Dépannage avancé Apple MDM

Dépannage avancé : méthode en couches APNs → ABM → enrollment → profils → compliance → CA → apps.

50 scénarios enterprise couvrant Jamf, Intune, Entra et Apple.

[APNs] Commandes MDM Intune pending > 24h sur iPhone → Devices > Enrollment > Apple > APNs expiration

[ABM/ADE] Mac neuf n'affiche pas Remote Management → ABM serial assigné au serveur MDM correct

[ABM/ADE] Token server_token.p7m expiré alerte J-7 → Intune Enrollment Program Tokens blade

[Profils] Profil Wi-Fi iOS Failed sur 30% flotte → Per-setting error sur device blade

[Compliance] Mac compliant hier, Non compliant aujourd'hui sans changement user → Compliance policy rules + OS update overnight

Logs Jamf : Policy Logs, jamf.log, managedsoftwareupdate.log.

Logs Intune : device timeline, per-setting errors, Company Portal.

Logs macOS : Console unified logging, log show --predicate.

Entra sign-in logs pour CA/MFA/SSO.

Playbook L1/L2/L3 avec escalade et SLAs.

Base de connaissances interne alimentée par les 50 scénarios.

Post-mortem obligatoire incident > 50 appareils.

Méthode dépannage — diagnostic par couche MDM/identité.

```mermaid

flowchart TB L1[L1 Helpdesk] --> Layer{Couche?} Layer -->|Push| APNs[APNs / Token] Layer -->|Enroll| ADE[ABM / ADE] Layer -->|Config| Prof[Profils MDM] Layer -->|Access| CA[Compliance / CA] APNs --> Fix[Fix + KB Update] ADE --> Fix Prof --> Fix CA --> Fix

```

ts-01 [APNs] Commandes MDM Intune pending > 24h sur iPhone — Vérifier : Devices > Enrollment > Apple > APNs expiration. Cause : Certificat APNs expiré ou renouvelé avec mauvais Apple ID. Fix : Renouveler APNs avec le même Apple ID entreprise, upload .pem, force sync appareils.

ts-02 [ABM/ADE] Mac neuf n'affiche pas Remote Management — Vérifier : ABM serial assigné au serveur MDM correct. Cause : Serial non assigné ou mauvais token MDM. Fix : ABM Devices → assign MDM server → sync token Intune/Jamf.

ts-03 [ABM/ADE] Token server_token.p7m expiré alerte J-7 — Vérifier : Intune Enrollment Program Tokens blade. Cause : Renouvellement annuel non planifié. Fix : Download new token ABM → re-import Intune → verify sync.

ts-04 [Profils] Profil Wi-Fi iOS Failed sur 30% flotte — Vérifier : Per-setting error sur device blade. Cause : Certificat 802.1X expiré ou EAP type mismatch. Fix : Renouveler cert SCEP/PKI, redeploy profile pilote puis scope.

ts-05 [Compliance] Mac compliant hier, Non compliant aujourd'hui sans changement user — Vérifier : Compliance policy rules + OS update overnight. Cause : macOS auto-update a dépassé max OS ou FileVault key escrow failed. Fix : Ajuster max OS grace period ou fix FileVault escrow bootstrap token.

ts-06 [Entra/SSO] Platform SSO login échoue après update macOS — Vérifier : Extension Team ID dans profil MDM + macOS version. Cause : Extension identifier changé ou OS incompatible. Fix : Mettre à jour payload Platform SSO avec Team ID Microsoft actuel.

ts-07 [Jamf] Policy Jamf success logs mais package non installé — Vérifier : Policy logs + /var/log/jamf.log sur Mac. Cause : Package cache Distribution Point inaccessible WAN. Fix : Vérifier DP reachability, failover DP régional, retry policy.

ts-08 [Intune] App VPP Required reste Not Installed — Vérifier : VPP token sync + licence assigned ABM. Cause : Licences non assignées au MDM server dans Apps & Books. Fix : ABM Apps & Books → assign licenses to MDM → Intune sync.

ts-09 [Entra/SSO] Conditional Access bloque VIP après FileVault recovery — Vérifier : Sign-in logs + device compliance state. Cause : FileVault off temporairement = non compliant. Fix : Break-glass CA exclusion OU grace period compliance FileVault.

ts-10 [ABM/ADE] ADE profile wrong language Setup Assistant — Vérifier : ADE profile locale settings. Cause : Profil ADE iOS appliqué à Mac (platform mismatch). Fix : Créer profils ADE distincts iOS et macOS.

