Profiles are not deleting when a device changes networks

SOLVED
vassallon
Head in the Cloud

Profiles are not deleting when a device changes networks

 

 

On the phone with support currently about a fairly significant issue. 

 

Today I was moving some iPads between networks and right now profiles from the previous network are being kept when the iPad moves to another network. 

 

Support is now claiming that this is expected behavior and has always been this way. I have used this product for almost 6 years and never in those 6 years have profiles stayed on the iPad when I have moved them between networks. 

 

This is brand new behavior that was not occurring last friday. Is anyone else seeing anything like this?

 

vassallon_0-1592860279061.png

 

All of these profiles are from the previous network and up until last Friday would have deleted after changing to the new network.

 

@Noah_Salzman 

 

 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)
1 ACCEPTED SOLUTION
Kevin_C
Meraki Employee

Per Noah’s comment above, we now have a fix out that should resolve this issue. We have implemented changes to our sync logic to facilitate automatic profile assignment resolution when devices switch networks. When admins switch devices to a new network, Systems Manager will identify and remove all profiles associated with the old network. 

 

Furthermore, on most devices that have already switched networks, this change should also retroactively resolve profile assignment on the next profile sync. Profile syncs are scheduled to automatically run on all devices at least once daily, but can be initiated manually for a given device by clicking the “Refresh Details” button at the top of the device’s details page.  Please let us know if you see any problems in this area of the product related to this change.

 
 

refresh.jpg

View solution in original post

33 REPLIES 33
BlakeRichardson
Kind of a big deal

@vassallon  Agree profiles should not remain on a device. I'll do some quick testing on a spare device and report back. 

Meraki CMNO, Ruckus WISE, Sonicwall CSSA, Allied Telesis CASE & CAI

@BlakeRichardson 

 

Please and thank you very much for checking. If this new behavior is expected than Meraki SM has become worthless to me.

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

Ok I have just changed one of our iPads and the old profiles i.e. seperate wifi, settings and wallpaper profiles have been removed and replaced with the new profiles. Its working for me as expected.

 

I would ask to have your case escalated, could well be a support person that isn't familiar with SM.

Meraki CMNO, Ruckus WISE, Sonicwall CSSA, Allied Telesis CASE & CAI

@BlakeRichardson 

 

What iOS version do you have on this iPad? The iPads I am using are iOS 13.5.1.

 

 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

@vassallon  13.31, I can update the OS and try again. 

Meraki CMNO, Ruckus WISE, Sonicwall CSSA, Allied Telesis CASE & CAI

The two I have tested are both 13.5 and 13.5.1. Let me see if I've got anything older as well.

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

I found an iPad running iOS 13.4.1 in my stack that were being repaired and it's having the same issue. Perhaps it is maybe something specific to a profile not removing correctly. 

 

@BlakeRichardson 

 

Can you try bouncing the iPads around to several different networks and seeing if you can get the profile updating to break?

 

 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

In digging into things I can see that profiles were updating correctly on 6/17 but not on 6/19.

 

Some change was made in that timeframe, I also remember there being an option for update management profile, under the command window, which has disappeared.

 

vassallon_0-1592867398334.png

 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

@vassallon I've update the device, moved it from one SM network to another and I am also finding the device is holding onto old profiles.. Sorry I misread your inital post and so my first testing was only checking device tagging not moving between networks.

 

So yes I am having the same issue as you and the "refresh profiles list" doesn't seem to remove old profiles.

Meraki CMNO, Ruckus WISE, Sonicwall CSSA, Allied Telesis CASE & CAI

@BlakeRichardson 

 

And to confirm, this isn't the behavior you saw before when a device changed networks in the past. It would remove the profiles and update to just the profiles for the new network, correct?

 

@Noah_Salzman 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

@vassallon  I have even disabled the old profiles so there is no scope for them at all, the dashboard reports the profile is out of date but refreshing them still wont remove them. I think you have uncovered a bit of a design floor, whether its an Apple or Meraki flaw who knows. 

Meraki CMNO, Ruckus WISE, Sonicwall CSSA, Allied Telesis CASE & CAI
Noah_Salzman
Meraki Alumni (Retired)

Hey Vassalon,

This is not an area I am intimately familiar with, however, my understanding is that the behavior you are seeing is NOT new. Are you sure you didn't previously de-scope devices before moving them?

With regard to the the Refresh Management Profile menu option: it has been temporarily disabled as it was causing an entirely separate problem. We hope to restore it soon.

--Noah--

@Noah_Salzman 

 

I have never had to unscope devices when moving them. As @BlakeRichardson mentioned, even with setting no profiles available to the device the profiles are not being removed.

 

I wonder if that is what knocked the Management Profile off of some of my iPads.

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

@Noah_Salzman 

 

I just tested this myself and it is not working.

 

vassallon_0-1592920259729.png

 

So the profile should not be being applied to any of the iPads in the network but when I check the iPad profiles:

 

vassallon_1-1592920455277.png

 

No matter what I try the profile is not being removed. Something was changed last week and broke the profile management process.

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

Now it appears clearing passcodes are broken as well.

