iPad policies not applying in Hexnode: APNs, supervision, and compliance syncSolved

Hello,

Thank you for reaching out to Hexnode Connect!

To answer your last question first: policy enforcement on iOS and iPadOS is handled natively by Apple’s MDM framework via configuration profiles. The Hexnode UEM app does not enforce system-level restrictions; it is primarily used for end-user features like the App Catalog, remote view permissions, and location tracking.

Based on your description, here is why you experienced those specific roadblocks:

1. APNs Mismatch: If your APNs certificates didn’t match, it usually means a new certificate was generated instead of renewing the original one. The renewed certificate must match the exact UID/Topic in Hexnode. Once the correct one is uploaded, the MDM communication channel is restored.
2. Supervision Requirement: A retail iPad enrolled manually or just via the app is unsupervised by default. Apple strictly prevents MDMs from enforcing advanced restrictions—like wallpaper configurations and app blocklists—on unsupervised devices. Supervising the iPad (via Apple Business Manager/ADE or Apple Configurator) is mandatory for those specific policies to apply.

Best regards,
George
Hexnode UEM.

That makes a lot of sense regarding supervision and the APNs mismatch, thank you!

I did notice one other issue: the compliance status seems to lag behind. For example, my app report showed that the blocked apps were successfully removed from the iPad, but the main compliance page still flagged the device as non-compliant for missing required apps for quite a while. Why does this happen, and how can I force the portal to update?

Hello,

Thank you for reaching out to Hexnode Connect!

That lag occurs because iOS processes MDM commands, app inventory updates, and compliance reporting asynchronously. Hexnode sends the command through the MDM channel, but iOS executes it and reports the updated state back on its own schedule.

If you know the device has already reached the expected state locally (e.g., apps installed or blocked apps removed) but the portal still shows it as non-compliant, you can force an update using these manual sync actions:

• Scan Device: Refreshes general device details and policy association status.
• Scan for Apps: Specifically refreshes the installed app inventory and app compliance status.

For future deployments, your ideal sequence should be: renew VPP and APNs (ensuring the UID matches), supervise the iPad, associate your policy, and finally run the Scan Device and Scan for Apps actions to instantly sync the compliance state.

Best regards,
George
Hexnode UEM.