Fix implementation of System Extensions payload
As documented by Apple (https://developer.apple.com/documentation/devicemanagement/systemextensions) it's an error to include the same Team ID in both the 'AllowedTeamIdentifiers' key as well as the 'AllowedSystemExtensions' key.
In my experience when both a Team ID and specific Bundle Identifiers of System Extensions are included, both these keys are present in the deployed profile.
Given that Apple specifies this as an error and the fact that admins may choose to specify just the Team ID to allow all extensions from a vendor whereas others might wish to only allow the specified extensions, the implementation of this payload should be fixd such that:
1) An admin who only specifies a Team ID and no Bundle Identifiers should ONLY have the 'AllowedTeamIdentifiers' key used
2) An admin who specifies a Team ID AND one or more Bundle Identifiers should ONLY have the 'Allowed System Extensions' key used
Additionally, the payload requires an admin to specify at least one of the available extension types. However Apple's documentation expressly states that should an admin opt to not explicitly specify an extension type that all are considered acceptable and will be loaded.
All that said, as currently implemented supplying both 'AllowedSystemExtensions' and 'AllowedTeamIdentifiers' in the System Extensions payload does not prevent vendor software (at least ours) from being properly loaded & run.
Alex Orlebeke
shared this idea
SimpleMDM currently handles the Team IDs as you request.
Regarding the Allowed Extension Types, our UI will not always mirror the underlying XML directly. If you would like to allow all acceptable types, you may keep the default check values enabled.
If you are having issues with your particular implementation, please contact support and include the XML that SimpleMDM is delivering to the device so that we can better understand if there is an issue with the profile generation or elsewhere.