 

Jun 23 07:20Clear device passcodeJun 23 07:20
Found this helpful? Give me some Kudos! (click on the little up-arrow below)

@BlakeRichardson 

 

Do you have your profiles setup to require a password to uninstall? I'm wondering if that might be the cause of this, I just tried setting it to all users to remove the profile. 

 

vassallon_0-1592925598535.png

 

After doing this it appears the profile was removed. I believe the issue may be due to the password being set.

 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)
EncinitasMatt
Here to help

I have opened a ticket for this issue myself.  Did you get a solution on yours Vassallon?

@EncinitasMatt 

 

Not yet, I am noticing some new behavior today in there so I suspect they are working on fixing the break.

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

@vassallon  All of my profiles require a password to remove. 

Meraki CMNO, Ruckus WISE, Sonicwall CSSA, Allied Telesis CASE & CAI

My ticket response from Meraki:

 

"factory resetting a devices before moving it to a new network is considered by Meraki to be the best practice for a clean deployment"

 

So basically, the answer is everything is working as expected.  I guess this is the new reality we will need to adjust to.

Here's the problem though in a school district with multiple networks for each school, simply resetting an iPad because the student changes school is not a valid response. 

 

Why should I have to reset an iPad to clear profiles that up until recently were automatically removed by Meraki when the device changed networks?

 

That makes no sense at all to me. I wouldn't accept that as an answer and push back on support, you can use my existing case (05297104) if it helps. 

 

 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

I just went through this issue myself.  My user's ticket is from early July.  Is this still happening?  The whole workflow is that devices appear first in the default network with default profile, and then they get moved to the school network and the defaults need to fall off, without resetting (that's just nuts).

 

The post I just made before I found this thread:

https://community.meraki.com/t5/Endpoint-Management-Systems/Profiles-sticking-between-networks/m-p/9...

 

And opened Case 05462486

@BrianBuchanan 

 

It STILL is not fixed. I don't know why it is so dang hard to fix something that has worked for years, that was broken in a change.

 

I mean seriously resetting an iPad is not a valid solution and should have never been offered as a "solution."

 

 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

I'm glad I'm not the only person that finds this to be ridiculous. Our deployment time has increased substantially thanks to this. 

I reopened my ticket.  This really is an annoyance, and frustrating that it used to not behave this way.

@EncinitasMatt 

 

I know we are going on two months and this issue is still occuring, it is more than an annoyance at this point. It's not acceptable in any way shape or form.

Found this helpful? Give me some Kudos! (click on the little up-arrow below)

I received this update from Tahir to my case 05462486:

 

I found that there is a known issue with profiles being retained after moving a device to one network to another and our developers are working on it. I have attached this case to the one open with development so that I can update the case when there is a fix.

 

So it sounds like it's in development.

Noah_Salzman
Meraki Alumni (Retired)

Since I got all high-n-mighty about open communication just hours ago: when support says "it's in development" that doesn't necessarily mean there is a developer actively working on it. It means "support agrees with you that this is a real issue that needs development to fix it; we have sent the case to development; and it's now up to development to do something about it." 

 

This particular issue is not currently being worked on by a developer.

 

However, I'm currently having discussions internally about this issue… The product management team is still gathering info both from customers and our product leaders on the best approach to make things better. Once we have details we will share them, but this one might take some time.

@Noah_Salzman 

 

That is disappointing news as I have about 1000 iPads with the wrong profiles on them because students have changed schools. I don't want to have to tell these students that they have to reset their iPad to get it to work correctly because the MDM isn't working right. 

Found this helpful? Give me some Kudos! (click on the little up-arrow below)
Noah_Salzman
Meraki Alumni (Retired)

Well, the bad news is that my post above was way off the mark and needlessly pessimistic. The good news is that, due to discussion prompted by this thread, some very smart people figured out what was going on and we think we may have a fix that works. More info coming soon.

Kevin_C
Meraki Employee

Per Noah’s comment above, we now have a fix out that should resolve this issue. We have implemented changes to our sync logic to facilitate automatic profile assignment resolution when devices switch networks. When admins switch devices to a new network, Systems Manager will identify and remove all profiles associated with the old network. 

 

Furthermore, on most devices that have already switched networks, this change should also retroactively resolve profile assignment on the next profile sync. Profile syncs are scheduled to automatically run on all devices at least once daily, but can be initiated manually for a given device by clicking the “Refresh Details” button at the top of the device’s details page.  Please let us know if you see any problems in this area of the product related to this change.

 
 

refresh.jpg

View solution in original post

vassallon
Head in the Cloud

This is great news, I am going to test this right now and see if it is working.

Found this helpful? Give me some Kudos! (click on the little up-arrow below)
vassallon
Head in the Cloud

@Kevin_C and @Noah_Salzman 

 

Thank you so much for listening to my venting and getting this resolved. It is GREATLY APPRECIATED.

 

I can confirm that the functionality is back in place and my school district's students iPads are now getting the correct profiles and removing the old profiles as expected.

Found this helpful? Give me some Kudos! (click on the little up-arrow below)
Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels