iPadOS: Awaiting final configuration from loop

[anthonydattorro]

Our organization recently moved over to Jamf Cloud from on-prem hosting. Trying to provision five iPads for a department. Stuck on awaiting final configuration from "our organization" loop. Has anyone experienced this before and if so how did you resolve it? I've already unassigned and reassigned the devices to our MDM in ASM and then wiped the devices in Apple Configurator. Left the iPads running overnight and it was still stuck on awaiting final configuration from "our organization". We had no issues with mobile devices with on-prem hosting.

[maffettb]

Hmmm, I have always been hosted and have not seen this behavior that I can recall in the past 4 years but just this morning trying to wipe some devices, I have 4 iPads that are sitting in this state :(

[jphillips]

Yes, we're seeing this on almost all iPads that are on some flavor of 14.x. It will sit at the Awaiting Final MDM Configuration screen, sometimes for a couple of hours, before moving on. Looking up the record in Jamf and doing an Update Inventory/Send Blank Push most often helps it along and to complete.

It seems there is something getting hung up either from Jamf->iPad, or from iPad->Jamf that lets the other know "hey I'm done and ready to move on".

All of our 13.x iPads enroll straight away and do not sit on the screen, which leads me to believe it's an iPadOS 14.x issue.

[sjuarez]

I see this sometimes as well on iPads that are running iOS 14.x. What sometimes helps me, when it gets stuck, I just restart the iPad and that will push it through when it gets to that step again. I haven't tried the Update Inventory/Send Blank Push that @jphillips mentioned though. I'll have to try that when I get another one I have to restore.

[cbrewer]

We see this happening in our environment when our wireless profile gets installed during enrollment. The iPad will switch to the new wireless network, but subsequent MDM commands get queued and won't go through until a Blank Push is sent. This is a new problem with iOS 14 and so far both Jamf and Apple are saying it is expected behavior.

[Tribruin]

Do you have Install Configuration Profiles before Setup Assistant checked in your PreStage Enrollment? It is possible that a configuration profile is failing to install properly and hanging up the process. Maybe try turning that off and see if you can identify any bad profiles?

[anthonydattorro]

Hello everyone! Thanks for all of you responses. Turns out me connecting the iPads to a mobile hotspot during enrollment got me past waiting for config. Might be an issue with our on prem wifi and networking having to adjust our inbound/outbound traffic for Jamf Cloud: https://www.jamf.com/jamf-nation/articles/409/permitting-inbound-outbound-traffic-with-jamf-cloud

I'll keep everyone in the loop on how we resolve this issue without having to use a mobile hotspot.

[atomczynski]

Hi @anthonydattorro

From your reply, it sounds like you are able to enroll while connected to a mobile hot spot but are experiencing difficulties when using your production network. Is that correct?

Jamf Environment Test - Jet - on github

Apple App Store mobile: Services Test

I have not used the first one to troubleshoot issues, and last time I had to run Services Test was several years ago.

Network Ports Used by Jamf Pro

[GBeau]

This is def a known ongoing issue with Jamf. Opened a ticket with them on Dec 8th and there's still no solution in sight.

[JosephRecendez]

@GBeau Agreed. I too have open a ticket for this. Very reproduceable. I am also hoping for a response. I had to remove my profiles from installing during the PreStage like @RBlount mentioned. The only issue now is that some times, hit or miss when provisioning new devices they will hang after the setup assistant is done for like a hour until they pull their configuration profiles. Blank pushes, inventory update, etc, don't do anything. Since you can not set iPads to update more than once a day this really stinks because you either have to wipe the device or look them up individually to be able to check and re check it they are now able to get the configuration profiles.

I am hoping this gets attention as it is a serious issue.

[cbrewer]

I'm not sure whether or not we're all dealing with the exact same issue, but Jamf did assign an official product issue to my problem. If you're dealing with this issue where you're seeing an iPad stuck at awaiting final configuration after enrollment and you have MDM commands queued up, reference PI-009296 with Jamf support.

[ben_hertenstein]

@jphillips "Looking up the record in Jamf and doing an Update Inventory/Send Blank Push most often helps it along and to complete." This did the trick for me. Only seeing it with the 14.x iPads.

[nbdavis]

We have been having a similar issue. Like @RBlount said, unchecking the Install Configuration Profiles before Setup Assistant checkbox fixed this for us.... though it does make the wipe and reset process a little more involved.

[jphillips]

Unfortunately that doesn’t work for us. We’ve never had the option in prestages on and we still get the Awaiting hang on every 14.x iPad.

