Expired APNs certificate: macOS devices stuck on “disenrollment initiated”Solved

Yes @ruthg_

If the APNs certificate has already expired, Hexnode cannot deliver remote MDM commands to Apple devices through APNs. This includes remote disenrollment commands.

In this state, devices may remain in “disenrollment initiated” in the portal because the command cannot reach the device. Removing the old APNs certificate from the portal lets you configure a new APNs certificate, but it does not remove the old MDM profile from the device itself.

For devices you can access physically or through the end user, remove the old MDM profile manually first:

System Settings > Profiles, then remove the old MDM profile.

After the old profile is removed, enroll the device again using the new enrollment link or QR code associated with the new APNs certificate.

Regards,
Isabel Lora
Hexnode UEM

What about a Mac that is with an employee who is away for a few weeks? Can I just delete it from the Hexnode console and enroll it again later?

You can clean up the device entry in the Hexnode portal by marking the device as disenrolled:

Manage > Devices > select the device > Actions > Mark device as disenrolled

This only updates the device status in the portal. Since the APNs certificate is expired, Hexnode still cannot send a command to the Mac to remove the MDM profile from the device. The old profile will remain installed on the Mac until the user manually removes it.

When the device becomes available again, the user should remove the old MDM profile from System Settings > Profiles and then enroll again using the new enrollment link.

Regards,
Isabel Lora
Hexnode UEM

What if the device is marked as disenrolled in the portal but the old profile is still on the Mac, can the user install the new enrollment profile anyway?

No. Apple allows only one active MDM profile on a macOS device at a time.

If the old MDM profile is still installed and the user tries to install the new enrollment profile, the installation will fail because an MDM payload is already present on the device.

The correct order is:

1. Remove the old MDM profile from the device.
2. Install the new enrollment profile.
3. Complete enrollment under the new APNs certificate.

For devices enrolled through Apple Business or Automated Device Enrollment, a factory reset will remove the old profile and apply the assigned MDM profile again during the device setup process.

Regards,
Isabel Lora
Hexnode UEM