I am trying to sign in using my managed work Apple ID on an iPhone through the settings under VPN & Device Management. When I input my email address, I get "Sign-In Failed", "Your Apple ID does not support the expected services on this device. Contact your administrator to sign in".
I am the MDM administrator, but do not know what this means. I am correctly enrolled into ABM, and my domain is approved. What other steps do I need to take in order to allow such a sign in?
When enrolling a device via Settings > General > VPN & Device Management this error happens and is reproducible. When I enroll the device in BYOD by visiting https://mycompany.jamfcloud.com/enroll it all worked fine.
If you also receive this error:
Check n8felton's answer for the related requirements.
Our failure was because our web server was not returning the correct content type for the hosted com.apple.remotemangement file, which needs to return the content-type application/json, so don't overlook that in the docs!
The best way to check this is to use the Developer Tools in a web browser and check the Header Response like this:
For an Apache web server the solution is to configure the correct MIME type in either the httpd.conf file, in an .htaccess file in your public_html folder, or through your admin portal. In our case we are on a shared web server so don't have access to the httpd.conf file and the changes we applied in our cPanel portal also had no effect.
The answer was to add an entry in the .htaccess file.
An Apache .htaccess file would need the following entry:
AddType application/json remotemanagement
However our web server is running LiteSpeed so the entry is different. For a LiteSpeed server, the entry in the .htaccess file needs to be this:
<IfModule mod_mime.c>
<FilesMatch "[^.]+\.remotemanagement$">
Header set Content-Type "application/json"
Header set Content-Encoding "UTF-8"
</FilesMatch>
</IfModule>
Settings > General > VPN & Device Management. When I enroll the device in BYOD by visiting https://mycompany.jamfcloud.com/enrol it all worked fine.
What you are looking for is referred to as account-based user enrollment and it requires some additional configuration on your domain and MDM to work.
I highly recommend watching the Apple Developer session Discover account-driven User Enrollment (wwdc21-10136) The relevant section starts at about the 6:30 mark.
Here are some of the highlights.
You will need to provide a well-known HTTP resource for your domain at the expected discovery URL e.g. https://example.com/.well-known/com.apple.remotemanagement. This resource will need to be available via an HTTP GET request, and the HTTP server must return the resource with a Content-Type: application/json header.
You can verify that your HTTP server is return the resource correctly with a curl command such as
curl -I https://example.com/.well-known/com.apple.remotemanagement
HTTP/2 200
content-type: application/json
The domain name will need to match the domain used with the Managed Apple ID (MAID), e.g. the MAID [email protected] will match the above URL, but [email protected] will not.
This resource will need to return a JSON document formatted like this
{
"Servers": [{
"Version": "mdm-byod",
"BaseURL": "https://mdmserver.example.com/enroll"
}]
}
The BaseURL key specifies the URL of the MDM server's enrollment endpoint. You will need to refer to your specific MDM's documentation for what this URL should be, but here are a few I was able to find as examples.
| MDM | BaseURL Example |
|---|---|
| Jamf Pro | https://myorganiztion.org/servicediscoveryenrollment/v1/userenroll |
| VMware Workspace One UEM | https://ds####.awmdm.com/DeviceManagement/Enrollment/AccountDrivenUserEnroll |
Just to clarify this is the apple business manager beta correct?
I had a similar issue with this and was pulling my hair out on it and even went through a long call with the support team on it.
I know it sounds very silly and I'm still trying to understand how it worked for me but try rebooting the device back up and signing in. I went the extra mile and wiped it through Apple Configurator (No profiles added in my case just decided to use it since I do it for the other devices I manage). But try the reboot first before backing up the device and starting from scratch. I really hope this helps you!