ts-11 [APNs] Jamf push notifications delayed hours — Vérifier : Jamf Settings > APNs certificate validity. Cause : APNs near expiry or Apple push service degradation. Fix : Renew APNs, verify with test lock command.

ts-12 [Profils] Conflit deux profils restrictions macOS — Vérifier : Device configuration profiles list order. Cause : Payload duplicate keys — last profile wins unpredictably. Fix : Consolider restrictions en un profil ou split payloads.

ts-13 [Jamf] Smart Group membership 0 alors que critères OK — Vérifier : Smart Group criteria AND/OR parentheses. Cause : Critère Extension Attribute script timeout. Fix : Fix EA script, simplify criteria, use static group interim.

ts-14 [Intune] Defender macOS status Unhealthy — Vérifier : Full Disk Access privacy settings. Cause : FDA not granted to Microsoft Defender. Fix : Deploy PPPC + FDA profile, user approve or silent if supervised.

ts-15 [Entra/SSO] Managed Apple ID federation loop redirect — Vérifier : ABM federation Entra DNS TXT + redirect URIs. Cause : Domain not verified or stale federation cert. Fix : Re-run ABM federation wizard, verify Entra enterprise app.

ts-16 [Deployment] 500 Mac rollout — 15% stuck Await Device Configured — Vérifier : Intune/Jamf profiles scoped to ADE group. Cause : Heavy profile set exceeds Setup Assistant timeout. Fix : Split profiles: minimal ADE + post-enrollment policies.

ts-17 [Security] FileVault escrow key missing Intune — Vérifier : Bootstrap token present on Mac. Cause : Admin account without secure token before FileVault enable. Fix : ADE create admin with secure token, redeploy FileVault policy.

ts-18 [Jamf] Patch policy eligible 0 computers — Vérifier : Patch source version + Smart Group scope. Cause : Software title not in Jamf patch catalog. Fix : Add custom patch definition or use policy+package workaround.

ts-19 [Intune] Compliance Unknown all devices — Vérifier : Compliance policy assignments. Cause : No compliance policy assigned to device groups. Fix : Assign policy All Apple Devices dynamic group.

ts-20 [ABM/ADE] Release device from ABM still Activation Lock — Vérifier : Find My + supervision state. Cause : User enabled Find My with personal Apple ID before release. Fix : MDM erase supervised device, then ABM release.

ts-21 [Profils] VPN Always On disconnects sleep/wake — Vérifier : VPN payload OnDemand rules. Cause : OnDemand match domains too narrow. Fix : Adjust OnDemand rules + include captive portal exception.

ts-22 [Entra/SSO] MFA prompt every app launch Platform SSO — Vérifier : CA session lifetime + PSSO registration. Cause : CA requires MFA every sign-in without token persistence. Fix : Tune CA sign-in frequency + confirm PSSO keychain registration.

ts-23 [Jamf] Self Service app missing patch policy — Vérifier : Patch policy Self Service option (not in search). Cause : Jamf 11.16: patch policies excluded from SS search. Fix : Link via category or use policy trigger Self Service.

ts-24 [Intune] Script macOS exit 0 but no effect — Vérifier : Script output Intune device run status. Cause : Script runs as root but targets user context. Fix : Use launchctl asuser or Jamf policy with user context.

ts-25 [Architecture] Multi-region ABM — devices wrong MDM tenant — Vérifier : ABM Location → MDM server mapping. Cause : Single MDM server for all locations without segmentation. Fix : Per-location MDM servers or naming convention + automation.

ts-26 [Security] Gatekeeper blocks signed internal app — Vérifier : Team ID in System Policy Control profile. Cause : App not notarized, Team ID not allowlisted. Fix : Add Team ID to MDM Gatekeeper allow list during migration.

ts-27 [Deployment] iPhone user enrollment vs ADE conflict — Vérifier : Enrollment type on device record. Cause : User enrolled BYOD then org tries ADE same device. Fix : Wipe + ADE re-enroll or migrate to account-driven enrollment.

ts-28 [Jamf] API automation 401 after midnight — Vérifier : OAuth token expiry cron. Cause : Token refresh job failed silently. Fix : Implement token refresh with alerting, store in vault.

ts-29 [Intune] Global deployment EU devices slow profile — Vérifier : Intune service region + Apple CDN. Cause : Profiles large payloads without staged rollout. Fix : Regional pilot groups, settings catalog split profiles.

ts-30 [Entra/SSO] Hybrid user cannot Platform SSO Mac — Vérifier : Entra hybrid join vs pure cloud UPN. Cause : UPN mismatch between local and Entra. Fix : Fix UPN sync AD Connect, verify nameID PSSO payload.

