'Enable ChatGPT' button blued out

[Greg1]

Hey folks, 

I'm having trouble allowing users to use ChatGPT. We allow Apple Intelligence on all machines, and so have all the allow buttons ticked in the Restrictions profile, aside from 'Allow integration with external intelligence services (macOS 15.2 or later, supervised)'.

I've removed a few test machines from the scope of the standard config profile, and duplicated the Restrictions Config profile, and then only included a few test machines, and this time allowed integration with external intelligence services (macOS 15.2 or later, supervised). The initial ChatGPT entry is fine:

but I'm seeing a strange blue box that almost looks like you could press it.

 

If you try to Use ChatGPT with an account, it doesn't allow that too (last screen shot).

Has anybody else experienced this?

[AJPinto]

Have you tried rebooting the devices? Some times with these keys you need to reboot for the setting to apply.

[Greg1]

I have, both machines are on 15.4.1, and it's still the same

[ceeghb]

I've exactly the same as you, have raised a support with Jamf but so far nothing useful....

[Greg1]

@ceeghb Please update the thread if you hear of a fix!

[ceeghb]

will do, you too please

[jtrant]

Are either of you setting the allowedExternalIntelligenceWorkspaceIDs key?

[Greg1]

No, this would potentially be in the next step, but to start with I just want users to be able to turn it on (I turned it on on my personal, non-jamf connected Mac to get an understanding how it looks, and on that machine I can turn it on, and also sign in too, on the unmanaged machine)

[ceeghb]

tried all settings, but yes it's on ATM, makes no difference :(

[ceeghb]

sorry misread, no we don't want users to use workspace ID and we don't have one anyway.

[jtrant]

If I remember correctly, there have been issues reported when setting these features to 'Allow'. What happens if you remove the MDM profile for Apple Intelligence completely?

[Greg1]

Here are my most recent steps.

If I remove all tickboxes relating to Apple Intelligence

Save, and Distribute to all, my Dock reboots (a sign the machine has downloaded the changes), and I am still signed in to Apple Intelligence.

After a reboot, I am still signed in to AI, and ChatGPT is disabled. After a sudo jamf recon, AI is still signed in. Checking the profile, the tags are set to False:

If I manually turn off AI, I can just manually turn it back on.


If I head back to jamf, and turn back on most the AI stuff:

my Dock reboots, the ChatGPT option is then clickable at the bottom of the AI panel, but again, same blued-out box, and I cannot turn on ChatGPT

[Greg1]

If I remove my test machines from the profile (so it is not applied to any machines), then clone the Profile, add the test machines to the copy, then distribute to the test machines, it's exactly the same (as expected)

[jtrant]

Un-checking the options in the Jamf Pro UI will disable those features.

My question is: If you remove the configuration profile related to Apple Intelligence completely does the feature become available? If so, something in your profile is causing this.

I would also recommend using a tool such as iMazing Profile Editor (and signing profiles before uploading) as Jamf Pro has a nasty habit of including other keys when configuring many payloads, including 'Restrictions').

[Greg1]

Eurgh, nasty habits are not something I want after spending €15k a year 😏

[Greg1]

And yes, if I remove the profile that is set to allow ChatGPT, then the option becomes available and ChatGPT is available.

 (ie, if I send the profile to the machine telling it to allow ChatGPT, it is not available)

[ceeghb]

Yes if I remove the config profile the blue button then works as normal, it seems a bug with jamf’s config profile because when you try to enable it, it doesn’t work, but does work if you try to disable Apple Intelligence.

[jtrant]

Recommend you inspect the contents of your profile using System Information on a target Mac to see what's actually getting pushed, or take a look at the profile in System Settings > Device Management.

You're better off using iMazing to create profiles, as I mentioned above.

[ceeghb]

Thanks will do tomorrow, but I did exclude my mac from global config profile, then checked it works, so created as brand new config profile with ONLY the default restrictions and this is what breaks it, should be something so simple but just doesn’t work. :(

[jtrant]

Feel free to post the text from System Information > Profiles on an affected device here. It's probably something Jamf is pushing that it shouldn't. All of my Apple Intelligence profiles were created outside of Jamf Pro, so I haven't run into this.

[ceeghb]

Interestingly when checking what's been pushed I don't even see the AI settings when they're enabled, perhaps this is normal, as when I DO restrict them I then see this reflected in settings;

Not sure if that's normal i.e. only disabled/disallowed settings get pushed?

