csh's toolbox
by Chris Schildhorn

I recently learned that playing with ADE enrollments of AVPs on an unsupported (not yet) MDM could lead to a device stuck in ‘waiting for configuration’ screen. Restarting device will end in the same screen even after you unassigned the device in ABM.

There was no obvious way to reset the device running visionOS 2.0. I have ask ACE support and there is a way to reset the device if you do the following.

1. Press both top buttons. A windows will appear: Apple Vision Pro is not configured.
2. Go to Accessibility options -> Eye input -> Switch eye input (you need to reconfigure your eye input settings).

Once you did this, an Apple logo with a progress bar will appear and AVP will be reset to factory settings before starting the new calibration progress.

Hopefully that helps if you are playing around like myself.

Apple released with iOS 17.4 and iOS 17.5 with two minor updates for users in the European Union to comply with the EU’s Digital Markets Act new features. In these releases users located in the EU have the possiblity to install 3rd party App Stores (aka Marketplaces in 17.4) and to download iOS apps directly from websites (aka Web Distribution in 17.5). If you wanna block users to install these on managed, corporate devices you can find here how.

What does this mean?

You can find a very detailed description what was changed in this Apple support document.

New for enterprise admins

In case you want to block one or both new distribution methods of apps you can do this quiet easy with two new device restrictions that are supported on supervised devices.

1. allowMarketplaceAppInstallation - iOS 17.4 includes a new Restriction key to prevent installing third-party app marketplaces on supervised iPhones in the EU.
2. allowWebDistributionAppInstallation - iOS 17.5 includes a new Restriction key allowWebDistributionAppInstallation to prevent installing apps through Web Distribution on supervised iPhones in the EU.

These already known restriction keys were updated to apply as well to the new distribution methods above:

• allowAppInstallation
• allowAppRemoval
• allowListedAppBundleIDs
• blockAppBundleIDs

The unexpected problem

What I mentioned during testing and deployment of the new settings as custom profiles via Microsoft Intune is that you have to be a little careful. This is because you can deploy this settings to all your devices and the profile reporting looks nice and clean. This is not working as you would expect on your devices. If you assign this configurations to iOS devices before 17.4 (allowMarketplaceAppInstallation) or before 17.5 (allowWebDistributionAppInstallation) is installed the report shows a successful deployment but the restriction does not apply (does not show in the management profile locally) and is not re-applied after the OS update is installed.

To overcome this (IMHO implementation flaw in iOS restrictions that is not taken in account by Intune) you can create to assignment filters that look like this.

Warning: You have to maintain them with upcoming iOS releases. I just added a few minor and patch versions in advance that may not be released ever to be prepared.

Go to Intune admin center -> Tenant administration -> Filters and create two new filters for the Platform ‘iOS/iPadOS’. I used in this example rule syntax a combination of the ‘device.enrollmentProfileName’ to target only supervised devices and a ‘device.osVersion’ list of ‘17.4 to 17.6.3’ and ‘17.5 to 17.6.3’ respectively. Edit: You can after the 2408 Intune release use -ge, -gt, -le and -lt operators in preview. This simplifies the filters. I added the simplified filters below

Filter name: iOS 17.4+

((device.enrollmentProfileName -eq "YourEnrollmentProfileName") and
(device.osVersion -in
["17.4","17.4.1","17.4.2","17.4.3","17.5","17.5.1","17.5.2","17.5.3","17.6","17.6.1","17.6.2","17.6.3"])

Filter name: Simplified iOS 17.4+

((device.enrollmentProfileName -eq "YourEnrollmentProfileName") and
(device.osVersion -ge "17.4")

Filter name: iOS 17.5+

((device.enrollmentProfileName -eq "YourEnrollmentProfileName")
and (device.osVersion -in
["17.5","17.5.1","17.5.2","17.5.3","17.6","17.6.1","17.6.2","17.6.3"])

Filter name: Simplified iOS 17.5+

((device.enrollmentProfileName -eq "YourEnrollmentProfileName")and (device.osVersion -ge "17.5")

Now you can simply add this filters to the respective custom profiles and you will not see this unintended behavior.

Edit: Martijn van Loenhout mentioned that allowMarketplaceAppInstallation is now (Service release 2403) already available as Setting Catalog configuration in Intune. You can use this for sure as well if you prefer this.

applefreakz-allowmarketplaceappinstallation-false.mobileconfig:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Restrictions</string>
			<key>PayloadIdentifier</key>
			<string>com.apple.applicationaccess.24BB5BE8-DCB8-4876-9F16-7C6D25CABF78</string>
			<key>PayloadType</key>
			<string>com.apple.applicationaccess</string>
			<key>PayloadUUID</key>
			<string>24BB5BE8-DCB8-4876-9F16-7C6D25CABF78</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>allowMarketplaceAppInstallation</key>
			<false/>
		</dict>
	</array>
	<key>PayloadDescription</key>
	<string>Block third-party app marketplaces</string>
	<key>PayloadDisplayName</key>
	<string>applefreakz_allowMarketplaceAppInstallation-FALSE</string>
	<key>PayloadIdentifier</key>
	<string>de.applefreakz.987A43C8-F8E8-4636-8C82-9FDAD46AB686</string>
	<key>PayloadOrganization</key>
	<string>applefreakz</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>CDC18090-077D-48BF-9621-86ECFAA3C327</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

applefreakz-allowwebdistributionappinstallation-false.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Restrictions</string>
			<key>PayloadIdentifier</key>
			<string>com.apple.applicationaccess.BFB998BC-3E8B-4252-816E-A6795D302D34</string>
			<key>PayloadType</key>
			<string>com.apple.applicationaccess</string>
			<key>PayloadUUID</key>
			<string>BFB998BC-3E8B-4252-816E-A6795D302D34</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>allowWebDistributionAppInstallation</key>
			<false/>
		</dict>
	</array>
	<key>PayloadDescription</key>
	<string>Block app installation through Web Distribution</string>
	<key>PayloadDisplayName</key>
	<string>applefreakz_allowWebDistributionAppInstallation-FALSE</string>
	<key>PayloadIdentifier</key>
	<string>de.applefreakz.8AE1F450-602E-4156-B149-CE1E9CD0F469</string>
	<key>PayloadOrganization</key>
	<string>applefreakz</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>E5A4DE5C-E468-40A9-B4C4-D2D2D063E3DE</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

In the management profile you will see two new restrictions like this: