Question

I want to collect device attributes and send them to the mdm server using push notification.

Steps involved are:

1. create a configuration profile with mdm payload
2. get device token
3. use apple push notification service to send a notification to the device.
4. get back device attributes
5. do same with multiple devices which the company manages

Questions:

1. Will the user always need to act on a message or I can send a message onto the device without user action and get the work done?
2. Do I need an app on the device to send back the token?

Answer 1

It sounds like you’re trying to use push notifications to poll iOS devices and return information.

Push notifications do not provide a mechanism to execute code on a device without user interaction. You would have to have an application loaded on the device, and the user would have to click through from the notification to your app.

In iOS, applications generally don’t run unless the user is actively interacting with them. There are a few exceptions (e.g. background audio.)

You do need to have an app running to get the device token. You call registerForRemoteNotificationTypes. See APNs docs for more information.

Edited to add more information:

Looks like the MDM protocol uses push notifications to do just what you describe. However, there’s nothing about it in Apple’s “Local and Push Notification Programming Guide” (linked above).

Apparently Apple keeps tight control over the MDM documentation (see here and here).

However, I did find this paper from blackhat describing how the system works.

My earlier point about not executing arbitrary code on a device without user interaction still applies. There’s a finite set of commands that can be executed (see Appendix A).