[ceeghb]

so done some testing with imazing, updated the Manifest Repository Update successfully and could see AI under 'other' tab.

Behaves like config profile pushed via Jamf, if allowed no settings are pushed but restrict something and it appears, but still doesn't fix my problem :(

[jtrant]

Please provide the text from the following PLIST on an affected machine:

/Library/Managed\ Preferences/com.apple.applicationaccess.plist

[ceeghb]

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>allowCloudKeychainSync</key>
<true/>
<key>allowPasswordSharing</key>
<true/>
<key>allowAssistant</key>
<true/>
<key>allowFingerprintForUnlock</key>
<true/>
<key>allowCloudBookmarks</key>
<true/>
<key>allowInternetSharingModification</key>
<true/>
<key>allowRapidSecurityResponseInstallation</key>
<true/>
<key>forceDelayedMajorSoftwareUpdates</key>
<false/>
<key>allowTimeMachineBackup</key>
<true/>
<key>allowActivityContinuation</key>
<true/>
<key>allowAccountModification</key>
<true/>
<key>allowWritingTools</key>
<true/>
<key>forceClassroomAutomaticallyJoinClasses</key>
<false/>
<key>allowCloudPhotoLibrary</key>
<true/>
<key>allowRapidSecurityResponseRemoval</key>
<true/>
<key>allowCloudPrivateRelay</key>
<true/>
<key>forceUnpromptedManagedClassroomScreenObservation</key>
<false/>
<key>allowCloudMail</key>
<true/>
<key>allowPasswordProximityRequests</key>
<true/>
<key>allowScreenShot</key>
<true/>
<key>allowUniversalControl</key>
<true/>
<key>allowCloudDocumentSync</key>
<true/>
<key>allowARDRemoteManagementModification</key>
<true/>
<key>PayloadUUID</key>
<string>B7278DCD-A12D-4EA6-B0C5-FF5007A0CFAD</string>
<key>allowBluetoothSharingModification</key>
<true/>
<key>allowExternalIntelligenceIntegrationsSignIn</key>
<true/>
<key>allowCloudAddressBook</key>
<true/>
<key>allowCloudDesktopAndDocuments</key>
<true/>
<key>allowMediaSharingModification</key>
<true/>
<key>allowRemoteScreenObservation</key>
<true/>
<key>enforcedFingerprintTimeout</key>
<integer>172800</integer>
<key>allowMusicService</key>
<true/>
<key>allowExternalIntelligenceIntegrations</key>
<true/>
<key>allowRemoteAppleEventsModification</key>
<true/>
<key>allowCloudReminders</key>
<true/>
<key>allowCamera</key>
<true/>
<key>allowCloudNotes</key>
<true/>
<key>allowFingerprintModification</key>
<true/>
<key>allowiPhoneMirroring</key>
<true/>
<key>allowStartupDiskModification</key>
<true/>
<key>allowNotesTranscriptionSummary</key>
<true/>
<key>forceClassroomUnpromptedScreenObservation</key>
<false/>
<key>allowUIConfigurationProfileInstallation</key>
<true/>
<key>forceBypassScreenCaptureAlert</key>
<false/>
<key>forceClassroomUnpromptedAppAndDeviceLock</key>
<false/>
<key>allowGenmoji</key>
<false/>
<key>forceAirPrintTrustedTLSRequirement</key>
<false/>
<key>allowEraseContentAndSettings</key>
<true/>
<key>allowedExternalIntelligenceWorkspaceIDs</key>
<array>
</array>
<key>allowCloudFMM</key>
<true/>
<key>allowImagePlayground</key>
<false/>
<key>forceDelayedSoftwareUpdates</key>
<false/>
<key>allowPrinterSharingModification</key>
<true/>
<key>forceClassroomRequestPermissionToLeaveClasses</key>
<false/>
<key>allowUSBRestrictedMode</key>
<true/>
<key>allowCloudFreeform</key>
<true/>
<key>allowCloudCalendar</key>
<true/>
<key>_isAppleIntelligenceRestricted</key>
<true/>
<key>allowAirPrint</key>
<true/>
<key>allowMailSummary</key>
<false/>
<key>allowDeprecatedWebKitTLS</key>
<false/>
<key>forceDelayedAppSoftwareUpdates</key>
<false/>
<key>allowLocalUserCreation</key>
<true/>
<key>allowAirDrop</key>
<true/>
<key>allowSpotlightInternetResults</key>
<true/>
<key>allowContentCaching</key>
<true/>
<key>allowCloudBTMM</key>
<true/>
<key>allowFileSharingModification</key>
<true/>
<key>allowDeviceNameModification</key>
<true/>
<key>allowAirPrintiBeaconDiscovery</key>
<true/>
<key>allowPasswordAutoFill</key>
<true/>
</dict>
</plist>

