Regular issue deploying apps

[tayre765]

I am periodically having huge issues when trying to deploy apps to iPads in Jamf School.

For example, I have 2 iPads refusing to install any managed apps at all at the moment with the error "The license could not be found. Please check the licenses in the app details page."

The apps have plenty of space licenses and they're assigned to other iPads just fine.

Usually I end up having to wait a week when it suddenly starts working again?

Anyone got any ideas what's causing this?

[ryan_w]

Any chance you might have a filter blocking access to Apple's cloud?  Do the apps show up as greyed out on the iPad or just missing? 

Also, I've had a similar issue on our network where apps won't load if the iPad can't reach the caching server but thinks it should be able to.

[tayre765]

So, the apps don't appear on the iPad at all. They all list in JAMF as "Failed" and don't even try to install.

Filtering can't be the issue, as the devices aren't trying to install anything at that point - JAMF is trying to get licenses?

We do have a firewall/filter in between the devices and the internet, but all the addresses Apple lists on its firewall page are allowed through, and nothing is being logged as being blocked. If it were TLS pinning related, we don't inspect any of the TLS traffic from Apple either.

[Milos]

Do you have enough device licenses? I am not talking about license for the app, I had a problem where apps would not install to any device because there was one device that was managed but not in use.

[tayre765]

Do you mean device licenses in order to manage the iPads in Jamf School? If so, yes we have plenty of spare licenses.

[tayre765]

As an update to this topic - we also get the error "Cannot connect to iTunes Store" randomly too - usually for a few days after adding a new device but sometimes for over a week. This happens in the same place - when Managed Apps are supposed to install. It happens almost immediately in Jamf School when the app is added to the device. It lists as "Pending" then immediately will say Failed and give that message in details. There is no traffic to the devices themselves at this point either.

[ryan_w · Accepted solution]

Interesting, that sounds like a network and/or filtering issue too.  I know you think it can't be filtering or the network, but have you tried to bypass all filtering by using a cellular hotspot or anything like that?  I've seen firewalls / filters cause some strange issues over the years so it is always something I try now when an issue is not obvious.  

[tayre765]

Well... Now that you've suggested that I've given it a go and it is working. So that means Apple must've silently changed something, yet again. Time to go searching for what is different now compared to the last time it all worked perfectly!

[tayre765]

For anyone else using Sophos XG, the solution was that simply adding exceptions for *.apple.com, *.icloud.com, *.mzstatic.com and *.digicert.com in the web filter was not enough. Even though the log shows everything being allowed through, and shows it bypassing the various policies, this still blocks something somehow.

Instead, you need to add a firewall rule to simply allow traffic from your device zone to the internet for those 4 domains, completely bypassing the transparent web proxy entirely.

[mainelysteve]

@tayre765 If you have not yet done so it's probably a good idea to generate and apply a new, fresh VPP token. Just to be clear though other MDM commands are functioning i.e. restart, clear passcode, etc?