iOS MDM profile downloads but installation failsSolved

Hello @margaret ,

Since you have already verified the network, date/time, and ensured there are no conflicting profiles, the issue is likely isolated to a hidden iOS enrollment state on that specific device failing the Device Enrollment Challenge. Disabling Stolen Device Protection helps rule out security prompt delays, but it generally will not fix a core payload rejection like this.

To isolate and resolve this device-specific error, try these next steps:

• Temporarily set your enrollment settings to require no authentication. This rules out any underlying credential or user-assignment conflicts causing the failure..
• If the device is expected to use Automated Device Enrollment, confirm that it is present in Apple Business and assigned to the Hexnode MDM server.
• If possible, erase the iPhone and attempt a fresh enrollment. A factory reset can clear local iOS enrollment state that is not visible under VPN & Device Management.

If wiping the device is not practical, swapping to another device is a valid workaround. To fix that specific iPhone without wiping it, a deeper investigation would require capturing device-side diagnostic logs via Apple Configurator while reproducing the failure.

Regards,
Simon Scott
Hexnode UEM

We ended up using another iPhone for the user because wiping the active device was not an option. The replacement enrolled normally, so this does look isolated to that particular device.