iOS 9.2 Unable to install managed app from MDM

[Oops_wasn_t_me]

Good Morning,

Yesterday, we were advised of a possibility of iOS9.2 breaking VPP distribution. Please refer here:

https://forums.developer.apple.com/thread/27960

Can anyone using JSS confirm this ?

Thank you.

[rcorbin]

We appear to be seeing this. The apps that are supposed to be installed say "Pending - Application is not available to install " in the pending commands log. If you try to install an app from Self Service it appears to stay in pending as well. We are still doing some testing and were not aware of this until seeing this post.

[joergradler]

Yes, iOS 9.2 is causing issues. This affects all MDMs not just JAMF. We have been working with Apple Enterprise support on this but so far no solution.

Things we are experiencing are : -MDM commands queueing - not being able to push managed apps
- more frequent app crashes

[John_Wetter]

Yep, filed a radar on this. Apple seems to be aware of the issue. Let's hope for a fix soon!

[Emmert]

This is terrible. I really don't want to have to tell the users "it's an Apple bug, there's nothing we can do." I'll see if our Apple SE has any news.

[RWitt]

Yeah we do the peek a boo app store and our work around is if its a free app to just download from the app store by manually removing the MDM profile and then pulling when done. This is a time consuming fix when you have more and more devices having this issue.

For us the problem is only showing in a fraction of the fraction of devices that got updated before we put our block up.

As of Friday our SE simply told us to block 9.2 until they get a potential fix out next week.

[rcorbin]

I have no idea why, but it does seem to be working a little better today than it was on Friday. We do have a few 9.2 test iPads that we can now push apps down to via Self Service. But it's not 100% consistent. I wonder if there is a possibility this is more on Apple's VPP back end than just 9.2 ?

[rcorbin]

We have seen more 9.2 iPads working ok today than not working. It's not 100%, but more working than not.

[nsdjoe]

Hold off on updating any managed iOS devices to 9.2!!

We've had all kinds of problems with VPP MD device assigned apps since updating to iOS 9.2. And like others have said, its affecting all MDM's not just JAMF. Apple is aware of it. I've been in contact with our Apple SE and JAMF. The root cause of this issue seems to be that the MDM daemon on the OS crashes when processing certain types of commands, in particular with inventory update and install app commands. There is nothing we can do until Apple releases a fix.

Here's another post on JAMF Nation where users describe issues they are experiencing:
https://jamfnation.jamfsoftware.com/discussion.html?id=18143

Hoping that a fix is released soon!

[ultimobert]

i tested it out with myself with a ipad 4th gen 9.2 on simplemind pro with the vpp and just worked flawless.

my link text

my link text

my link text

[rcorbin]

@ultimobert We did some further testing and found it works on the first app. Then it will fail on any app you try after that. So yes it works sometimes, but there are big issues. @nsdjoe We look forward to that fix. We just prepped a bunch of iPads to 9.2 just before we discovered this was an issue so we are kind of in a holding pattern on those until this is fixed.

[TreviñoL]

I tested yesterday and was not able to push Self Service or corporate apps to my devices. But if I enroll the same device again everything works just fine.

[mks007]

This will be fixed in 9.2.1

Resolved Issues in iOS 9.2.1 beta

The following fixes are in iOS 9.2.1 beta software.

Device Management: Fixes a problem in iOS 9.2 that could prevent managed app installation. In iOS 9.2, if a Mobile Device Management (MDM) server sends an InstallApplication command to device, and then sends a ManagedApplicationList command before the app installation is finished, the app installation will not complete.

[steelopus]

Apple's official acknowledgement and response: https://support.apple.com/en-us/HT205654

[bcampbell]

Has anyone with the to the 9.2.1 beta installed confirmed that it fixes the MDM problem preventing an inventory and managed app installation?

[kuypers]

Yes it seems to have fixed the issue on my test device made apps managed again and getting Inventory updates. I also push the IOS 9.2.1 beta 2 to device yesterday and is working!!!!! Just Need Apple to release!!!

[msnowdon]

I am seeing this problem as well. Any idea when the new IOS version will be released?