[jtrant]

I think your issue is caused by the following. Unless you want to restrict Writing Tools, I recommend you remove:

<key>allowWritingTools</key>
<true/>

[Greg1]

If this helps, I just tried unticking Allow Apple Intelligence: Writing Tools (macOS 15 or later, supervised), in jamf and saving the existing profile. My machine updated (dock refreshed), but I can still not use ChatGPT

[Greg1]

oh, and my plist shows

<key>allowWritingTools</key>
	<false/>

after making this change

(allowExternalIntelligenceIntegrations is set to true)

[jtrant]

That's because un-checking the box disables the feature.

As I have mentioned before, iMazing Profile Creator is a far better option for crafting 'Restrictions' profiles. Jamf has a habit of including additional preferences when creating such profiles in the UI.

[ceeghb]

I get the same as @Greg1 , but if I enable the feature in Jamf GUI or even iMazing as far as I can tell it only puts an entry in the plist IF the item is disallowed.

As I'm enabling it (the default) there's nothing in the plist that should disable AI and ChatGPT?

Yes there are other thing in there too - by default but nothing related to AI and ChatGPT

[ceeghb]

Sorry that was nonsense, IF you look at the config profile through the Mac's UI you see nothing, but if you look at the plist you see things like;

<key>allowExternalIntelligenceIntegrationsSignIn</key>
<true/>

<key>allowExternalIntelligenceIntegrations</key>
<true/>

<key>allowGenmoji</key>
<true/>

<key>allowedExternalIntelligenceWorkspaceIDs</key>
<array>
</array>

<key>allowImagePlayground</key>
<true/>

<key>_isAppleIntelligenceRestricted</key>
<false/>

<key>allowMailSummary</key>
<true/>

to name a few, so I'm no further forward :(

[jtrant]

Setting any keys relating to Apple Intelligence creates a hidden key in com.apple.applicationaccess:

<key>_isAppleIntelligenceRestricted</key>
<true/>

This lets the system know that Apple Intelligence is managed. My point here is to not set any keys relating to Apple Intelligence if you don't want to restrict them. For your Restrictions profile, use iMazing to craft a test profile without selecting any of the Apple Intelligence features so that the hidden key doesn't get created to begin with.

This will ensure that <true> keys are not pushed for features you have no interest in managing and allow your users to use Apple Intelligence features normally.

[ceeghb]

Got a reply from Jamf :(

Thank you for bringing this to our attention. I have tested the profile you provided and was able to replicate the issue you described. Upon further investigation, I found that this behavior has been documented internally as a product issue:
PI135178 – Unable to enable ChatGPT even if allowExternalIntelligenceIntegrations is set to true

At this time, there is no known workaround. However, please be assured that our development team is actively investigating this issue to identify a permanent fix.

For more information on managing Apple Intelligence features, including ChatGPT integration, you may find the following resource helpful:
https://derflounder.wordpress.com/2025/01/29/managing-apple-intelligence-features-on-macos-sequoia-1...

We have attached this case to the PI, so that we raise awareness and suggest to keep an eye out on the release notes for the upcoming Jamf Pro versions so that we can verify if the issue has been addressed or not.

We're truly sorry for the impact this is having in your environment and we can assure you we're working hard on getting to the bottom of it and provide with the best solution.

We are marking this case as inactive, but as always, I remain at your disposal should you have any further questions.

Thank you for working with Jamf Support and we wish you a marvellous day!

[Greg1]

Many thanks @ceeghb for submitting an official ticket, I was shortly going to do the same. It's time for me to take a look at Kandji as it comes so highly recommended, and I'm growing tired of jamf boasting about 'day one support', and here we are on day 240, and it doesn't work properly (and this is by far the only issue II'm having).

[ceeghb]

@Greg1 still waiting for Jamf for a solution, but might have found a work around, excluded mac from our "staff restriction" policy - the one where it's specified in there, to enable all AI 🙄, but as we know doesn't work, but...
excluding macs from this policy obviously allows AI to work as normal, but found after I enabled AI AND applied the original policy again didn't break it!