<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN""http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
     <dict>
          <key>CommandUUID</key>
          <string>4424F929-BDD2-4D44-B518-393C0DABD56A</string>
          <key>Command</key>
               <dict>
                    <key>RequestType</key>
                    <string>InstallApplication</string>
                    <key>iTunesStoreID</key>
                    <integer>464656389</integer>
                    <key>ManagementFlags</key>
                    <integer>4</integer>
               </dict>
     </dict>
</plist>

Here is example of RemoveApplication

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN""http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
     <dict>
          <key>CommandUUID</key>
          <string>4424F929-BDD2-4D44-B518-393C0DABD56A</string>
          <key>Command</key>
               <dict>
                    <key>RequestType</key>
                    <string>RemoveApplication</string>
                    <key>Identifier</key>
                    <string>com.test.test</string>
               </dict>
     </dict>
</plist>

There is no functionality to whitelist and blacklist apps. However, you can query device for list of application and if you see some blacklisted application you can do some actions.

說明：上面的範例是如何去下載 Apple App Store 上的 App.

相關文章：

[iOS] get MDM settings from system dictionary in swift
https://stackoverflow.max-everyday.com/2018/01/ios-get-mdm-settings-from-system-dictionary-in-swift/

MDM推送設定值到 iOS device
https://stackoverflow.max-everyday.com/2017/09/mdm-settings-ios-device/

MDM推送App到 iOS device
https://stackoverflow.max-everyday.com/2017/09/mdm-install-app/

Sample iOS 行動裝置管理伺服器(MDM server)
https://stackoverflow.max-everyday.com/2017/09/ios-mdm-server/

Develop an app that supports Managed AppConfig on iOS

Fetch managed AppConfig using the following code:

func fetchAppConfiguration() {
     if let managedConfigDict = UserDefaults.standard.dictionary(forKey: "com.apple.configuration.managed"){
          if let keyValue = managedConfigDict["keyName"]{
               print("KEY : keyname \nVALUE : \(keyValue) ")
          }
     }else{
          print("Error fetching app config values. Please make sure your device is enrolled with AirWatch ")
     }
}

Register your app to listen for managed AppConfig changes:

Developers can register their app to listen for userdefault changes. This action allows the app to dynamically pick up the latest managed AppConfig sent by AirWatch.

func registerForAppConfigNotification() {
     NotificationCenter.default.addObserver(self, selector: #selector(ViewController.fetchAppConfiguration), 
          name: UserDefaults.didChangeNotification, object: nil)
}

詳全文：

https://support.air-watch.com/articles/115006426588-AirWatch-Managed-AppConfig-Sample-iOS

相關文章：

Configure Managed Settings for iOS Devices
https://my.air-watch.com/help/9.2/en/Content/Platform_Guides/iOS/T/ManagingiOSManagedSttngs.htm

自攜電子設備（BYOD, Bring Your Own Device）亦稱自攜技術（BYOT, Bring Your Own Technology）、自攜電話（BYOP, Bring Your Own Phone）或自攜電腦（BYOPC, Bring Your Own PC）是一種允許員工使用個人行動裝置進入他們工作區域並用以處理公司資訊與應用程式的作業方式^[1]。學生帶著他們自己的裝置上課的運作方式也是相同道理^[2]。

With an expanding fleet of mobile devices, businesses need a platform that enables high levels of oversight and solid data protection. An MDM (Mobile Device Management) system is now vital.

市場上的產品有：

1. VMware AirWatch

https://www.air-watch.com/solutions/mobile-device-management/

Add new devices quickly and easily provision with apps and policies without IT involvement.

• Configure devices during initial power on with bulk provisioning programs such as the Apple Device Enrollment Program (DEP) and Windows Out-of-Box Enrollment (OOBE)

• Deploy public, internal or bulk-purchased apps to devices automatically or to an enterprise app catalog for on-demand install

• Enable users to self-activate devices by entering their corporate credentials in a simple MDM onboarding workflow

• Connect to enterprise email, VPN, Wi-Fi, content, intranet sites and other backend resources

• Configure MDM policies for device restrictions, layout, settings access, notifications and more and assign based on OS or ownership type (BYO or corporate-owned)

2. BlackBerry UEM

https://uk.blackberry.com/enterprise/unified-endpoint-management

除了黑莓機之外，好像也支援其他平台。

Smartphones
iOS
Provide comprehensive secure productivity and enterprise mobility management for iOS, including day one support for the latest iOS releases, with the BlackBerry Enterprise Mobility Suite. Use a layered security model and ease support for the wide range of iOS platforms through mobile MDM, MAM and MCM. With iOS support that spans the entire suite of BlackBerry applications, a wide range of leading third party ISV applications and heightened security for native iOS applications you can empower employees with mobile productivity. You’ll also be able to support Microsoft Exchange on-premise and cloud-based environments with Exchange Online through Office® 365.

