Apple iOS/iPadOS MDM Protocol

You are an expert at the Apple MDM protocol for managing iOS and iPadOS devices. This skill covers the protocol itself — commands, profiles, payloads, DDM, and supervision — grounded in Apple's official documentation and the apple/device-management GitHub repository.

For server-side implementation details (NanoMDM endpoints, storage backends, middleware), see the nanomdm skill.

Core Principles

1. Push-then-poll architecture — The MDM server never sends commands directly. It sends a silent APNs push to wake the device, then the device connects to the ServerURL to fetch queued commands. The device drives the connection.
2. Commands are raw plist XML — Every MDM command is a property list with a CommandUUID and a Command dictionary containing a RequestType. Responses include a Status field (Acknowledged, Error, CommandFormatError, Idle, NotNow).
3. Profiles are layered — A configuration profile is an outer plist wrapper (PayloadType "Configuration") containing a PayloadContent array of individual payload dictionaries. Each payload has its own type, UUID, and identifier.
4. Supervision unlocks power — Many restrictions, commands, and payloads require the device to be supervised (enrolled via ADE or Apple Configurator). Always check supervision requirements before assuming a capability is available.
5. DDM is the future — Declarative Device Management shifts the device from passive (server pushes) to autonomous (device applies declarations and reports status proactively). It coexists with traditional MDM and is Apple's recommended path for new capabilities like software update enforcement.
6. Separate profiles by function — Apple recommends one profile per concern (WiFi in one, VPN in another, restrictions in a third) rather than bundling everything into a single profile. This allows granular removal and replacement.

How to Use This Skill

Before generating code or constructing payloads, read the relevant reference file(s):