iOS ADE migration: MDM profile still removable after email enrollmentSolved

Participant
Discussion
1 week ago Jul 27, 2026

We’re moving company-owned iPhones from another MDM to Hexnode using Apple Business. The devices are assigned to the Hexnode MDM server, then unenrolled from the old MDM, and enrolled into Hexnode using an email invitation with directory authentication.

The issue is that users can still remove the MDM profile from the iPhone, even though our Automated Device Enrollment profiles have “Allow MDM profile removal” unchecked. These devices need to be supervised, and we expected the Apple Business reassignment to apply the ADE restrictions without wiping the device.

Does a direct MDM server change in Apple Business still require a factory reset for supervision and non-removable MDM profile settings to take effect?

Replies (1)

Marked SolutionPending Review
Hexnode Expert
7 days ago Jul 27, 2026
Marked SolutionPending Review

Hello @ren_ben ,

Yes. For iPhones to enroll through Automated Device Enrollment and receive supervision-based restrictions, a factory reset is required after assigning the device to the Hexnode MDM server in Apple Business.

Changing the MDM server assignment in Apple Business updates the device assignment on Apple’s side, but the iPhone does not automatically re-run the ADE enrollment flow while it is already set up. The device must go through the iOS Setup Assistant again to contact Apple Activation Servers, identify the assigned MDM server, and download the ADE enrollment profile.

In the workflow described, enrolling through an email invitation bypasses ADE and performs a standard enrollment instead. As a result:

  • The device will not become supervised through ADE.
  • The ADE enrollment profile settings will not be applied.
  • The “Allow MDM profile removal” restriction from the ADE profile will not take effect.
  • The MDM profile may remain removable by the user.

To enforce supervision and prevent MDM profile removal, wipe the iPhone after assigning it to the Hexnode MDM server in Apple Business Manager, then complete enrollment using the Hexnode ADE profile.

Regards,
Simon Scott
Hexnode UEM

Save