdates</key>
<false/>
<key>allowPrinterSharingModification</key>
<true/>
<key>forceClassroomRequestPermissionToLeaveClasses</key>
<false/>
<key>allowUSBRestrictedMode</key>
<true/>
<key>allowCloudFreeform</key>
<true/>
<key>allowCloudCalendar</key>
<true/>
<key>_isAppleIntelligenceRestricted</key>
<true/>
<key>allowAirPrint</key>
<true/>
<key>allowMailSummary</key>
<false/>
<key>allowDeprecatedWebKitTLS</key>
<false/>
<key>forceDelayedAppSoftwareUpdates</key>
<false/>
<key>allowLocalUserCreation</key>
<true/>
<key>allowAirDrop</key>
<true/>
<key>allowSpotlightInternetResults</key>
<true/>
<key>allowContentCaching</key>
<true/>
<key>allowCloudBTMM</key>
<true/>
<key>allowFileSharingModification</key>
<true/>
<key>allowDeviceNameModification</key>
<true/>
<key>allowAirPrintiBeaconDiscovery</key>
<true/>
<key>allowPasswordAutoFill</key>
<true/>
</dict>
</plist>

[jtrant]

I think your issue is caused by the following. Unless you want to restrict Writing Tools, I recommend you remove:

<key>allowWritingTools</key>
<true/>

[Greg1]

If this helps, I just tried unticking Allow Apple Intelligence: Writing Tools (macOS 15 or later, supervised), in jamf and saving the existing profile. My machine updated (dock refreshed), but I can still not use ChatGPT

[Greg1]

oh, and my plist shows

<key>allowWritingTools</key>
	<false/>

after making this change

(allowExternalIntelligenceIntegrations is set to true)

[jtrant]

That's because un-checking the box disables the feature.

As I have mentioned before, iMazing Profile Creator is a far better option for crafting 'Restrictions' profiles. Jamf has a habit of including additional preferences when creating such profiles in the UI.

[ceeghb]

I get the same as @Greg1 , but if I enable the feature in Jamf GUI or even iMazing as far as I can tell it only puts an entry in the plist IF the item is disallowed.

As I'm enabling it (the default) there's nothing in the plist that should disable AI and ChatGPT?

Yes there are other thing in there too - by default but nothing related to AI and ChatGPT

[ceeghb]

Sorry that was nonsense, IF you look at the config profile through the Mac's UI you see nothing, but if you look at the plist you see things like;

<key>allowExternalIntelligenceIntegrationsSignIn</key>
<true/>

<key>allowExternalIntelligenceIntegrations</key>
<true/>

<key>allowGenmoji</key>
<true/>

<key>allowedExternalIntelligenceWorkspaceIDs</key>
<array>
</array>

<key>allowImagePlayground</key>
<true/>

<key>_isAppleIntelligenceRestricted</key>
<false/>

<key>allowMailSummary</key>
<true/>

to name a few, so I'm no further forward :(

[jtrant]

Setting any keys relating to Apple Intelligence creates a hidden key in com.apple.applicationaccess:

<key>_isAppleIntelligenceRestricted</key>
<true/>

This lets the system know that Apple Intelligence is managed. My point here is to not set any keys relating to Apple Intelligence if you don't want to restrict them. For your Restrictions profile, use iMazing to craft a test profile without selecting any of the Apple Intelligence features so that the hidden key doesn't get created to begin with.

This will ensure that <true> keys are not pushed for features you have no interest in managing and allow your users to use Apple Intelligence features normally.