Unable to enroll macOS 27 beta VMs with mobile device management service
- Dominant language
- Swift
- Stars
- 35.5k
- Forks
- 1.8k
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 7
Description
There's been a persistent issue with running macOS 27 betas in VMs, where I am unable to get management profiles from a mobile device management (MDM) server following enrollment with that MDM server.
Steps to reproduce:
1. Create new macOS 27 VM running 27 beta 1 through beta 5.
2. Enroll the macOS 27 VM with an MDM server.
Expected behavior:
1. MDM enrollment succeeds
2. MDM enrollment profile installs correctly.
3. macOS 27 VM communicates with MDM server.
4. MDM server sends additional management profiles, components, software, etc as required.
Actual behavior:
1. MDM enrollment succeeds
2. MDM enrollment profile installs correctly.
3. macOS 27 VM communicates with MDM server.
4. MDM server sends nothing.
When I've checked in the MDM server side's logging, it appears that the MDM server in question (in my case, Jamf Pro) does not recognize the VM as a device it can manage.
I and other colleagues have feedback open with Apple about this issue:
- FB23007963
- FB24255552
- FB24163685
For FB24163685, Apple has provided the following response:
`The VM must supply Virtualization.framework guest provisioning to receive a device identity and work with APNs (and therefore MDM). It doesn't appear that UTM is doing this. Thank you for your feedback.`
Can the device identity issue please be investigated?
**Configuration**
* UTM Version: 475
* macOS Version: 26.6.1
* Mac Chip: Apple M4
I'm attaching logs I gathered from running the following command: `log show --predicate 'process == "UTM" OR process CONTAINS "qemu" OR subsystem == "com.apple.Virtualization" OR subsystem == "com.apple.vmnet"' --info --debug > UTMlogging.txt`
Contributor guide
Research direction
Start by reproducing the macOS 27 VM enrollment flow described in the issue and inspect the attached UTMlogging.txt output from the provided log command. Trace the UTM, qemu, and Virtualization.framework activity around device identity and guest provisioning. Done means the VM receives a device identity, works with APNs, and accepts additional MDM profiles from the server.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- macos, swift
- Domain
- desktop-dev, operating-systems
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100