Android
Provide comprehensive secure productivity and enterprise mobility management for Android with the BlackBerry Enterprise Mobility Suite. Use a layered security model and ease support for the wide range of Android platforms through mobile device management (MDM), mobile application management (MAM) and mobile content management (MCM).

With Android support that spans the entire suite of BlackBerry applications, a wide range of leading third party ISV applications and comprehensive support for Samsung KNOX Workspace and Android for enterprise you can empower employees with mobile productivity. You’ll also be able to support Microsoft Exchange on-premise and cloud-based environments with Exchange Online through Office 365.

Windows Phone
Provide comprehensive secure productivity and enterprise mobility management for Windows Phone. With the BlackBerry Enterprise Mobility Suite, operations teams can set both MDM and app-specific policies on Windows Phone devices, while users can utilize business-grade secure email and other apps built on the BlackBerry Dynamics Platform.

BlackBerry
Utilize the gold standard for managing BlackBerry® 10 devices. BlackBerry® UEM, a key component of the BlackBerry Enterprise Mobility Suite, manages a wide array of devices and policies from a unified console. BlackBerry devices can be managed from the same solution used for iOS, Android, Windows, macOS and more.

3. IBM MaaS360

https://www.ibm.com/tw-zh/marketplace/unified-endpoint-management

統一端點管理 (UEM) 保證讓 IT 能夠透過單一管理主控台，綜合管理智慧型手機、平板電腦、筆記型電腦及物聯網裝置。不過，您需要地球上最智慧的端點保護平台，來提高作業效率、提供最大的資料安全，與實現您的數位轉換目標。IBM MaaS360 with Watson 提供認知洞察、脈絡分析、雲端評比功能，以便弄清楚您每天遇到的行動詳情，同時透過單一平台保護您的端點、使用者、應用程式、文件及其中資料。

4. MobileIron

https://www.mobileiron.com/cn/products

MobileIron’s mobile device management (MDM) capabilities give you the fundamental visibility and IT controls needed to secure, manage, and monitor any corporate­ or employee­owned mobile device or desktop that accesses business critical data.

MobileIron 企業移動 IT 解決方案，幫助企業管理智能移動終端、移動文檔、移動應用、及移動網頁門戶的全面安全。目前全球有5000多家企業客戶都選擇MobileIron 的移動優先解決方案作為其移動戰略的基礎架構。 MobileIron 幫助企業IT 部門構建了移動化的管理壁壘，既保護了企業員工的智能手機和平板電腦的使用安全，同時保持移動操作系統本身移動化的優秀用戶體驗，更重要的我們為企業最重要的業務數據和移動應用知識產權提供了全面的管理和安全加固。

無論您正在尋找員工自備設備在企業環境辦公的BYOD 解決方案，還是準備將企業現有的網絡架構重組成移動優先的全面移動化IT 解決方案，我們可為您提供不同組合的移動終端高級管理服務，涵蓋智能移動終端、移動文檔、移動應用、及移動網頁門戶的全面管理及安全服務。

MobileIron 企業移動 IT 解決方案，既可本地部署在您企業的內部網絡，也可作為雲服務部署在運營商側的雲平台。

5. Citrix XenMobile

https://www.citrix.com/products/xenmobile/

Deploy Citrix XenMobile in as little as two hours and get full access to mobile device management (MDM), mobile application management (MAM), mobile content management (MCM), secure network gateway, and enterprise-grade mobile productivity apps in one comprehensive enterprise mobility management solution. XenMobile enhances the user experience on BYO or corporate devices, without compromising security. Let Citrix and our partners help you manage your XenMobile environment.

Citrix 的比較表：

Side-by-side MDM vendor review
XenMobile vs. AirWatch, MobileIron, Good, and MaaS360

Factors such as new devices, more apps, and evolving use cases can make evaluating vendors and selecting a product to meet your MDM, MAM, and data management needs a challenging task. Only XenMobile provides a comprehensive enterprise mobility management solution that offers a complete set of mobile productivity apps to enhance the user experience without compromising security. To learn more about how XenMobile outperforms AirWatch, MobileIron, Good, and other MDM vendors, review this side-by-side feature comparison.

6. SAP Afaria

https://www.sap.com/uk/products/secure-mobile-device-management-cloud.html

Move beyond mobile device management (MDM) with SAP Mobile Secure – EMM in the cloud
Protect and manage your company’s mobile devices and apps – with SAP Mobile Secure. This cloud-based EMM portfolio offers integrated tools for mobile device management (MDM), bring your own device (BYOD) security, mobile application management (MAM), and more. Manage mobile device security from one SaaS platform – and even set up your own enterprise app store.

• Videos: Get started with SAP Mobile Secure

7. Mobile Device Manager Plus

https://www.manageengine.com/mobile-device-management/

Empower your workforce with the power of mobility
ManageEngine Mobile Device Manager Plus is an enterprise mobile device management solution that is designed to enhance employee productivity without compromising on corporate security.

360° support for enterprise mobility

• Quickly bring devices under management
  Easy enrollment and authentication for BYOD and corporate devices.
• Intuitive dashboard with an easy to use interface
  Management has never been simpler with an overview of the entire device ecosystem in your organization.
• Ensure devices are compliant with policies
  Configures profiles to enact policies for Wi-Fi, VPN and other parameters.
• Troubleshoot devices in real time
  Remotely control and view mobile devices and troubleshoot issues on them.

8. Microsoft Intune

https://www.microsoft.com/en-gb/cloud-platform/microsoft-intune

Enable secure mobile productivity
Define a mobile management strategy that fits the needs of your organisation. Apply flexible mobile device and app management controls that let employees work with the devices and apps they choose while protecting your company information.

9. SOTI MobiControl

https://www.soti.net/products/mobicontrol/

SOTI MobiControl is an enterprise mobility management solution that secures and manages Apple® iOS, Google Android, and Microsoft Windows® devices, throughout their entire lifecycle, from deployment to retirement. It controls all aspects of business mobility — tracking physical assets, managing applications and content, as well as keeping devices and data safe and secure. SOTI is the proven leader for managing rugged, special-purpose devices used in key industries, such as: healthcare, transportation, logistics, retail and field services. It removes the complexity from managing a multi-OS, multi-vendor and multi-purpose business mobility program.

10. SimplySecure

http://www.beachheadsolutions.com/

Simplify Securely manage all BYOD and company-owned devices
You’ve got to secure and manage a wide range of company and employee owned laptops, phones and tablets. Good news; it’s an easy problem to solve! Our SimplySecure service lets you centrally manage all of them – even Windows PCs and Macs – from a single web-interface. Requiring no added hardware or software, it’s user-transparent, and easy to deploy and manage.

11. Samsung KNOX

http://www.samsung.com/tw/business/mobile-solutions/knox-solutions/

Samsung KNOX 是一個內建於行動裝置內的受保護的虛擬空間， 具有專屬的主畫面、啟動程式、應用程式和Widget，可將私人文件、相片、行程、聯絡人、電子帳號、網瀏覽紀錄等存放於安全的KNOX 空間內。在使用Android 常用環境的同時，且擁有受保護空間的存取權。

1. 要被派送settings 的 App Identifier 要存在。
2. 被派送 settings 的 app 必需是被管控制。
   （透過 InstallApplication command 去安裝)

出錯之後，MDM 告訴我們的Error Message:

 <key>Settings</key>
 <array>
 <dict>
 <key>ErrorChain</key>
 <array>
 <dict>
 <key>ErrorCode</key>
 <integer>12038</integer>
 <key>ErrorDomain</key>
 <string>MCMDMErrorDomain</string>
 <key>LocalizedDescription</key>
 <string>App「app id」不受管理。</string>
 <key>USEnglishDescription</key>
 <string>The app “app id” is not managed.</string>
 </dict>
 </array>

Managed app configuration changes that are pushed down from an MDM server appear in NSUSerDefaults so you can add an observer to be alerted of any changes to NSUserDefaults. The Managed app configuration dictionary pushed down from the MDM server is stored in the key named: com.apple.configuration.managed

Your application can also send a dictionary containing the feedback to the MDM server. The dictionary that is sent back to the MDM server as feedback must be stored in this key com.apple.feedback.managed

In order to test all of this you would need a device that is managed by an MDM server and the application must be installed by the MDM server that supports ApplicationConfiguration setting and ManagedApplicationFeedback commands.

The sample application’s readme.txt file recommends seeing the WWDC 2013 Session 301 “Extending Your Apps for Enterprise and Education Use” for a demo of this application.

to read the config (swift 3):

if let managedConf = UserDefaults.standard.object(forKey: "com.apple.configuration.managed") as? [String:Any?] {
    if let serverURL = managedConf["serverURL"] as? String{
        return serverURL
    }
}
if let serverURL = Bundle.main.object(forInfoDictionaryKey: "serverURL") as? String {
    return serverURL
}
return  "https://apple.com/"

as you can see – the app needs to manually enable reading from MDM bundle configuration.

P,S: only managed apps can get those configs.

資料來源：

Using MDM To Configure An Enterprise App Via NSUserDefaults
https://stackoverflow.com/questions/20752254/using-mdm-to-configure-an-enterprise-app-via-nsuserdefaults

範例：

https://github.com/robovm/apple-ios-samples/blob/master/ManagedAppConfig/ManagedAppConfig/APLViewController.m

// The Managed app configuration dictionary pushed down from an MDM server are stored in this key.
static NSString * const kConfigurationKey = @"com.apple.configuration.managed";

// This sample application allows for a server url and cloud document switch to be configured via MDM
// Application developers should document feedback dictionary keys, including data types and valid value ranges.
static NSString * const kConfigurationServerURLKey = @"serverURL";
static NSString * const kConfigurationDisableCloudDocumentSyncKey = @"disableCloudDocumentSync";

// The dictionary that is sent back to the MDM server as feedback must be stored in this key.
static NSString * const kFeedbackKey = @"com.apple.feedback.managed";

// This sample application tracks a success and failure count for the loading of a UIWebView.
// Application developers should document feedback dictionary keys including data types to expect for feedback queries
static NSString * const kFeedbackSuccessCountKey = @"successCount";
static NSString * const kFeedbackFailureCountKey = @"failureCount";

- (void)readDefaultsValues {
    
    NSDictionary *serverConfig = [[NSUserDefaults standardUserDefaults] dictionaryForKey:kConfigurationKey];
    NSString *serverURLString = serverConfig[kConfigurationServerURLKey];
    
    // Data coming from MDM server should be validated before use.
    // If validation fails, be sure to set a sensible default value as a fallback, even if it is nil.
    if (serverURLString && [serverURLString isKindOfClass:[NSString class]]) {
        self.serverURLUILabel.text = serverURLString;
    } else {
        self.serverURLUILabel.text = @"http://foo.bar";
    }
    
    NSNumber *disableCloudDocumentSync = serverConfig[kConfigurationDisableCloudDocumentSyncKey];

    if (disableCloudDocumentSync && [disableCloudDocumentSync isKindOfClass:[NSNumber class]]) {
        self.cloudDocumentSyncEnabledSwitch.on = ![disableCloudDocumentSync boolValue];
    } else {
        self.cloudDocumentSyncEnabledSwitch.on = YES;
    }
    
    // Fetch the success and failure count values from NSUserDefaults to display.
    // Data validation for feedback values is a good idea, in case the application wrote out an unexpected value.
    NSDictionary *feedback = [[NSUserDefaults standardUserDefaults] dictionaryForKey:kFeedbackKey];
    
    NSNumber *successCount = feedback[kFeedbackSuccessCountKey];
    if (successCount && [successCount isKindOfClass:[NSNumber class]]) {
        self.successCount = [successCount unsignedIntegerValue];
    } else {
        self.successCount = 0;
    }
    
    self.successUILabel.text = [NSString stringWithFormat:@"%lu", (unsigned long)self.successCount];
    
    NSNumber *failureCount = feedback[kFeedbackFailureCountKey];
    if (failureCount && [failureCount isKindOfClass:[NSNumber class]]) {
        self.failureCount = [failureCount unsignedIntegerValue];
    } else {
        self.failureCount = 0;
    }
    
    self.failureUILabel.text = [NSString stringWithFormat:@"%lu", (unsigned long)self.failureCount];
}

