Anyone else having problems with Apple Device Enrollment?

[DavR]

ADE has been completely broken for us for the last few days, which is annoying as it's this time of year I wipe our shared iPad sets fresh for September.

 

Every device I reset gets to the startup assistant, but then fails when it comes to enrolling into our MDM (Meraki) with either "Unable to Download Profile Configuration" (on iOS16) or "The Configuration is not available" (on legacy devices). This is stuck on a loop, we can go no further. 

 

I did accidentally let our ADE token expire, but fixed this, and still no dice. I've even deleted and recreated the whole ADE service in Meraki and Apple School Manager, but it's made no difference. They're talking to each other fine, but, I'm just always getting this message when I try and put a device through ADE setup. 

 

I've got Meraki support on the case, and they suggest that Apple may be having a problem with ADE for legacy versions of iOS lately, and have asked me to collect logs that I can't collect, due to being a startup loop. Has anyone else had any experience of this lately?

[DavR]

An update, just in case anyone else is having this problem and/or finds themselves here.

 

Apple support have just acknowledged that there is a current known bug with ADE for legacy versions of iOS, in my case I'm seeing it on iOS 12 and iOS16. I guess it's not creating many waves, as most people aren't factory resetting bunches of old(er) devices.

 

New devices (iOS18) continue to go through just fine.

[DDR5]

I'm wondering if this is related to an issue I'm having. 

We bought around 80 iPads years ago direct from Apple and most are still in use(!) but at the time we didn't have DEP setup, so once it was all setup I have, over time, manually enrolled them into DEP/ASM via Apple Configurator. We use Meraki for the MDM and all has been working fine. I usually erase them via Meraki ready for the new year and they take minutes to set back up.

 

We then bought some more iPads last month, again from Apple, and I asked for them to be enrolled into the schools ASM. They said they had to re-activate our account and when I checked a few days later, they were all in ASM, and I all was good. However, I also noticed that some of the original iPads that had been either damaged or taken out of circulation were also showing in ASM as unassigned. So I guessed that whatever Apple had done had bought every device into ASM.

 

Anyhow, the issue I now have is that if I wipe an old iPad, I can no longer get it to install the MDM config. It just says 'Failed to retrieve configuration'
If I release it from ASM and try and enrol manually via Configurator, I get an error too. The only way I can now get these iPads back into Meraki, is to release from ASM, erase and enrol into Meraki without DEP. 

 

Have logged this with Apple but not getting very far. It's as if the records have somehow been screwed over.

[DavR]

27 minutes ago, DDR5 said:

Anyhow, the issue I now have is that if I wipe an old iPad, I can no longer get it to install the MDM config. It just says 'Failed to retrieve configuration'
If I release it from ASM and try and enrol manually via Configurator, I get an error too. The only way I can now get these iPads back into Meraki, is to release from ASM, erase and enrol into Meraki without DEP. 

 

Yup, sounds like exactly the problems we've been having. Doesn't matter which way you do a factory reset, it always comes up with an error trying to enrol into the MDM via device enrolment. We're Meraki too, I wonder if that's also a factor. The only way I've been able to reset devices is by taking them out of device enrolment and setting them up non-DEP.

 

What iOS version are the devices you are trying to reset? See below error messages from two of ours, look familiar?

 

If it would help you with Apple support, DM me, and I'll send you a case ref that links back to the known fault.

 

[DDR5]

The messages you're getting are different - I just get 'Failed to retrieve configuration'

It's not Meraki as I also use Mosyle and get exactly the same issue with that.

 

The iPads I have are iPads Air 2's running iOS 15.8.3

 

Did Apple actually say there was an issue? Knowing Apple, they've probably done this to stop customers using older equipment - it's causing me a huge headache though as, like you, I like to get them wiped ready for September :(

[DavR]

Odd that the messages are different, but, it could be that your message is particular to iOS15, as the messages I got for iOS12 and iOS16 were both different wording.

 

So, I logged a call with Meraki first, who hinted there was a known problem with older versions of iOS, and gave me a call ref I could quote.

