Apple Configuration Deployment
Problem
Section titled “Problem”An Apple configuration profile has been created and assigned to a group or endpoint, but the settings are not applying on the device — or the profile is applying on some devices but not others.
Solution
Section titled “Solution”1. Check that the device is enrolled and checking in
Section titled “1. Check that the device is enrolled and checking in”Go to Apple → Endpoints → Mobile Devices (or Mac) and confirm the device appears in the list and has a recent Last check-in timestamp. If the device is not checking in, the profile cannot be delivered. Ensure the device has internet access and the MDM profile is still installed (Settings → General → VPN & Device Management on iOS/iPadOS).
2. Check that the configuration is assigned
Section titled “2. Check that the configuration is assigned”Open the configuration in Apple → Configurations and check the Endpoints and Groups counts. If both show 0, the configuration is not assigned to anything and will not deploy. Assign it to the appropriate group or endpoint.
3. Check priority conflicts
Section titled “3. Check priority conflicts”If the configuration is assigned but the expected settings are not applying, a higher-priority configuration may be overriding it. Review all configurations assigned to the affected device (via its groups) and compare priority values. The configuration with the highest priority number wins.
See Configuration Priority for how priority resolution works.
4. Check for supervised-only settings
Section titled “4. Check for supervised-only settings”Some configuration profile settings only work on Supervised devices enrolled through Apple Business Manager (DEP). If a configuration containing supervised-only settings is applied to an unsupervised device, those settings are silently ignored — the profile installs but the restricted settings have no effect.
Check the device’s management mode in Apple → Endpoints — Supervised devices show “Supervised” in the Management Mode column. If the device is unsupervised and the configuration requires supervision, the device must be wiped and re-enrolled via DEP.
5. Wait for the next check-in
Section titled “5. Wait for the next check-in”Configuration profiles are not pushed immediately — they are delivered on the device’s next MDM check-in. If a profile was assigned recently, wait a few minutes and recheck. You can prompt a faster check-in by going to Settings → General → VPN & Device Management on the device and tapping the MDM profile to refresh it.
Good to know
Section titled “Good to know”- Profile removal — if a configuration is unassigned from a device, the profile is removed on the next check-in. Settings enforced by the profile revert to their defaults.
- Multiple profiles can coexist — unlike some MDM platforms, Apple devices can have multiple configuration profiles installed simultaneously. Priority determines which wins for conflicting settings, but non-conflicting settings from multiple profiles all apply.
- macOS and iOS/iPadOS — configuration profiles work on both, but some payload types are platform-specific. A profile designed for iOS may not have any effect on macOS endpoints in the same group.