Update for those that might still be experiencing this: Unchecking "Set Time Zone" in the prestage seems to have solved this hang. I was trying to enroll a 14.4 iPad all morning, about 4 times, but it kept hanging. Unchecked the the Set Time Zone option and the iPad enrolled immediately.

[nbdavis]

That's very strange. We have never had the "Set Time Zone" option checked..... wonders never cease.

[cleverleys]

So as per @nbdavis @RBlount and @cbrewer this is definitely caused by install profiles before setup assistant - we have now turned this off.
What we see is that the command 'device configured' is stuck in the list of pending tasks which is stopping the handoff from setup assistant. We clear all commands APART FROM device configured, send a blank push which has seemed to be a successful workaround......

[realjaack]

Try unchecking the "Set Time Zone" in pre-stage. They asked us to do that and it seems to have resolved this immediately for us for now. Good luck, all!

[arpierson]

I also have an open ticket for this issue. Ticket was opened on 12/2/2020 and still have no resolution. Right now I'm trying unchecking the option to install config profiles before setup assistant fix, but we've never used the 'Set Time Zone' option.

With 10.5k student iPads in a remote learning environment, it's getting incredibly frustrating that our help desk is too afraid of this issue to have a student reset and re-enroll their iPad to try and resolve issues.

Also, we're on-prem running 10.27.0, so it's not limited to cloud customers.

[arpierson]

I'm not sure whether or not we're all dealing with the exact same issue, but Jamf did assign an official product issue to my problem. If you're dealing with this issue where you're seeing an iPad stuck at awaiting final configuration after enrollment and you have MDM commands queued up, reference PI-009296 with Jamf support.

@cbrewer Did they close your PI? I can't find a reference to PI-009296 on the Known Issues page.

[arpierson]

I tried unchecking Install configuration profiles before Setup Assistant in my prestage and it did successfully get my test device through Setup Assistant and to it's home screen. However, now instead of DeviceConfigured being the command that's getting stuck, the initial Submit Inventory is getting permanently stuck. This means that my test iPad never fell into the multiple smart groups it should have, and therefore failed to receive most of it's config profiles and managed apps. That makes it an untenable workaround for us.

It's worth noting, though, that that test device does successfully receive other management commands. Upon enrollment, it received and executed the commands to install a five apps and four config profiles that are scoped to 'All Devices'. It also successfully received and executed the Renew MDM Profile and Restart Device commands I manually issued. However, it failed to receive Settings - Disable Bluetooth, EnableLostMode, and PlayLostModeSound that I manually issued.

[MichaelScott]

My cloud server was updated to 10.27 about a week ago and we immediately started having this issue. I'm able to get to get past the awaiting final configuration loop and to the home screen by deselecting time-zone (iOS 14 or later) and Install Configuration Profiles before Setup Assistant, but it hangs up there with an Update Inventory as previous posts stated. I've tried a blank push, restart, another wipe but can't get config profiles, apps, or smart groups on the device. Self Service is also not working for iPads, so it's causing quite a few headaches. Anyone else find a resolution?

[realjaack]

It looks like this is resolved for now by going into your PreStages and unchecking the "Set Time Zone" box. Good luck!

[kayc]

We've never had the "Set Time Zone" box checked and are having the issue. Unchecking "Install Configuration Profiles before Setup Assistant" gets a device to the home screen, but configs and apps won't come down reliably.

[realjaack]

..

[kayc]

For those interested, we've been assigned a product issue (PI-009403). We have some apps scoped as autoinstall and some of those same apps scoped to be in self service. If there's any device overlap between the 2, we get this issue. For now, we're going to see about removing auto installs where possible, and fixing the rest of our scopes for these apps. Really hoping that takes care of it. It'd sure be nice if the backend were smarter about licensing and idiot proofing this sort of thing...

[JKoopman]

Bumping this as we began experiencing the same issue early in March after renewing our Certificate Authority. I've tried unchecking "Install configuration profiles before Setup Assistant" in our prestage setting and it lets us finish enrollment, but the iPads stop receiving/processing management commands shortly afterwards and never complete their app deployments.

We've never had Set Time Zone checked.

The only solution we've been able to find is to delete the iPad from Jamf Pro and restore it so it can go through enrollment again. If the device isn't removed from Jamf Pro first, it just gets stuck at "Awaiting final configuration" again and you have to restore it again. This is obviously a huge, time-consuming, pain in the butt.

