Skip to main content

DEP/ADE Forbidden Error

Description

When creating an ADE (formerly DEP) association or running another ADE synchronization action, FileWave may show this error: DEP error: Forbidden.

The most likely causes are:

  • The FileWave Server SSL certificate changed. Check Preferences > Mobile to confirm that the server SSL certificate is not revoked or expired.
  • The external IP address of the FileWave Server changed.

Apple stores the external IP address of the FileWave Server from the last successful contact. If that IP address differs during synchronization, the action can fail and the ADE Server Token must be replaced.

You can check the stored IP address in the relevant ADE account:

In the Apple portal, open Settings, select the MDM server, and choose Edit. The Last Date Connected and Last IP Connected values appear in the MDM Server Information view.

n1RUQ73gSehzqQt1-embedded-image-pnhjtfqf.png

Requirements

  • FileWave MDM ADE certificate

Resolution

A Forbidden error requires replacing the ADE Server Token, not updating it in place.

In FileWave Central, go to Preferences > VPP & ADE:

In FileWave 16.4.0 and later, the certificate and account controls are under Configuration, while synchronization is under Status. Earlier versions use the single-pane layout. See VPP and ADE Preferences for the version-specific navigation. This replacement procedure is for a failing ADE token; for a healthy token’s annual renewal, follow the Apple Business Manager or Apple School Manager renewal instructions instead.

  1. Choose Download certificate (requires the fwadmin password) and save the certificate.

In the relevant Apple ADE account, Apple Business Manager or Apple School Manager:

  1. Select Settings.
  2. Highlight the MDM server from the list and choose Edit.
  3. Select Upload New... and select the certificate downloaded from FileWave.
  4. When prompted, download the ADE Server Token.

Before removing the ADE Server Token, check whether it is selected in the Education tab of Preferences. If it is, record which account is selected and remove that Education association first. After replacing the token and completing the full sync, select the replacement account in Education again.

Back in FileWave Central, go to Preferences > VPP & ADE:

  1. Click Configure Accounts (requires the fwadmin password).
  2. Select the Forbidden token and use the - button to remove it.
  3. Select the + button and choose the ADE Server Token downloaded from Apple.
  4. Run an ADE Full Sync. Hold Alt/Option while choosing the synchronization action; the button name changes to indicate a full sync.

After the token is replaced and the full sync completes, synchronization should succeed.

No comments to display