Migration of enrolled devices that lost connection with their previous MDMSolved

Participant
Discussion
6 days ago May 01, 2026

Hi everyone, we are trying to migrate Macs to Hexnode via ABM. One device is stuck in a loop trying to remove the existing MDM profile. We tried re-enrolling, but no success so far. I got this error:

“An error occurred while enrolling computer: Permission Error – The user specified does not have permission to perform the action.
Device Signature Error – A valid device signature is required to perform the action.
Enroll return code: 70”

Has anyone handled migrations where the device can no longer communicate with the old MDM?

Replies (6)

Marked SolutionPending Review
Participant
6 days ago May 01, 2026
Marked SolutionPending Review

If the device can’t communicate with the previous MDM, anything that depends on server-side actions like automated profile removal will fail. That loop is expected behavior in such cases.

First thing I’d check is whether the existing MDM profile is removable from System Settings > Profiles. If it is, you can remove it manually and continue the migration. If it isn’t removable, you’ll need to take a different approach.

Marked SolutionPending Review
Participant
5 days ago May 02, 2026
Marked SolutionPending Review

If you’re migrating via Hexnode Gateway, there should be an option called “Remove device from existing MDM automatically”. If that’s enabled, it should attempt to trigger removal from the previous MDM during migration.

Marked SolutionPending Review
Participant
5 days ago May 02, 2026
Marked SolutionPending Review

Before going further, I’d still try sudo profiles renew -type enrollment. If the device is still properly assigned in ABM, this can re-trigger automated enrollment and re-establish communication with Hexnode. It’s not guaranteed, but it’s worth attempting before more disruptive steps.

Marked SolutionPending Review
Participant
4 days ago May 03, 2026
Marked SolutionPending Review

Thanks. If that doesn’t work, what would you recommend?

Marked SolutionPending Review
Participant
4 days ago May 03, 2026
Marked SolutionPending Review

If the profile is removable, go ahead and remove it manually and proceed with enrollment. If it isn’t removable and the device still can’t communicate with the previous MDM, then the most reliable option is a full device wipe and re-enrollment through ABM.

Marked SolutionPending Review
Participant
3 days ago May 04, 2026
Marked SolutionPending Review

Understood. This clarifies things a lot, thanks everyone!

Save