# Apple Configuration Deployment

> Fix an Apple configuration profile that is assigned to a group or endpoint but is not applying on the device.

Source: https://docs.capaone.com/capaone/troubleshooting/apple-configuration-deployment/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

## Problem

An Apple configuration profile has been created and assigned to a group or endpoint, but the
settings are not applying on the device — or the profile is applying on some devices but not
others.

## Solution

### 1. Check that the device is enrolled and checking in

Go to **Apple → Endpoints → Mobile Devices** (or Mac) and confirm the device appears in the list
and has a recent **Last check-in** timestamp. If the device is not checking in, the profile
cannot be delivered. Ensure the device has internet access and the MDM profile is still installed
(Settings → General → VPN & Device Management on iOS/iPadOS).

### 2. Check that the configuration is assigned

Open the configuration in **Apple → Configurations** and check the Endpoints and Groups counts.
If both show 0, the configuration is not assigned to anything and will not deploy. Assign it to
the appropriate group or endpoint.

### 3. Check priority conflicts

If the configuration is assigned but the expected settings are not applying, a higher-priority
configuration may be overriding it. Review all configurations assigned to the affected device
(via its groups) and compare priority values. The configuration with the highest priority number
wins.

See [Configuration Priority](/capaone/reference/configuration-priority/) for how priority
resolution works.

### 4. Check for supervised-only settings

Some configuration profile settings only work on **Supervised** devices enrolled through Apple
Business Manager (DEP). If a configuration containing supervised-only settings is applied to an
unsupervised device, those settings are silently ignored — the profile installs but the
restricted settings have no effect.

Check the device's management mode in Apple → Endpoints — Supervised devices show
**"Supervised"** in the Management Mode column. If the device is unsupervised and the
configuration requires supervision, the device must be wiped and re-enrolled via DEP.

### 5. Wait for the next check-in

Configuration profiles are not pushed immediately — they are delivered on the device's next MDM
check-in. If a profile was assigned recently, wait a few minutes and recheck. You can prompt a
faster check-in by going to **Settings → General → VPN & Device Management** on the device and
tapping the MDM profile to refresh it.

## Good to know

- **Profile removal** — if a configuration is unassigned from a device, the profile is removed
  on the next check-in. Settings enforced by the profile revert to their defaults.
- **Multiple profiles can coexist** — unlike some MDM platforms, Apple devices can have multiple
  configuration profiles installed simultaneously. Priority determines which wins for conflicting
  settings, but non-conflicting settings from multiple profiles all apply.
- **macOS and iOS/iPadOS** — configuration profiles work on both, but some payload types are
  platform-specific. A profile designed for iOS may not have any effect on macOS endpoints in the
  same group.