[RLR]

Recently setup 50 9.2 iPads over the last few days and most of the time the apps installed fine. I have seen some failed commands but not too major. My main issue is that some apps crash as soon as you open them. I'm having to remove some apps and re-install them - wonder if this is part of the same issue?

[bcampbell]

@RLR I don't know about your app crashing (maybe you have some apps that aren't iOS 9 compatible?), but I've reliably found that with iOS 9.2 MANAGED apps won't install via MDM and inventory won't run because the bug in 9.2 seems to prevent the MDM getting a list of installed apps.

@msnowdon I wish I knew why it was taking Apple so long. It is confirmed (on this thread) that the problem is fixed in the 9.2.1 beta so I would assume that we will see the 9.2.1 public release any day now. Of course, I thought that would be the case over a week ago. The iOS 9.3 beta was supposedly just released.

[Emmert]

It was released, I have an iPad running 9.3 sitting next to me right now. I don't know why Apple is dragging their heels on 9.2.1. I was fully expecting the update to come out over winter break.

[msnowdon]

@emmert,
Why is my iPad on 9.2 and states it's up to date?

Thanks

Mark

[Emmert]

Sorry for the confusion:

9.2 is still the most current iOS release version as of today.

9.2.1 is in public beta.

9.3 is in developer beta.

[tdilossi]

We are bugging our Apple rep daily because we know they have had a successful beta so far. There are too many of us with this issue right now using JAMF, but from what I've read it is every MDM having this issue. Why can't they release the fix for this issue then release a later fix for other bug fixes? I've heard March for the release, and we honestly will be in a huge mess if we can't get it until then... Anyone else heard a release date?

[parkhillmoseley]

This is such a pain...we had (on JAMF's recommendation at our jump start in December) updated 100 of our devices to 9.2 - we then hard wiped them for the enrolment and now we've been sat unable to get our paid apps back on to them because we'd migrated all the licenses to Casper!

ARGH!!!

[tdilossi]

One of our educational support companies states that it may come out this week!!! I hope it is soon, since it is starting to be a huge issue.

[bcampbell]

@parkhillmoseley While it may not be the you want to do it if you have a choice, you can still get your paid apps on iPads with 9.2 before Apple fixes the MDM bug. Non-managed apps will install so you can install apps from Self Service manually (VPP codes or VPP managed licenses) if you uncheck the managed flag or install them from the App Store (if you have granted VPP managed licenses) using the Purchased tab.

If you do the former (manual install without managed flag), it seems that you will be able to switch them to managed later using relatively new Casper feature that allows you to switch apps on supervised iPads from unmanaged to managed silently.

Unfortunately, you can install the JAMF Self Service app since the only way to get that to work is to install it managed (so it gets the proper configuration for your server), but you could use the Self Service web clip until Apple release 9.2.1.

Besides, karma says that if you go through all the work-around steps to get your apps installed unmanaged before the 9.2.1 updated is released, it will get released right after you do all the work. :-)

[RLR]

Does anyone know if this issue is also causing other commands to pend? I've got a couple of iPads in front of me which I'm trying to update their inventory but the command is just stuck at pending. Also trying to get a student to accept their VPP invite but the command is also stuck at pending. I've checked our push certificates and their still valid. Apple push notification service status seems fine also. Not sure what else could be causing this.

[cpdecker]

@RLR , this has been a huge headache for us. Once iPads go to 9.2 we can't send any management commands to them, so that means no configuration profile changes, no managed App installs via Self Service, no inventory updates (although it seems that Casper shows some devices have checked in even though the inventory update that was issued is still hanging).

However, I had a freshly unboxed iPad that was shipped with 9.2 and I enrolled it yesterday, installed configuration profiles, installed managed Apps, accepted VPP and sent inventory updates over the air after enrollment. I felt like I was losing my mind, but now I'm postulating that there's a difference between being enrolled on 9.2 versus being enrolled on a previous release and then upgrading to 9.2. Also there's the possibility that having any kind of "hidden" queued commands causes an issue, as I've heard that you need to work with your TAM to clean up the Casper database for some problem 9.2 iPads, rather than relying on the web GUI, so maybe deleting the iPad from Casper and doing a complete re-enrollment makes a difference. Not suggesting this as a course of action, just theorizing. Also, trying to test this theory today.