[prabe]

We too have been seeing this the last couple weeks. Our workaround has been to delete the device from JAMF and then restore the device in iTunes. After doing that process, we plug them into Ethernet to complete the setup. Luckily it's not widespread, but definitely adds to the setup process. Hope that helps some people!

[GeorgeCasper]

I started seeing this yesterday, too. Had a client who checked out 4 iPads. One worked fine, but the other three were repeatedly stuck on the "Final Configuration" step. We didn't have Time Zone set, but we did have "Install Configuration Profiles before Setup Assistant." Turning that off and sending the devices a wipe seems to have resolved it.

Our clients now have to set a passcode during set-up, and then have to set a new passcode a bit later when our passcode policy hits it, which is irritating, but at least it works.

[psav]

When this happens is it stuck installing a WIFI profile? This happens with our iPads too from time to time and it is always when trying to install a WIFI profile. I cancel the install of the WIFI profile and the rest of the install proceeds. I then push the cancelled profile to the iPad.

[SubhiHashwa]

Check your firewall rules. Apple has changed the end points and silently updated the article. Loads of end points are now on Akamai and not on the 17/8 IP range. See https://support.apple.com/en-us/HT210060

You can download service test app, that will check your firewall rules from your network against JAMF and Apple.

[JKoopman]

Going to Jamf Settings > Global Management > Push Certificates > MDM Push Notification Certificate and changing the push protocol from Binary to HTTP/2 as well as toggling off the "Install Configuration Profiles before Setup Assistant" option in our prestage settings seems to have resolved our issue.

[Tolandese]

I was originally seeing this issue back in November 2020 and after trying all of these proposed fixes, I still have 3 iPads that absolutely refuse to move past this error. Of my leftover stockpile of 20 devices I run tests on, 17 always succeed no matter what I throw at them and 3 always fail. Unchecking the install config profile allows them in and then they get hit by the inventory update issue and never process commands. I will reopen my case and mention the above product issue.

I noticed also that when trying to reset the iPad in configurator, the 3 failing devices always stay hung up on the awaiting final configuration step there as well.

[christina_luis]

Im a little confused about this. I am experiencing this with several iPads, however some things that you all are saying make no sense to me. If the iPad is awaiting configuration it is not fully in Jamf yet? How can you send a blank push or update inventory if the iPad is unmanaged? I don't understand, we are experiencing this on more and more devices. If i uncheck the install config files before set up assistant the iPad doesn't even go into Jamf. I have turned in a help ticket with Jamf, but haven't heard anything back.

[kayc]

@christina_luis If you search for the affected devices you'll see that you are able to send commands, and they do receive them. At least that's been our experience. It's more that Jamf hasn't fully configured these devices than them not being in Jamf at that point.

[EXP_SimonF]

We too had this problem happen with a brand new iPhone. I had manually added it to DEP with Apples Configurator, so I figured I had done something wrong. But removing the "Set Time Zone" option in Prestage Enrollment for Mobile Devices in JAMF, did the trick. Just like @jphillips experienced, this was the key to moving on from "Awaiting configuration"...

[Tolandese]

unfortunately the time zone suggestion does not work here as we have never had it checked. I received 3 brand new iPads from apple that all went through the basic setup flawlessly. Now that I am trying to use them with iCloud backups, they are having the exact same issue as all the others.

[LMT]

I had the same problem, however, when I searched for the display name it was gone. So I search for the serial number and found it, however, the display name was reset. Therefore, I changed it back to the display name that I originally gave it and the iOS update was completed and all the apps that I had assigned to this device were reinstalled.

[Tolandese]

I found a solution that worked for my devices, hoping it works for others as well. I first unscoped the iPad from its prestage enrollment. I unassigned the iPad from my Apple School manager instance, then I deleted the iPad from Jamf. After that I did a DFU restore and after it completed, I set it up as a generic non managed iPad. Then I went through and reassigned it in school manager, added it back to the prestage, then reset the iPad and went through the enrollment process. Worked first time every time.

[woaikonglong]

Ouch @Tolandese That is hardly a solution for a lot of devices, but good score if it works for you. After schooling through I had hoped that I would be finding some hope, rather than an issue without a clear solution for half a year. I was able to do a hard restart and that got all but one of my iPad through. I tried just removing it from Jamf and putting it through PreStage, no dice, then DFU didn't even work for me. Just one iPad is preventing me from calling our summer iPad refresh "DONE".

[Tolandese]

Was told this week it is PI-009362 causing the issue and is a planned fix in an upcoming release.