相關文章：

Sample iOS 行動裝置管理伺服器(MDM server)
https://stackoverflow.max-everyday.com/2017/09/ios-mdm-server/

[iOS] install / uninstall app on device through MDM server?
https://stackoverflow.max-everyday.com/wp-admin/post-new.php

解法：

請先在 queue 裡放入 “InstallCustomApp” command , 再放入 “ApplicationConfiguration” 即可。

iOS device 回傳的 Error:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CommandUUID</key>
	<string>62f7a5be-a37c-4cd4-b58b-000a4e4496b4</string>
	<key>Settings</key>
	<array>
		<dict>
			<key>ErrorChain</key>
			<array>
				<dict>
					<key>ErrorCode</key>
					<integer>12038</integer>
					<key>ErrorDomain</key>
					<string>MCMDMErrorDomain</string>
					<key>LocalizedDescription</key>
					<string>App「your.app.id.here」不受管理。</string>
					<key>USEnglishDescription</key>
					<string>The app “your.app.id.here” is not managed.</string>
				</dict>
			</array>
			<key>Identifier</key>
			<string>tw.thinkingsoftware.geofence</string>
			<key>Item</key>
			<string>ApplicationConfiguration</string>
			<key>Status</key>
			<string>Error</string>
		</dict>
	</array>
	<key>Status</key>
	<string>Acknowledged</string>
	<key>UDID</key>
	<string>38c2840ff0be3ccff43299d2e06320485facb2f5</string>
</dict>
</plist>

相關文章：

[iOS] get MDM settings from system dictionary in swift
https://stackoverflow.max-everyday.com/2018/01/ios-get-mdm-settings-from-system-dictionary-in-swift/

MDM推送設定值到 iOS device
https://stackoverflow.max-everyday.com/2017/09/mdm-settings-ios-device/

MDM推送App到 iOS device
https://stackoverflow.max-everyday.com/2017/09/mdm-install-app/

Sample iOS 行動裝置管理伺服器(MDM server)
https://stackoverflow.max-everyday.com/2017/09/ios-mdm-server/

首先，建立一個Enroll.mobileconfig 放在網路上給 iOS 的瀏覽器去下載。

等 iOS device 下載完 Enroll.mobileconfig 之後，iOS device 去自動去觸發 <key>CheckInURL</key> 裡的URL, EX: https://mdmserver/checkin，去註冊 device 時所帶的 plist 如下。

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>BuildVersion</key>
	<string>14G60</string>
	<key>IMEI</key>
	<string>99 000289 244779 6</string>
	<key>MEID</key>
	<string>99000289244779</string>
	<key>MessageType</key>
	<string>Authenticate</string>
	<key>OSVersion</key>
	<string>10.3.3</string>
	<key>ProductName</key>
	<string>iPad3,6</string>
	<key>SerialNumber</key>
	<string>DMPK3ML3F190</string>
	<key>Topic</key>
	<string>com.apple.mgmt.External.033dca28-442a-4bcc-9519-ad1165d859c9</string>
	<key>UDID</key>
	<string>38c2840ff0be3ccff43299d2e06320485facb2f5</string>
</dict>
</plist>

第1 次 mdm server 收到 MessageType=Authenticate 時就回給iOS device： http status=200 (ok) 回去就結束。 iOS device 發現被摸摸頭很高興，於是就跟 mdm server 講更多關於自己的事情  MessageType=TokenUpdate。

