Supervise already-set-up device without erase?

[GDeol313]

I'm trying to supervise an iPhone that has already been set up (CloudConfigurationUIComplete: true, IsSupervised: false) without erasing it. When I run ios prepare --certfile=supervision-cert.der --orgname=test I get the error "A cloud configuration is already present on this device."

Apps like ShiftYourPhone and TechLockdown are able to supervise already-set-up devices without erasing them on Windows — they trigger a "continue with partial setup" flow on the device. Is this something go-ios supports or plans to support? If not, which protocol/service would need to be called to clear the existing cloud config and trigger the partial setup flow?

[nanoscopic]

Yeah it doesn't work once you go through initial setup and you get CloudConfigurationUIComplete: true and can't do it. You have to do it during the initial steps after an erase.

Edit: I'm pretty sure that the things you mention are doing "full MDM" and you are getting confused by the reuse of the word supervision. I could be wrong. Do you have any evidence that they are doing the same sort of lightweight supervision? Do you have any documentation or explanation for what it is you claim these tools do and support?

[nanoscopic]

Ok I dug into this. It appears the way to do this is by overwriting systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist using MobileBackup2 to flip the flag there indicating that CloudConfiguration setup was completed to false.

Eg; set CloudConfigurationUIComplete to false.
Possible ConfigurationWasApplied to false also.

I don't quite get it. I thought you can't just overwrite those files... but ??

[nanoscopic]

Related code showing CloudConfigurationDetails being written: doronz88/pymobiledevice3#1543

[GDeol313]

Hey nanoscopic,

I really appreciate all your help. I've been cooped up with university work, but finally got back to my project. I managed to get supervision working (via sparserestore/Nugget through pymobiledevice3, on iOS 18.7), but no matter what I do, once the device is supervised, my MDM (NanoMDM on a VPS) receives Authenticate but never TokenUpdate. When the device is not supervised, enrollment works fully (both tokenupdate and authenticate received)

The device's mdmd log shows it's deliberately skipping TokenUpdate:

MDMServerCore retried token update enough. Aborting...
Skipped token update due to incomplete migration.

and separately, when it tries to stop managing books:
DMDStopManagingBooksOperation ... Error Code=1650 "Book migration must be complete."

One thing I noticed: if I factory-reset the device and then enroll, TokenUpdate works, but if I just unsupervise (rewriting CloudConfigurationDetails) and re-enroll, it doesn't. So something the factory reset clears isn't getting cleared by my unsupervise. I was hoping you might have an idea of what state I'm missing, or what completes that book migration? Thanks again for all your help!