This error occurs when a Privacy Preferences Policy Control (PPPC) Device Setting contains an invalid CodeRequirement value. The most common causes are a typo, incorrect formatting, or a Code Requirement copied from an unreliable source. Correcting the value and redeploying the profile will resolve the error.
What Causes This Error
The CodeRequirement field in a PPPC Device Setting must follow a specific syntax. The most frequent mistake is including a designated = prefix, which is invalid in this context.
✅ Correct format:
identifier "org.mozilla.firefox" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "43AQ936H96"
(identifier "com.google.Chrome" or identifier "com.google.Chrome.beta" or identifier "com.google.Chrome.dev" or identifier "com.google.Chrome.canary") and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV
❌ Incorrect format (note the designated => prefix):
designated => identifier "org.mozilla.firefox" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] =
Note: Every application has a unique Code Requirement — the content will differ between apps, but the formatting pattern above should look consistent.
How to Fix This Error
- Navigate to Catalog > Device Settings and open the affected PPPC Device Setting.
- Locate the entry with the invalid
CodeRequirementvalue. - Check for the following common issues:
- A
designated =>prefix at the beginning of the value - Typos or extra characters in the string
- A Code Requirement that was copied from a source other than the application itself
- A
- Replace the value with the correct Code Requirement for the application.
- Save and redeploy the profile.
Not sure how to get the correct Code Requirement? See How to Get the Team ID, Bundle ID, and Code Requirement for step-by-step instructions on retrieving it directly from the application.