Profiles are not deleting when a device changes networks

[vassallon]

On the phone with support currently about a fairly significant issue. 

Today I was moving some iPads between networks and right now profiles from the previous network are being kept when the iPad moves to another network. 

Support is now claiming that this is expected behavior and has always been this way. I have used this product for almost 6 years and never in those 6 years have profiles stayed on the iPad when I have moved them between networks. 

This is brand new behavior that was not occurring last friday. Is anyone else seeing anything like this?

All of these profiles are from the previous network and up until last Friday would have deleted after changing to the new network.

@Noah_Salzman 

[BlakeRichardson]

@vassallon  Agree profiles should not remain on a device. I'll do some quick testing on a spare device and report back. 

[vassallon]

@BlakeRichardson 

Please and thank you very much for checking. If this new behavior is expected than Meraki SM has become worthless to me.

[BlakeRichardson]

Ok I have just changed one of our iPads and the old profiles i.e. seperate wifi, settings and wallpaper profiles have been removed and replaced with the new profiles. Its working for me as expected.

I would ask to have your case escalated, could well be a support person that isn't familiar with SM.

[vassallon]

@BlakeRichardson 

What iOS version do you have on this iPad? The iPads I am using are iOS 13.5.1.

[BlakeRichardson]

@vassallon  13.31, I can update the OS and try again. 

[vassallon]

The two I have tested are both 13.5 and 13.5.1. Let me see if I've got anything older as well.

[vassallon]

I found an iPad running iOS 13.4.1 in my stack that were being repaired and it's having the same issue. Perhaps it is maybe something specific to a profile not removing correctly. 

@BlakeRichardson 

Can you try bouncing the iPads around to several different networks and seeing if you can get the profile updating to break?

[vassallon]

In digging into things I can see that profiles were updating correctly on 6/17 but not on 6/19.

Some change was made in that timeframe, I also remember there being an option for update management profile, under the command window, which has disappeared.

[BlakeRichardson]

@vassallon I've update the device, moved it from one SM network to another and I am also finding the device is holding onto old profiles.. Sorry I misread your inital post and so my first testing was only checking device tagging not moving between networks.

So yes I am having the same issue as you and the "refresh profiles list" doesn't seem to remove old profiles.

[vassallon]

@BlakeRichardson 

And to confirm, this isn't the behavior you saw before when a device changed networks in the past. It would remove the profiles and update to just the profiles for the new network, correct?

@Noah_Salzman 

[BlakeRichardson]

@vassallon  I have even disabled the old profiles so there is no scope for them at all, the dashboard reports the profile is out of date but refreshing them still wont remove them. I think you have uncovered a bit of a design floor, whether its an Apple or Meraki flaw who knows. 

[Noah_Salzman]

Hey Vassalon,

This is not an area I am intimately familiar with, however, my understanding is that the behavior you are seeing is NOT new. Are you sure you didn't previously de-scope devices before moving them?

With regard to the the Refresh Management Profile menu option: it has been temporarily disabled as it was causing an entirely separate problem. We hope to restore it soon.

--Noah--

[vassallon]

@Noah_Salzman 

I have never had to unscope devices when moving them. As @BlakeRichardson mentioned, even with setting no profiles available to the device the profiles are not being removed.

I wonder if that is what knocked the Management Profile off of some of my iPads.

[vassallon]

@Noah_Salzman 

I just tested this myself and it is not working.

So the profile should not be being applied to any of the iPads in the network but when I check the iPad profiles:

No matter what I try the profile is not being removed. Something was changed last week and broke the profile management process.

[vassallon]

Now it appears clearing passcodes are broken as well.

Jun 23 07:20

Clear device passcode

Error: The passcode cannot be cleared (-1)

Jun 23 07:20

[vassallon]

@BlakeRichardson 

Do you have your profiles setup to require a password to uninstall? I'm wondering if that might be the cause of this, I just tried setting it to all users to remove the profile. 

After doing this it appears the profile was removed. I believe the issue may be due to the password being set.

[EncinitasMatt]

I have opened a ticket for this issue myself.  Did you get a solution on yours Vassallon?

