iOS 9.2 Unable to install managed app from MDM

Does anyone know if this issue is also causing other commands to pend? I've got a couple of iPads in front of me which I'm trying to update their inventory but the command is just stuck at pending. Also trying to get a student to accept their VPP invite but the command is also stuck at pending. I've checked our push certificates and their still valid. Apple push notification service status seems fine also. Not sure what else could be causing this.

@RLR , this has been a huge headache for us. Once iPads go to 9.2 we can't send any management commands to them, so that means no configuration profile changes, no managed App installs via Self Service, no inventory updates (although it seems that Casper shows some devices have checked in even though the inventory update that was issued is still hanging).

However, I had a freshly unboxed iPad that was shipped with 9.2 and I enrolled it yesterday, installed configuration profiles, installed managed Apps, accepted VPP and sent inventory updates over the air after enrollment. I felt like I was losing my mind, but now I'm postulating that there's a difference between being enrolled on 9.2 versus being enrolled on a previous release and then upgrading to 9.2. Also there's the possibility that having any kind of "hidden" queued commands causes an issue, as I've heard that you need to work with your TAM to clean up the Casper database for some problem 9.2 iPads, rather than relying on the web GUI, so maybe deleting the iPad from Casper and doing a complete re-enrollment makes a difference. Not suggesting this as a course of action, just theorizing. Also, trying to test this theory today.

Our JAMF Senior Engineer advised that some customers seem to have no issues with 9.2, others have nothing but issues with 9.2, and some are a mix. We are extremely ready for 9.2.1 to come out so we can hopefully put this behind us. We just received a new deployment shipment of 500 iPads with 9.2 out of the box and we don't know how to progress from here. Apple--clean up your Enterprise support. We are not happy.

@RLR Inventory will hang MDM commands due to the 9.2 bug.

My experience and what seems consistent with what Apple has said is the bug is that the problem is when the MDM requests a list of installed apps. That API call apparently causes the software on the iPad that responds to crash. An inventory as well as installation of a managed app seems to use that API call. If I clear out managed app installs and inventories in the JSS, I have been able to install configuration profiles. Installation of apps from Self Service has also worked fine as long as the app object is NOT set to install managed. (Since automatic/silent installs can only be done as managed, those never work and hang any commands behind that on the iPad.)

@cpdecker Interesting that you have been able to run inventory and install managed apps on a newly unboxed iPad with 9.2. That seems bizarre unless Apple has multiple build numbers for iOS 9.2. My iPad which has the problem with managed apps an inventory shows 13C75 in parens next to 9.2 as the Version when I look under Setting > General > About. Do your iPads that work correctly show the same build?

@bcampbell @cpdecker We had a new student start and her iPad we gave her would not send any commands since the day it enrolled to the MDM. I gave her a replacement iPad today which is also on 9.2 and it works absolutely fine. All commands I send to it arrive instantly. It seems like there are hidden commands holding up the queue. Very frustrating.

As previously stated, I just setup 50 shared ipads for our preprep and I thought it went really well. Been getting a few emails about some apps not working. I sure hope an update is released soon.

We have over 2600 managed IOS devices on our JSS and have now gone over a month where we really cannot manage them. Jamf seems to do nothing about it other than say oh well let's just wait for apple to fix it. It sounds like other MDM solutions have found work arounds. Apple keeps telling us the fix is around the corner but weeks later we are still waiting. I'm surprised how few responses there are in this thread about this. Is anyone able to do anything with Apple's suggested fix and I'm just missing something? https://support.apple.com/en-us/HT205654

@dnikles It is surprising to hear that other MDM solutions have work arounds. I wonder what they are? If that is indeed true that JAMF is one of the only MDMs still having this problem then maybe I see what Apple hasn't prioritized this at the level I would suspect.

However, it seems odd that other MDMs are affected as Apple suggested "fix" is to not do things that require the InstallApplication and ManagedApplicationList commands as Apple's software on the iPad the services those commands seems to be what is broken (by Apple's own admission) on iOS 9.2 not JAMFs software.