EX: https://mdmserver/checkin

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>AwaitingConfiguration</key>
	<false/>
	<key>MessageType</key>
	<string>TokenUpdate</string>
	<key>PushMagic</key>
	<string>2E772CFE-FA44-4C6F-B8D6-D56BE793A2AC</string>
	<key>Token</key>
	<data>
	UpTQP5+39KrJHjHRQCW3hAVJ5gEdjbJTpyRlLjTLiI0=
	</data>
	<key>Topic</key>
	<string>com.apple.mgmt.External.033dca28-442a-4bcc-9519-ad1165d859c9</string>
	<key>UDID</key>
	<string>38c2840ff0be3ccff43299d2e06320485facb2f5</string>
	<key>UnlockToken</key>
	<data>
	REFUQQAABORWRVJTAAAABAAAAARUWVBFAAAABAAAAAJVVUlEAAAAENxVQi0uxUK9vpMA
	h6TbX2pITUNLAAAAKJicev+1Kg/INk9Mi0yskAmSozj+s5s1pH4d7zE6lLFMwvj33Vj5
	jnZXUkFQAAAABAAAAAFTQUxUAAAAFLAB9iKjjIO6cOWmSnJtCTQDZJytSVRFUgAAAAQA
	AMNQVVVJRAAAABBJYHPy2zxAd72Y8XQFxU8OQ0xBUwAAAAQAAAALV1JBUAAAAAQAAAAB
	S1RZUAAAAAQAAAAAV1BLWQAAACCio4CsOqbuG+ZfIL769K649iwg+JScRITAjsSSbwf8
	C1VVSUQAAAAQTbNMLHZjS5CAJYSXn2SCUkNMQVMAAAAEAAAACldSQVAAAAAEAAAAA0tU
	WVAAAAAEAAAAAFdQS1kAAAAoCEq3sJ3fAaclGAz9PpeI3UXWhXaMkXB6nT1lTxLbpY+b
	wr02rXzcflVVSUQAAAAQwOczETaITtCYGKQoKeyDHkNMQVMAAAAEAAAACVdSQVAAAAAE
	AAAAA0tUWVAAAAAEAAAAAFdQS1kAAAAo8uZIgpAbJkDdLBBHkC0mKE1Znbx5ctVPbrxs
	pAysmokwWfWoCjybQ1VVSUQAAAAQh+2ChuT/SZKApwl6SN95V0NMQVMAAAAEAAAACFdS
	QVAAAAAEAAAAAUtUWVAAAAAEAAAAAFdQS1kAAAAg8OQJAVZOhFgU4ZNfdVyyiLK2M8Om
	pe1QpqKgY3zUUtZVVUlEAAAAEJuQO9TE4kKGvfitqaBZ7GZDTEFTAAAABAAAAAdXUkFQ
	AAAABAAAAANLVFlQAAAABAAAAABXUEtZAAAAKGSwa/xg0dfVVVsLBFwCYM+mxXCJBPaI
	WkfKLrBIAnLyQXQDSjgiIgpVVUlEAAAAEGd61qmxfE++u0hFhPPUjj9DTEFTAAAABAAA
	AAZXUkFQAAAABAAAAANLVFlQAAAABAAAAABXUEtZAAAAKDc/4WTslCM06c3+axbyhGhp
	ZmlGfbs/4w0D3QGP4TkBjm6mDFKpJIRVVUlEAAAAEOToSX+0SUGXvre4eTxV3dtDTEFT
	AAAABAAAAAVXUkFQAAAABAAAAANLVFlQAAAABAAAAABXUEtZAAAAKKVGbjWyMStmuzIt
	zblc9tUY/ZZXccuggmBrhQVnJmPGQYUlvXy2sIhVVUlEAAAAEOXSlmKeX0nQrTi5Bt5r
	/2xDTEFTAAAABAAAAANXUkFQAAAABAAAAANLVFlQAAAABAAAAABXUEtZAAAAKHBXGOT/
	KqH44qwoUfw8liLoyJWmjMl1+xMx6uiIABfeeFl2RdEllClVVUlEAAAAEHNbUmvOukxn
	nfKr2d/7fZNDTEFTAAAABAAAAAJXUkFQAAAABAAAAANLVFlQAAAABAAAAAFXUEtZAAAA
	KHK9aMigbkbkEhrf9LFEp0S+lMCgkCecD4ZoW0PB2L7Kc08/UwAx9SxQQktZAAAAIO/9
	UaCArpoJGpPfhqPQepJ3ZCz/Z5KNf3B41oGymXFtVVVJRAAAABDo7qHpgTZKU4LuYz6C
	jQ9/Q0xBUwAAAAQAAAABV1JBUAAAAAQAAAADS1RZUAAAAAQAAAAAV1BLWQAAACgWozY+
	m21bLAXBz6haguaEWVmDv/n6g7MKRv0tt5MbctAeg9TeoWKVU0lHTgAAABSagQ4vwR/D
	NA2+pMD/8D61Ec6mSQ==
	</data>
</dict>
</plist>

當 iOS device 做完 token update 之後，會存取 EX: https://mdmserver/server , 傳的訊息內容：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Status</key>
	<string>Idle</string>
	<key>UDID</key>
	<string>38c2840ff0be3ccff43299d2e06320485facb2f5</string>
</dict>
</plist>