[vassallon]

@EncinitasMatt 

Not yet, I am noticing some new behavior today in there so I suspect they are working on fixing the break.

[BlakeRichardson]

@vassallon  All of my profiles require a password to remove. 

[EncinitasMatt]

My ticket response from Meraki:

"factory resetting a devices before moving it to a new network is considered by Meraki to be the best practice for a clean deployment"

So basically, the answer is everything is working as expected.  I guess this is the new reality we will need to adjust to.

[vassallon]

Here's the problem though in a school district with multiple networks for each school, simply resetting an iPad because the student changes school is not a valid response. 

Why should I have to reset an iPad to clear profiles that up until recently were automatically removed by Meraki when the device changed networks?

That makes no sense at all to me. I wouldn't accept that as an answer and push back on support, you can use my existing case (05297104) if it helps. 

[BrianBuchanan]

I just went through this issue myself.  My user's ticket is from early July.  Is this still happening?  The whole workflow is that devices appear first in the default network with default profile, and then they get moved to the school network and the defaults need to fall off, without resetting (that's just nuts).

The post I just made before I found this thread:

https://community.meraki.com/t5/Endpoint-Management-Systems/Profiles-sticking-between-networks/m-p/9...

And opened Case 05462486

[vassallon]

@BrianBuchanan 

It STILL is not fixed. I don't know why it is so dang hard to fix something that has worked for years, that was broken in a change.

I mean seriously resetting an iPad is not a valid solution and should have never been offered as a "solution."

[DjShroll]

I'm glad I'm not the only person that finds this to be ridiculous. Our deployment time has increased substantially thanks to this. 

[EncinitasMatt]

I reopened my ticket.  This really is an annoyance, and frustrating that it used to not behave this way.

[vassallon]

@EncinitasMatt 

I know we are going on two months and this issue is still occuring, it is more than an annoyance at this point. It's not acceptable in any way shape or form.

[BrianBuchanan]

I received this update from Tahir to my case 05462486:

I found that there is a known issue with profiles being retained after moving a device to one network to another and our developers are working on it. I have attached this case to the one open with development so that I can update the case when there is a fix.

So it sounds like it's in development.

[Noah_Salzman]

Since I got all high-n-mighty about open communication just hours ago: when support says "it's in development" that doesn't necessarily mean there is a developer actively working on it. It means "support agrees with you that this is a real issue that needs development to fix it; we have sent the case to development; and it's now up to development to do something about it." 

This particular issue is not currently being worked on by a developer.

However, I'm currently having discussions internally about this issue… The product management team is still gathering info both from customers and our product leaders on the best approach to make things better. Once we have details we will share them, but this one might take some time.

[vassallon]

@Noah_Salzman 

That is disappointing news as I have about 1000 iPads with the wrong profiles on them because students have changed schools. I don't want to have to tell these students that they have to reset their iPad to get it to work correctly because the MDM isn't working right. 

[Noah_Salzman]

Well, the bad news is that my post above was way off the mark and needlessly pessimistic. The good news is that, due to discussion prompted by this thread, some very smart people figured out what was going on and we think we may have a fix that works. More info coming soon.

[Kevin_C · Accepted solution]

Per Noah’s comment above, we now have a fix out that should resolve this issue. We have implemented changes to our sync logic to facilitate automatic profile assignment resolution when devices switch networks. When admins switch devices to a new network, Systems Manager will identify and remove all profiles associated with the old network. 

Furthermore, on most devices that have already switched networks, this change should also retroactively resolve profile assignment on the next profile sync. Profile syncs are scheduled to automatically run on all devices at least once daily, but can be initiated manually for a given device by clicking the “Refresh Details” button at the top of the device’s details page.  Please let us know if you see any problems in this area of the product related to this change.

[vassallon]

This is great news, I am going to test this right now and see if it is working.

[vassallon]

@Kevin_C and @Noah_Salzman 

Thank you so much for listening to my venting and getting this resolved. It is GREATLY APPRECIATED.

I can confirm that the functionality is back in place and my school district's students iPads are now getting the correct profiles and removing the old profiles as expected.