iOS 11.3 Breaking MDM Connection

[jared_f]

Saw this report this morning. Haven’t updated anything yet, not sure if Meraki is impacted.

http://piunikaweb.com/2018/04/04/ios-11-3-breaks-apples-mdm-mobile-device-management-protocol/

[MikeMandalorian]

Good stuff , thanks for the info ,, I updated my test Ipad to 11.3 and ran a full remote test didn't have any issues with sending commands , so hope fully they release a bug fix before i have to update the fleet 

[vassallon]

I can confirm that Meraki is also having issues with iOS 11.3. It appears to only be affecting iPads that a reset and need to complete the re-enrollment process. Any iPads that are user updated to 11.3 seem to be functioning correctly and accepting commands from Meraki.

[jared_f]

Typical Apple, breaking things. Thanks for testing @vassallon.

[vassallon]

Yeah I found this out on Monday as we received an iPad back from a local police department that had been offline for over a year. I DFU reset the iPad to clear any information and updated to iOS 11.3 and then was unable to get it to update once it enrolled back into Meraki. The iPad would check in but not install any profiles or Apps. A quick look at logs through Apple Configurator 2 and XCode showed multiple failures so I immediately opened tickets with Meraki and Apple and after a day of troubleshooting we were able to identify the issue and determine that Apple had saw the issue affecting other MDMs also. 

[jared_f]

I pushed iOS 11.3 to a test iPad and it installed just fine. Seems to be responding to commands, installing apps from Self Service, checking-in, etc. 

[vassallon]

Yes, that seems to be okay. The issue doesn't seem to crop up until you reset an iPad and it re-enrolls into Meraki, I have been able to recreate this issue multiple times. The last communication I had is that Meraki and Apple were working on a fix to resolve the issue that is causing iPads to stop accepting commands. 

[PatrickL]

We did see this manifest in a few cases where devices were upgraded to iOS 11.3 via MDM. We pushed out a fix for the unhandled 'idle' response which appears to have resolved nearly all affected devices, but we're continuing to investigate potential edge cases.