Our JAMF Senior Engineer advised that some customers seem to have no issues with 9.2, others have nothing but issues with 9.2, and some are a mix. We are extremely ready for 9.2.1 to come out so we can hopefully put this behind us. We just received a new deployment shipment of 500 iPads with 9.2 out of the box and we don't know how to progress from here. Apple--clean up your Enterprise support. We are not happy.

[bcampbell]

@RLR Inventory will hang MDM commands due to the 9.2 bug.

My experience and what seems consistent with what Apple has said is the bug is that the problem is when the MDM requests a list of installed apps. That API call apparently causes the software on the iPad that responds to crash. An inventory as well as installation of a managed app seems to use that API call. If I clear out managed app installs and inventories in the JSS, I have been able to install configuration profiles. Installation of apps from Self Service has also worked fine as long as the app object is NOT set to install managed. (Since automatic/silent installs can only be done as managed, those never work and hang any commands behind that on the iPad.)

@cpdecker Interesting that you have been able to run inventory and install managed apps on a newly unboxed iPad with 9.2. That seems bizarre unless Apple has multiple build numbers for iOS 9.2. My iPad which has the problem with managed apps an inventory shows 13C75 in parens next to 9.2 as the Version when I look under Setting > General > About. Do your iPads that work correctly show the same build?

[RLR]

@bcampbell @cpdecker We had a new student start and her iPad we gave her would not send any commands since the day it enrolled to the MDM. I gave her a replacement iPad today which is also on 9.2 and it works absolutely fine. All commands I send to it arrive instantly. It seems like there are hidden commands holding up the queue. Very frustrating.

As previously stated, I just setup 50 shared ipads for our preprep and I thought it went really well. Been getting a few emails about some apps not working. I sure hope an update is released soon.

[dnikles]

We have over 2600 managed IOS devices on our JSS and have now gone over a month where we really cannot manage them. Jamf seems to do nothing about it other than say oh well let's just wait for apple to fix it. It sounds like other MDM solutions have found work arounds. Apple keeps telling us the fix is around the corner but weeks later we are still waiting. I'm surprised how few responses there are in this thread about this. Is anyone able to do anything with Apple's suggested fix and I'm just missing something? https://support.apple.com/en-us/HT205654

[bcampbell]

@dnikles It is surprising to hear that other MDM solutions have work arounds. I wonder what they are? If that is indeed true that JAMF is one of the only MDMs still having this problem then maybe I see what Apple hasn't prioritized this at the level I would suspect.

However, it seems odd that other MDMs are affected as Apple suggested "fix" is to not do things that require the InstallApplication and ManagedApplicationList commands as Apple's software on the iPad the services those commands seems to be what is broken (by Apple's own admission) on iOS 9.2 not JAMFs software.

I've been able to successfully manage all the iPads at my school with regard to other management tasks such as configuration profiles, unlocks, etc, as long as the iPad doesn't try to install managed apps (that would be all the automatic installs) or run an inventory. Once those try to run all other management commands in the queue seem to get stuck.

The automatic installation of apps as managed as been a big part of the issue here. Other than the Self Service app, I really don't care if apps are managed or unmanged. I'd actually prefer unmangaged, but there is no way in Casper to set an app for automatic app install, which is silent on a supervised iPad, without the installation being managed. Managed apps scare me when they are really not needed since a slip in scope rips the app AND DATA off the iPad. Usually, I just want to be able to push the app on the iPad. I don't care about being able to remove it automatically.

I always assumed the automatic install/managed requirement that was an Apple API restriction (kind of makes sense I guess), and not a choice by JAMF. Are there other MDMs that allow silent/automatic install of unmanged apps?

[jcline_bigos]

Just in case this helps anyone, we have been suffering with the 9.2 issues as well. Surprisingly, when our Cloud instance of JSS was updated to 9.82, most of these problems have gone away. Failed commands get retried now and managed app installation is going well now. I'd be interested to hear if anyone else is seeing the same improvement with the latest JSS?

[cdenesha]

We have not noticed any difference in managed app installations from Self Service (students are still coming to get the app store enabled for an unmanaged install), nor Update Inventory commands as they still get stuck when freshly sent. We have been on hosted 9.82 for a week.

Even though this is an Apple bug, I think I have identified an area where JAMF can improve. I wrote up a Feature Request addressing the stuck Update Inventory commands and how they are implemented partially in the JSS. Please upvote it if you agree.

Thank you,

chris

[tdilossi]

There are several work arounds however when the api is broken (which is what the bug breaks), you can't get to it. The issue with this bug is that it is inconsistent not all 9.2 iPads are out of touch. If you wipe the device and re-enroll it you will have access to it until the user does something to break the api again. It could be as easy as going to the app store or the safari app and browse the internet. They don't know exactly what breaks it. My tech director wants us to install the beta on Tuesday if there is no release of 9.2.1 by then.. My guess is as soon as we install the beta, the release will come...
We have the 9.82 JSS update installed, and still have huge issues with our inventory running 9.2.

[rcorbin]

Suddenly lots of discussion about this today. This is causing us huge issues. We have lots of iPads that were updated to 9.2. We also have lots of iPads we would like to update and 9.2 would just make life worse. It's holding up a lot of projects. We had just converted all of our codes to tokens for use with Casper as our main app distribution method. I was just reading @tdilossi 's post and the idea of putting the beta on certain units. I might be getting that desperate soon. Got me wondering if the 9.2.1 beta is public or an NDA private one. And if I did that would I be able to push out the final 9.2.1 build when it comes out via Casper. Getting desperate here...

[bcampbell]

@rcorbin My experience has been that you can still install apps non-managed. That means for VPP tokens/licenses you should be able to still get the content to the iPads, but you can't push it for a silent/automatic install. Once you scope the VPP licenses to users, Apple adds the app to the purchased history for those Apple IDs. If you create an app object for the app without VPP codes (or you can mark it as free), users should still be able to install the app from Self Service as Apple will see it as purchased and not require payment or a new license. Therefore, while this bug is a real pain (and I'm waiting for it to be fixed too), whether you are using old-style VPP codes or the newer VPP managed licenses/tokens does change what you are able to do with regard to getting the app installed.

I've seen multiple people equating using VPP licenses (instead of codes) as being a particular challenge while this bug goes unfixed so please correct me if you find what I'm saying above to be incorrect. From what I'm seeing the license method is irrelevant.

[cpdecker]

@bcampbell , I think it is odd too. I went ahead and set up 26 test iPads that had 9.2 out of the box and had 0 issues with them except for what seems to be a VPP glitch on 3 of them. Can't get VPP invitation 1 of 2 to go through, but the new one I recently created worked. Both VPP invites worked on the other 23. Inventory updates still go through after reboot. Managed App installs work from Self Service.

As far as I know, there's only one build available for 9.2 right now. The iPads we have been unboxing are cell carrier capable though, and none of our others are. That could potentially be a difference, even though it probably isn't.

I also feel your pain regarding managed App installs. I'm terrified of them too, especially since I've fat fingered scope changes before. But that's the only option we have when the App Store is disabled. Apple is now pushing for managed installs after we were told to go unmanaged during our Summer refresh.

@rcorbin , I think many of us were hoping this would be straightened out by the time we got back from Christmas break. That's the boat I was in. Now reality has set in along with the panic.

We are afraid to move forward with deploying these iPads until 9.2.1 for fear that things will start derailing immediately after, even though we have had success so far. We need to be able to block updates and roll back updates. That should be a primary feature for Enterprise managed devices.

[kweber]

Here it is, the 19th of December now, and no word from Apple on the release of 9.2.1. This is getting ridiculous.

[John_Wetter]

9.2.1 just dropped!

Apple's website hasn't updated yet but it is available OTA.