iPad unreachable after Apple Configurator enrollment and Scan Device delay in HexnodeSolved

Hi @jaxon_r ,

For this type of iPad enrollment issue, there are a few separate checks to consider:

1. Verify the APNs certificate
If the APNs certificate is expired, iOS devices cannot reliably receive MDM push notifications from Hexnode UEM. Renewing the APNs certificate is the correct first step. After renewal, initiate Scan Device again and allow a few minutes for the device to check in.

2. Confirm Apple Business sync
Go to Admin > Apple Business/School Manager > Automated Device Enrollment > Accounts and confirm that the sync status is Success.

3. Confirm ADE profile assignment
Go to Admin > Apple Business/School Manager > Automated Device Enrollment > Devices, search for the device, and confirm that the ADE profile status is Assigned.

If the APNs certificate is valid, Apple Business sync is successful, and the ADE profile is assigned, the timeout during setup is often temporary. The device may need some time to complete activation and contact Apple’s servers before it downloads the remote management configuration successfully.

Regarding MDM profile removal: when a device is manually added to Apple Business using Apple Configurator, Apple enforces a 30-day provisional period. During this period, the user may see an option such as “Leave Remote Management,” which allows them to remove the MDM profile and release the device from the organization. After 30 days, that option disappears and the device becomes permanently associated with the organization in Apple Business.

Regards,
Isabel Lora
Hexnode UEM

That explains the profile removal part. I was wondering why the iPad still had the option to leave remote management even though it was already assigned through ABM. So there is no Hexnode setting to hide that during the first 30 days?

Correct. The 30-day provisional period is enforced by Apple for devices manually added to Apple Business Manager through Apple Configurator. It cannot be disabled from Hexnode.

This behavior is designed to prevent unauthorized ownership claims over devices. Once the 30-day period is completed, the user will no longer be able to remove the device from remote management using that option.

I’ve seen the Last Seen timestamp lag a bit right after enrollment too. The device looked online, but the portal didn’t update instantly. Running Scan Device again after a few minutes usually caught it up.

Yes @felixfrost , that behavior can happen even when the iPad is online.

Hexnode sends an MDM command or push notification to the device, but iOS controls when the command is processed. If the device OS is busy with activation, setup tasks, app installation, policy application, or other background processes, MDM commands can be queued on the device side.

Once iOS finishes the higher-priority background tasks, it processes the queued MDM command, checks in with Hexnode, and updates the Last Seen status in the portal. A short delay in Last Seen does not always mean the device is disconnected, especially immediately after enrollment or APNs renewal.

Regards,
Isabel Lora
Hexnode UEM