 

Then I logged a call with Apple, who came back two days later and confirmed that there was definitely a known issue, and that their MDM team is working on it. No timeframe given. But it is almost certainly a fault at Apple's end.

 

They better not be disowning the older devices - some of our oldest on iOS12 I can understand, but iOS15 and 16 I would be pretty hacked off about! Those devices are still with a reasonable lifespan IMO.

[DDR5]

Managed to get hold of Apple support today. I was on holiday when they tried contacting me, but they left an email saying they've had 'developments' and said they'd explain over the phone. Weird.

 

Anyway, nobody called back so I called them and after having to explain the issue again, they found an article from Jamf highlighting the same issue and that Jamf had heard reports of this issue from other MDM's.

 

Article here: https://community.jamf.com/general-discussions-2/failed-to-retrieve-configuration-on-ipados-v15-8-4-48978

 

So it looks like Apple are indeed aware of it which is why they wanted to speak to me over the phone and not actually put it in an email. 

 

The bulk of the devices I'm having issues with are on iOS 15.8 and she did say that it seemed to be this version and some others, but she couldn't say for sure.

 

To test, I've just been onsite and wiped an iPad that's running iOS 17 and it enrols without issue.

 

Hoping they sort it out soon, but I'll keep chasing.

[DavR]

Thanks for sharing that update @DDR5

 

Good to hear that it's being recognised more widely as an issue, but not very encouraging that Jamf users were talking about this two months back, and it's still not resolved.

 

I've done everything I needed to manually with the devices temporarily unenrolled from DEP, and then put them back in for later. So, I'm just waiting for a call back now from Apple.... at some point.... with any developments.

[synaesthesia]

What a ballache this is, thanks Apple. They do love forced obsolescence

Just hit this - decommissioned nearly 20 older iPad Air's and Air 2s with the plan of putting a fair few of them all round the school in staff areas for SignInApp. Great idea in principal - updates/security not an issue as they'll be entirely locked down with a whitelist filtered backstop just in case, serving single purpose.

Wipe a couple, get them set up.... oh, computer says No, can't retrieve configuration.

Filtering perhaps? Hotspot... computer says No, can't retrieve configuration.

Maybe I have to plug it into a crapbook and Configurator. Crapbook says No, can't retrieve configuration.

Found both this and the jamf discussion (we use Mosyle) and have had to settle on the following process:

Remove device from Mosyle entirely, unassign device management from ASM (but keep it enrolled)

Wipe device, set up entirely manually (groaning all the way as it Mrs Doyles you about EVERY. LITTLE. THING. Ooooh gwan. Gooo onnnn. You sure you don't want one? You sure? Go on... Just a little one. They've got cocaine in...)

Enroll manually into Mosyle.

Repeat a dozen times

 

[DavR]

If it helps @synaesthesia, your suffering has achieved something - I was meaning to go back and test this and see if it's an issue, it obviously is, so you've saved me a job 😂 Not very encouraging about a fix time, though, if this is still a fault four months later.

 

I don't know how well this would fit your processes, but if you've got Apple Configurator, you can setup a blueprint in that to answer all the silly little questions, and save yourself that hassle at least. That's what I did when I had to reset a batch of iPad Air Mk1s over the summer. 

[synaesthesia]

Glad to be of some help!

Unfortunately configurator has never been my strong point - whilst I can get devices prepared and supervised, the whole blueprint thing never stuck. Different issue entirely, likely user-side! It goes through the preparation process, then on restart just sits at the first prompt. It'll happily continue if you manually enter everything and go through the Mrs Doyle prompts, but that's about it

[DavR]

Just in case anyone out there is affected, Apple Device Enrolment service is still borked for legacy iOS versions 16 and below. 

 

I tested it again this morning, because Meraki chased me for an update on a call I had logged from last August(!) and no change.

 

I'm gonna go ahead and assume that Apple have no intention of fixing ADE for legacy iOS versions - unless anyone else has heard differently? I still have a call open with Apple but I don't imagine chasing it will get anywhere.