Description
This article summarizes the MDM process Jamf Now uses to send MDM commands to devices enrolled in Jamf Now.
Jamf Now MDM Process
After a device installs the MDM profile and is managed by Jamf Now, it will use the APNs certificate to communicate with devices.
Jamf Now sends a notification through APNs to the managed device to make a device poll Jamf Now for commands.
When the device receives this request to poll the Jamf Now, it securely contacts the Jamf Now URL using a TLS connection. The device validates the server’s certificate, then uses its identity as the client certificate to authenticate the connection.
The device then sends a request-payload message in a plist-encoded dictionary to Jamf Now using an HTTP PUT request. This message contains either an
Idlestatus or the result of a previous operation.Jamf Now responds to the request-payload message from the device by sending a response-payload message back to the device enclosed in an HTTP reply. This message includes the next command for the device to execute.
The device executes the command and sends one of the following responses:
Acknowledged: The device processed the command successfully.Error: An error occurred.Jamf Now will automatically regenerate the command for the device to retry during the next check-in.KBB0010030Batcave Retry_Later (internal)
CommandFormatError: A protocol error occurred, which can result from a malformed command.Idle: The device is idle; theres no status.NotNow: The device received the command, but couldn't execute it.
Jamf Now will either direct the device to proceed with the next command (based on priority) or terminate the connection once all commands have been executed.
Special Note:
"Not Now" device responses are a result of specific device conditions that prevent a device from executing a command. For example, a device won't execute some commands before the first unlock after a device boot. When this occurs, a device can respond to the server with a NotNow status to indicate that later retries may succeed.
Jamf Now will continue to resend any command for which a device responds "Not Now" in hopes that future subsequent attempts will be successful. As long as the device is actively being used, we should expect settings to apply over time even after initial "Not Now" responses. Sometimes resetting the device and unlocking it post device restart can help in getting the device available.
More Resources
For more information on the Not Now response, please see the Apple Developer documentation.