provisioning agent timed out waiting for jamf mdm push confirmation
Redesigns a provisioning agent that times out waiting for Jamf MDM push confirmation: async polling with a deadline and a webhook callback. Use when provisioning stalls on push confirmation. Not for Jamf push failures themselves.
TL;DR
MDM push confirmation is asynchronous and slow; blocking on it with a fixed timeout fails. Poll with backoff up to a deadline, accept a webhook callback as the success signal, and hand off to a human queue on deadline expiry.
The query
provisioning agent timed out waiting for jamf mdm push confirmationUse this when
- provisioning times out waiting for Jamf push
- devices enroll minutes after the agent gave up
- the agent marks devices failed that later succeed
Not for
- Jamf push certificate expirations
- devices that never check in at all
- enrollment invitation problems
Steps
- Replace the fixed sleep with polling that backs off, checking the Jamf device record. Expected output: the agent observes check-ins without blocking.
- Set an explicit deadline, such as 30 minutes, after which the agent stops waiting. Expected output: the wait always terminates.
- Prefer a Jamf webhook on enrollment complete as the success signal over polling. Expected output: confirmation arrives as an event.
- On deadline expiry, file a follow-up task with the device serial instead of failing the provisioning. Expected output: a human or later run picks it up.
- Record the actual time-to-enroll to tune the deadline. Expected output: the deadline matches reality.
Applies to
Jamf Pro webhooks and API, provisioning agents, Apple device enrollment.
Variant phrasings
Push confirmations arrive but late
Lengthen the deadline; the design already handles it gracefully.
Webhook never fires
Fall back to polling and alert that the webhook subscription needs repair.
Why it happens
APNs delivery and device check-in timing are outside your control. Synchronous waits encode a guess about that timing, and every guess is eventually wrong.
Edge cases
- Idempotency matters: a late confirmation after handoff must not double-provision.
- Log the serial at every stage; without it, late events cannot be matched.
- Weekend enrollments are slower; consider calendar-aware deadlines.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_Rh7oDJ0O1nEjsKz93Q2N7A