ts-31 [APNs] New APNs cert — all devices show offline briefly — Vérifier : Expected during cert swap if same topic. Cause : Normal push topic rebind — devices reconnect on check-in. Fix : Monitor 4h, no action unless offline > 24h.

ts-32 [Profils] MDM profile cannot be removed — user complaint — Vérifier : Supervised + locked enrollment. Cause : By design for corporate owned ADE devices. Fix : Explain policy; offboard via wipe + ABM release workflow.

ts-33 [Jamf] Computer inventory stale 7 days — Vérifier : Last check-in + APNs + network filter. Cause : Corporate proxy blocking Jamf URLs. Fix : Allowlist Jamf cloud URLs on proxy, verify cert inspection.

ts-34 [Intune] Company Portal macOS shows enrollment failed — Vérifier : Entra user license Intune + device limit. Cause : User hit device enrollment quota. Fix : Retire old devices or raise per-user device limit.

ts-35 [Security] MDA attestation failed iOS 17 — Vérifier : Supervised + OS min for attestation. Cause : Device not supervised or OS below minimum. Fix : Require ADE supervision, update compliance rule.

ts-36 [Deployment] Migration Jamf→Intune duplicate profiles — Vérifier : Both MDM profiles installed. Cause : Incomplete Jamf unenroll before Intune ADE. Fix : Wipe/re-ADE or remove Jamf profile via transition runbook.

ts-37 [Entra/SSO] Report-only CA shows block but user accesses — Vérifier : CA policy state Report-only vs On. Cause : Policy not enforced yet — expected. Fix : Review logs, fix gaps, switch to Enabled pilot.

ts-38 [Jamf] Script policy duplicate executions — Vérifier : Trigger Recurring Check-in + frequency. Cause : Frequency set Once per computer but trigger too broad. Fix : Add offset, use log file gate, or Once per computer ever.

ts-39 [Intune] macOS update deferral ignored — Vérifier : Declarative vs legacy update profile. Cause : User initiated update outside MDM deferral window. Fix : Use DDM software update declarations + compliance min OS.

ts-40 [ABM/ADE] ASM vs ABM token confusion education — Vérifier : Which Apple portal owns devices. Cause : School uses ASM token in enterprise ABM tenant. Fix : Separate tokens per program, label clearly in Intune.

ts-41 [Architecture] Dual MDM Jamf+Intune same Mac — Vérifier : Business decision co-management vs migration. Cause : Architectural overlap without clear ownership. Fix : Define single MDM owner per platform, use integrations not dual enroll.

ts-42 [Security] SIP status Non compliant Jamf Protect — Vérifier : Recovery OS boot recent?. Cause : SIP disabled in Recovery for debugging never re-enabled. Fix : Re-enable SIP csrutil, compliance will recover.

ts-43 [Deployment] Platform SSO project — 20% Mac Intel excluded — Vérifier : PSSO requires macOS 14+ Apple Silicon recommended. Cause : Hardware/OS prerequisites not in scope matrix. Fix : Legacy Mac: Entra login + Company Portal fallback.

ts-44 [Jamf] Package postinstall fails exit 1 silent — Vérifier : Install log /var/log/install.log. Cause : Postinstall script assumes path absent on Apple Silicon. Fix : Fix script universal paths, test package Intel+ARM.

ts-45 [Intune] Conditional Access works iOS not macOS — Vérifier : Compliance policy platform specific. Cause : macOS compliance policy missing or not assigned. Fix : Create parallel macOS compliance, link same CA.

ts-46 [Entra/SSO] Passwordless Mac login fails offline — Vérifier : Offline grace PSSO documentation. Cause : No cached credential — by design after TTL. Fix : Document offline policy, local admin break-glass.

ts-47 [ABM/ADE] Inventaire serial mismatch CMDB vs MDM — Vérifier : ABM source of truth export. Cause : Manual CMDB entries not synced from ABM. Fix : Automate ABM→CMDB API feed nightly.

ts-48 [Jamf] Webhook Jamf → SIEM missing events — Vérifier : Webhook auth header + retry logs. Cause : SIEM endpoint rate limit 429. Fix : Batch events, exponential backoff, queue Jamf side.

ts-49 [Intune] Security baseline macOS conflicts custom profile — Vérifier : Settings catalog conflict report. Cause : Duplicate firewall keys two profiles. Fix : Merge into single baseline-aligned profile.

ts-50 [Architecture] Architect review — no runbook cert renewal — Vérifier : ABM/APNs/VPP token calendar. Cause : Operational gap — single owner left company. Fix : Shared calendar, dual custodians, automated alerts 30/7/1 days.