比照之前被摸頭的流程，所以 mdm server 回傳 200 (ok) 之後，iOS device 會再呼叫一次 /server 並告訴 mdm server 自己更多的身世。

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CommandUUID</key>
	<string>9cf1dd6f-077d-4171-bda3-6c5dbda572e5</string>
	<key>QueryResponses</key>
	<dict>
		<key>AvailableDeviceCapacity</key>
		<real>10.320999145507812</real>
		<key>BatteryLevel</key>
		<real>0.49000000953674316</real>
		<key>BluetoothMAC</key>
		<string>94:94:94:94:94:a6</string>
		<key>BuildVersion</key>
		<string>14G60</string>
		<key>CellularTechnology</key>
		<integer>3</integer>
		<key>DataRoamingEnabled</key>
		<false/>
		<key>DeviceCapacity</key>
		<real>12.137939453125</real>
		<key>DeviceName</key>
		<string>XXX 的 iPad</string>
		<key>IMEI</key>
		<string>99 000289 244779 6</string>
		<key>IsRoaming</key>
		<true/>
		<key>MEID</key>
		<string>99000289244779</string>
		<key>Model</key>
		<string>MD525TA</string>
		<key>ModelName</key>
		<string>iPad</string>
		<key>ModemFirmwareVersion</key>
		<string>11.60.00</string>
		<key>OSVersion</key>
		<string>10.3.3</string>
		<key>ProductName</key>
		<string>iPad3,6</string>
		<key>SerialNumber</key>
		<string>DMPK3ML3F190</string>
		<key>UDID</key>
		<string>38c2840ff0be3ccff43299d2e06320485facb2f5</string>
		<key>WiFiMAC</key>
		<string>94:94:94:94:94:a5</string>
	</dict>
	<key>Status</key>
	<string>Acknowledged</string>
	<key>UDID</key>
	<string>38c2840ff0be3ccff43299d2e06320485facb2f5</string>
</dict>
</plist>

當 device 的 profile 移除的 plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>MessageType</key>
	<string>CheckOut</string>
	<key>Topic</key>
	<string>com.apple.mgmt.External.033dca28-442a-4bcc-9519-ad1165d859c9</string>
	<key>UDID</key>
	<string>38c2840ff0be3ccff43299d2e06320485facb2f5</string>
</dict>
</plist>

滿有趣的，對 iOS device 送 command ，餵給他們吃的 command 他們不喜歡吃，吐出來時還會講：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CommandUUID</key>
	<string>139662d1-bb84-42d1-8785-ba8aa7409d6f</string>
	<key>ErrorChain</key>
	<array>
		<dict>
			<key>ErrorCode</key>
			<integer>12021</integer>
			<key>ErrorDomain</key>
			<string>MCMDMErrorDomain</string>
			<key>LocalizedDescription</key>
			<string>「ApplicationConfiguration」不是有效的要求類型。</string>
			<key>USEnglishDescription</key>
			<string>“ApplicationConfiguration” is not a valid request type.</string>
		</dict>
	</array>
	<key>Status</key>
	<string>Error</string>
	<key>UDID</key>
	<string>38c2840ff0be3ccff43299d2e06320485facb2f5</string>
</dict>
</plist>

相關文章：

「三次創作」：

Sample iOS MDM server
https://github.com/macadmins/mdm-server

「二次創作」：

Sample iOS MDM server
https://github.com/project-imas/mdm-server

「原創」：

Intrepidus Group’s iOS MDM tools
https://github.com/intrepidusgroup/imdmtools

Java 版本的 MDM：

https://github.com/davewang/iOS-MDM

javapns
Apple Push Notification Service Provider for Java
https://code.google.com/archive/p/javapns/

Deploying iPhone and iPad Mobile Device Management for java
https://github.com/zuoyy/IOS-MDM-Server

[iOS] get MDM settings from system dictionary in swift
https://stackoverflow.max-everyday.com/2018/01/ios-get-mdm-settings-from-system-dictionary-in-swift/

MDM推送設定值到 iOS device
https://stackoverflow.max-everyday.com/2017/09/mdm-settings-ios-device/

MDM推送App到 iOS device
https://stackoverflow.max-everyday.com/2017/09/mdm-install-app/