Prevent iOS devices from being unenrolled by users in HexnodeSolved

To make the MDM profile non-removable on iOS or iPadOS, the device must be enrolled as a supervised device through Apple Business Manager or Apple School Manager.

This is controlled by Apple’s management framework, so it cannot be enforced only through a Hexnode policy if the device was manually enrolled. For example, if the device was enrolled using Safari, an enrollment URL, or a standard manual enrollment flow, the user can remove the MDM profile from the device settings.

For the MDM profile to be non-removable:

1. Add the device to Apple Business Manager or Apple School Manager.
2. Assign the device to the Hexnode MDM server in ABM/ASM.
3. Enroll the device through Automated Device Enrollment.
4. Ensure the enrollment profile is configured for supervision and management. Once enrolled this way, users will not be able to remove the management profile from the device.

If I’m using Apple Configurator to prepare the device, do I need to select the option that adds the device to Apple Business Manager?

Yes. If the device is not already present in Apple Business Manager, you should select the option in Apple Configurator to add it to Apple Business Manager.

One important detail: devices added to ABM using Apple Configurator go through Apple’s 30-day provisional period. During this period, the user can still remove the device from management, even though the device is supervised.

After the 30-day provisional period ends, the user will no longer be able to remove the management profile.

If the device was already in Apple Business Manager or Apple School Manager before enrollment, this 30-day provisional period does not apply, and the MDM profile is non-removable immediately after Automated Device Enrollment.