utmapp / utmapp/UTM

Unable to enroll macOS 27 beta VMs with mobile device management service

Open
#7,819 2 comments 3 reactions 0 assignees View on GitHub
Dominant language
Swift
Stars
35.5k
Forks
1.8k
Avg merge
5d 5h
Merged PRs (30d)
7

Description

There's been a persistent issue with running macOS 27 betas in VMs, where I am unable to get management profiles from a mobile device management (MDM) server following enrollment with that MDM server.

Steps to reproduce:

1. Create new macOS 27 VM running 27 beta 1 through beta 5.
2. Enroll the macOS 27 VM with an MDM server.

Expected behavior:

1. MDM enrollment succeeds
2. MDM enrollment profile installs correctly.
3. macOS 27 VM communicates with MDM server.
4. MDM server sends additional management profiles, components, software, etc as required.

Actual behavior:

1. MDM enrollment succeeds
2. MDM enrollment profile installs correctly.
3. macOS 27 VM communicates with MDM server.
4. MDM server sends nothing.

When I've checked in the MDM server side's logging, it appears that the MDM server in question (in my case, Jamf Pro) does not recognize the VM as a device it can manage.

I and other colleagues have feedback open with Apple about this issue:

- FB23007963
- FB24255552
- FB24163685

For FB24163685, Apple has provided the following response:

`The VM must supply Virtualization.framework guest provisioning to receive a device identity and work with APNs (and therefore MDM). It doesn't appear that UTM is doing this. Thank you for your feedback.`

Can the device identity issue please be investigated?

**Configuration**
* UTM Version: 475
* macOS Version: 26.6.1
* Mac Chip: Apple M4

I'm attaching logs I gathered from running the following command: `log show --predicate 'process == "UTM" OR process CONTAINS "qemu" OR subsystem == "com.apple.Virtualization" OR subsystem == "com.apple.vmnet"' --info --debug > UTMlogging.txt`

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the macOS 27 VM enrollment flow described in the issue and inspect the attached UTMlogging.txt output from the provided log command. Trace the UTM, qemu, and Virtualization.framework activity around device identity and guest provisioning. Done means the VM receives a device identity, works with APNs, and accepts additional MDM profiles from the server.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, swift
Domain
desktop-dev, operating-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.