iPhones will not apply Profiles or complete commands

[ekour1]

I have multiple iPhones that, when I apply a profile, nothing seems to happen on the device. In MDM, the profile list does not update or change.

I can see in the Activity log pending commands but, however long I wait, they never complete. I can only cancel them.

I recently renewed the MDM Push Ceritificate, the ADE token and the VPP token.

[alemabrahao]

Maybe this will help you with troubleshooting.

https://documentation.meraki.com/SM/Profiles_and_Settings/Managed_device_does_not_receive_deployed_a...

[ConnorL]

Mind dropping me a DM with a link to the specific device? There can be several reasons as to why this is happening:

• APNS is expired/invalid
• Profile isn't valid for the device (e.g. it's a BYOD device and the profile requires supervision)
• The device simply isn't syncing with Dashboard due to it being offline or connected to a network performing SSL inspection or content filtering
• iOS issue, try a reboot etc

[BlakeRichardson]

Are the devices recently enrolled in Systems manager or have they been enrolled for a while and just stopped working? 

You mentioned you renewed your APNS cert, had it expired before you renewed it? If so you will need to re-enroll your devices, once a push notification certificate expires the MDM can no longer communicate with any of the enrolled devices. 

[ekour1]

The APNS expired before I renewed it. I tried reenrolling another iPhone with Apple Configurator and it worked.

Is there a way to not reenroll the devices? I don't want to erase all of them.

[BlakeRichardson]

@ekour1 ok the expiring cert is the reason. There is no way to fully enrol iOS devices without erasing them. You could try going to m.meraki.com and entering in your MDM code found in Systems Manager > Manage > Add devices  IOS but that will only give you limited management if it works. 

[ConnorL · Accepted solution]

@ekour1 and I spoke off-thread.

It was due to a new APNS token being applied to Dashboard rather than the existing one being renewed, once this has been reverted and the correct token renewed, MDM communications should start working again without requiring a re-enrollment.