title: Java iOS MDM Policies
body: <p>I have an mdm server which manages iOS device(s). 
  We have completed all the steps for installing an mdm profile on the device. Also we have applied all policies which are applicable to the device and Configurations like Wi-Fi too.</p>
  
  <p><strong>Question 1:</strong> When we send "allowAppRemoval" as false the device does not apply this policy this raises the non-compliance of the device as this policy is being sent to the device but device does not acknowledge this policy. MDM Reference documentation of Configuration does mention this policy is available.
  It describes it as : Optional. When false, disables removal of apps from iOS device.</p>
  
  <p>But after applying policies say i have sent allowCamera and allowAppRemoval both as false and try to fetch all the policies applied on the device using "Restrictions" command. The restrictions only returns the camera policy and all dependents but does not notify the allowAppRemoval at all. </p>
  
  <p>It there a possibility that iOS does not support this policy? I work on iOS 7.1. 
  There are many posts which does report this issue but none provide any solution or a resonable answer to it.</p>
  
  <p><strong>"Update 1":</strong>
  Below is the restrictions payload content passed to the device with allowAppRemoval to the device as false</p>
  
  <pre><code>&lt;key&gt;PayloadContent&lt;/key&gt;
      &lt;array&gt;
          &lt;dict&gt;
              &lt;key&gt;PayloadDescription&lt;/key&gt;
              &lt;string&gt;MDM Policies&lt;/string&gt;
              &lt;key&gt;PayloadDisplayName&lt;/key&gt;
              &lt;string&gt;Restrictions&lt;/string&gt;
              &lt;key&gt;PayloadIdentifier&lt;/key&gt;
              &lt;string&gt;com.version1.mdm3.configuration.restrictions1&lt;/string&gt;
              &lt;key&gt;PayloadOrganization&lt;/key&gt;
              &lt;string&gt;&lt;/string&gt;
              &lt;key&gt;PayloadType&lt;/key&gt;
              &lt;string&gt;com.apple.applicationaccess&lt;/string&gt;
              &lt;key&gt;PayloadUUID&lt;/key&gt;
              &lt;string&gt;BB35B1B3-9944-4C43-AD36-27176362AB2A&lt;/string&gt;
              &lt;key&gt;PayloadVersion&lt;/key&gt;
              &lt;integer&gt;1&lt;/integer&gt;
              &lt;key&gt;allowAppRemoval&lt;/key&gt;
              &lt;false/&gt;
          &lt;/dict&gt;
      &lt;/array&gt;
  </code></pre>
  
  <p>This payload is installed as a profile. Below is the console logs</p>
  
  <pre><code>Polling MDM server https://mdm-server-url/location for next command.
   mdmd[1120] &lt;Notice&gt;: (Note ) MDM: Transaction completed. Status: 200
   mdmd[1120] &lt;Notice&gt;: (Note ) MDM: Attempting to perform MDM request: InstallProfile
   profiled[1121] &lt;Notice&gt;: (Note ) MC: Checking for MDM installation...
   profiled[1121] &lt;Notice&gt;: (Note ) MC: ...finished checking for MDM installation.
   profiled[1121] &lt;Notice&gt;: (Note ) MC: Beginning profile installation...
   profiled[1121] &lt;Error&gt;: MKBDeviceLockAssertion: MKBDeviceLockAssertion (asserttype:3)
   profiled[1121] &lt;Error&gt;: MKBDeviceGetGracePeriod: MKBDeviceGetGracePeriod() =&gt; (0,0,0)
   profiled[1121] &lt;Error&gt;: MKBDeviceGetGracePeriod: MKBDeviceGetGracePeriod() =&gt; (0,0,0)
   profiled[1121] &lt;Error&gt;: get_longlongvalue_for_key: failed to get GracePeriod
   profiled[1121] &lt;Error&gt;: get_longlongvalue_for_key: failed to get MaxLifetime
   profiled[1121] &lt;Error&gt;: MKBDeviceSetGracePeriod: MKBDeviceSetGracePeriod(-1,5,-1)
   profiled[1121] &lt;Error&gt;: MKBDeviceSetGracePeriod: MKBDeviceSetGracePeriod: from AKS 0
   keybagd[46] &lt;Error&gt;: 0x243000 __update_system_keybag_block_invoke: Updating System Keybag
   keybagd[46] &lt;Error&gt;: 0x243000 KBUpdateSystemKeyBag: Got opaqueStuff from ondisk keybag
   profiled[1121] &lt;Notice&gt;: (Note ) MC: Profile com.version1.mdm3.configuration installed.
   keybagd[46] &lt;Error&gt;: 0x243000 KBUpdateSystemKeyBag: Saved new keybag with result 2371352
   profiled[1121] &lt;Error&gt;: __MKBAssertionFinalize: __MKBAssertionFinalize(0x17d93b50)
   mdmd[1120] &lt;Notice&gt;: (Note ) MDM: Command Status: Acknowledged
  </code></pre>
  
  <p>And when the profile is installed the Restrictions payload on the device displays as: "Don't specify any restrictions"</p>
  
  <p><img src="https://i.stack.imgur.com/L8Woo.png" alt="enter image description here"></p>
  
  <p><strong>Question 2:</strong> Is there a policy which can block Remove of MDM Payload. We have the "<strong>PayloadRemovalDisallowed</strong>" attribute present for each payload which when set true we cannot remove the profile installed on the device. But this is done only once while installation of the profile on the device.
  My scenario is bit different. I want to have a policy which when needed can be made true which will not allow the mdm profile to be removed and when made false mdm profile is applicable to be removed. 
  I have referred all the documentation regarding this too, we can have a supervised device, but this a not the requirement. 
  In simple terms do we have a policy like allowCamera which when made false blocks the camera and vice versa. I dont want to change the mdm payload installed on the device at all. If this requires a client side implementation then we can skip it too.</p>
  
  <p>Hope i made myself clear.
  Thanks.</p>