I've been able to successfully manage all the iPads at my school with regard to other management tasks such as configuration profiles, unlocks, etc, as long as the iPad doesn't try to install managed apps (that would be all the automatic installs) or run an inventory. Once those try to run all other management commands in the queue seem to get stuck.

The automatic installation of apps as managed as been a big part of the issue here. Other than the Self Service app, I really don't care if apps are managed or unmanged. I'd actually prefer unmangaged, but there is no way in Casper to set an app for automatic app install, which is silent on a supervised iPad, without the installation being managed. Managed apps scare me when they are really not needed since a slip in scope rips the app AND DATA off the iPad. Usually, I just want to be able to push the app on the iPad. I don't care about being able to remove it automatically.

I always assumed the automatic install/managed requirement that was an Apple API restriction (kind of makes sense I guess), and not a choice by JAMF. Are there other MDMs that allow silent/automatic install of unmanged apps?

Just in case this helps anyone, we have been suffering with the 9.2 issues as well. Surprisingly, when our Cloud instance of JSS was updated to 9.82, most of these problems have gone away. Failed commands get retried now and managed app installation is going well now. I'd be interested to hear if anyone else is seeing the same improvement with the latest JSS?

We have not noticed any difference in managed app installations from Self Service (students are still coming to get the app store enabled for an unmanaged install), nor Update Inventory commands as they still get stuck when freshly sent. We have been on hosted 9.82 for a week.

Even though this is an Apple bug, I think I have identified an area where JAMF can improve. I wrote up a Feature Request addressing the stuck Update Inventory commands and how they are implemented partially in the JSS. Please upvote it if you agree.

Thank you,

chris

There are several work arounds however when the api is broken (which is what the bug breaks), you can't get to it. The issue with this bug is that it is inconsistent not all 9.2 iPads are out of touch. If you wipe the device and re-enroll it you will have access to it until the user does something to break the api again. It could be as easy as going to the app store or the safari app and browse the internet. They don't know exactly what breaks it. My tech director wants us to install the beta on Tuesday if there is no release of 9.2.1 by then.. My guess is as soon as we install the beta, the release will come...
We have the 9.82 JSS update installed, and still have huge issues with our inventory running 9.2.

Suddenly lots of discussion about this today. This is causing us huge issues. We have lots of iPads that were updated to 9.2. We also have lots of iPads we would like to update and 9.2 would just make life worse. It's holding up a lot of projects. We had just converted all of our codes to tokens for use with Casper as our main app distribution method. I was just reading @tdilossi 's post and the idea of putting the beta on certain units. I might be getting that desperate soon. Got me wondering if the 9.2.1 beta is public or an NDA private one. And if I did that would I be able to push out the final 9.2.1 build when it comes out via Casper. Getting desperate here...

@rcorbin My experience has been that you can still install apps non-managed. That means for VPP tokens/licenses you should be able to still get the content to the iPads, but you can't push it for a silent/automatic install. Once you scope the VPP licenses to users, Apple adds the app to the purchased history for those Apple IDs. If you create an app object for the app without VPP codes (or you can mark it as free), users should still be able to install the app from Self Service as Apple will see it as purchased and not require payment or a new license. Therefore, while this bug is a real pain (and I'm waiting for it to be fixed too), whether you are using old-style VPP codes or the newer VPP managed licenses/tokens does change what you are able to do with regard to getting the app installed.

I've seen multiple people equating using VPP licenses (instead of codes) as being a particular challenge while this bug goes unfixed so please correct me if you find what I'm saying above to be incorrect. From what I'm seeing the license method is irrelevant.

@bcampbell , I think it is odd too. I went ahead and set up 26 test iPads that had 9.2 out of the box and had 0 issues with them except for what seems to be a VPP glitch on 3 of them. Can't get VPP invitation 1 of 2 to go through, but the new one I recently created worked. Both VPP invites worked on the other 23. Inventory updates still go through after reboot. Managed App installs work from Self Service.

As far as I know, there's only one build available for 9.2 right now. The iPads we have been unboxing are cell carrier capable though, and none of our others are. That could potentially be a difference, even though it probably isn't.

I also feel your pain regarding managed App installs. I'm terrified of them too, especially since I've fat fingered scope changes before. But that's the only option we have when the App Store is disabled. Apple is now pushing for managed installs after we were told to go unmanaged during our Summer refresh.

@rcorbin , I think many of us were hoping this would be straightened out by the time we got back from Christmas break. That's the boat I was in. Now reality has set in along with the panic.

We are afraid to move forward with deploying these iPads until 9.2.1 for fear that things will start derailing immediately after, even though we have had success so far. We need to be able to block updates and roll back updates. That should be a primary feature for Enterprise managed devices.

Here it is, the 19th of December now, and no word from Apple on the release of 9.2.1. This is getting ridiculous.

9.2.1 just dropped!

Apple's website hasn't updated yet but it is available OTA.

Woo Hoo!

Thanks for the heads up! Now let's see what 9.2.1 breaks :)

While 9.2.1 does seem to fix this MDM bug, is anyone seeing storage issues on iPads which appear to have been caused by the 9.2 MDM craziness? We ran into a large number of iPads inexplicably running out of storage while on 9.2. iTunes shows the missing storage listed as "other". So far the only way to reclaim the missing storage is by resetting the device.

Updated a few iPads that were having all sorts of issues with MDM functions and the 9.2.1 update fixed them all. So far so good!

FYI Look here for thread started by @jake of JAMF announcing iOS 9.2.1 release and suggest​ion for pushing mass update of 9.2.1.

Is anyone else still having problems getting managed apps installed via JAMF in 9.2.1?

I'm still seeing issues where it is randomly installing 3-4 apps and not installing the others. All apps are free and one is an in house app. Sometimes I get two apps, sometimes all of them. The error I see is "the app "whatever" is already scheduled for management" but it never installs.

I've tried restoring back to factory and then running my 3 blueprints in C2 (restore backup, apply wifi and CA, enroll jamf). Everything worked perfectly for about 2 weeks, but now as iPads come back and I have to run my C2 process and re-enroll they won't pick up all the apps??

Is anyone else still having problems getting managed apps installed via JAMF in 9.2.1? I'm still seeing issues where it is randomly installing 3-4 apps and not installing the others. All apps are free and one is an in house app. Sometimes I get two apps, sometimes all of them. The error I see is "the app "whatever" is already scheduled for management" but it never installs. I've tried restoring back to factory and then running my 3 blueprints in C2 (restore backup, apply wifi and CA, enroll jamf). Everything worked perfectly for about 2 weeks, but now as iPads come back and I have to run my C2 process and re-enroll they won't pick up all the apps??

@mtiffany I'm not 100% on this but I believe if the app is a free app you need the free option ticked in the app catalogue. If it is a paid app, you leave the Free option unticked.

Found this from the comments on: https://jamfnation.jamfsoftware.com/featureRequest.html?id=4434

If app was free in App Store/VPP - checkbox needs to be checked If app was paid in App Store/VPP - checkbox should not be checked The JSS is essentially asking you whether the type of license that this app requires is a free license or a paid license. If this checkbox is improperly checked/unchecked for an app, and a user goes to download the app, the error "the app 'com.whatever.whatever' is already scheduled for management" is returned in the device record. This error, as far as I understand from support calls, means that the JSS thinks that the app is already on the device, and it's trying to manage the app.

Is this something that is fixed between jss versions 9.81 and 9.82? I'm still at 9.81 so I'm wondering if that is the problem.

@mtiffany I think many of the fixes in 9.82 are to do with VPP and DEP. It cleared up a few things for us.

@mtiffany We're on 9.82 and I've recently setup 60 shared iPads with VPP device assignment. I still get that same error message but the app seems to install still.

@rcorbin @RLR Thanks for your help! I just updated our jss to 9.82 this morning. None of the iPads that were not getting the apps previously started installing them. So I'm wiping one of them with C2 and will take it back through my normal process and see how it comes out on the other side. Fingers crossed!