Fix Return to Service Disabled but Still Showing

Executive Summary

Some ADE-enrolled iOS and iPadOS devices may show Return to Service behavior while checking for software updates, even when the Return to Service option appears disabled in the ADE Enrollment Profile. In this case, restarting the device or re-saving the existing ADE profile may not clear the behavior.

Before remediation, admins should confirm whether Return to Service is actually active on the device. If the active MDM profile includes the ReturnToServiceEnabled key, the software update behavior may be linked to an active Return to Service configuration. If the key is missing and the ADE profile setting is unchecked, the issue may be tied to the assigned ADE profile state, especially when the device is using the Default ADE profile.

The recommended remediation is to create a brand-new ADE Enrollment Profile, keep Return to Service disabled, assign the affected ADE devices to the new profile, then wipe and re-enroll them through Automated Device Enrollment.

Why Return to Service can affect iOS update checks

Return to Service is designed to prepare a managed iPhone or iPad for reuse. When Return to Service with app preservation is active, software updates may be disabled because the device can restore a preserved system state during the Return to Service workflow.

This means the first step is to determine whether Return to Service is truly active on the device or whether the device is incorrectly showing Return to Service behavior even though the ADE profile setting is disabled.

This table explains how to interpret Return to Service behavior when an ADE-enrolled iPhone or iPad cannot check for software updates.

Symptoms on ADE-enrolled iPhones and iPads

• The device enters or displays Return to Service mode while checking for iOS or iPadOS updates.
• The device cannot check for software updates.
• The ADE Enrollment Profile has the Return to Service option unchecked.
• The active configuration profile on the device does not show the ReturnToServiceEnabled key.
• The device may be assigned to the Default ADE profile.
• The affected device may have been added to Apple Business using Apple Configurator and then assigned an ADE profile in Hexnode.

Prerequisites and cautions before remediation

Note: The remediation requires wiping and re-enrolling the affected iPhone or iPad. Ensure that required data is backed up and that the device can complete Automated Device Enrollment again after the wipe.

• Access to the Hexnode UEM portal with permission to manage Apple Business or Apple School Manager Enrollment Profiles.
• Access to ADE device assignment through Hexnode UEM.
• The affected iPhone or iPad must be available for wipe and re-enrollment.
• The device should be assigned to the correct Apple Business or Apple School Manager server token in Hexnode.
• The new Enrollment Profile should be created before wiping the affected device.

Verify whether Return to Service is active on the device

Before creating a new ADE Enrollment Profile, verify whether the active profile on the device includes Return to Service configuration.

1. In the Hexnode UEM portal, review the ADE Enrollment Profile assigned to the affected device.
2. Confirm that the Return to Service option is unchecked in the assigned ADE Enrollment Profile.
   

   
   
   

3. On the affected iPhone or iPad, go to Settings > General > VPN & Device Management.
4. Open the active MDM profile.
5. Check the active configuration profile restrictions for the ReturnToServiceEnabled key or any active Return to Service-related restriction.
6. If ReturnToServiceEnabled is present, review the Return to Service configuration before proceeding.
7. If ReturnToServiceEnabled is not present and the ADE profile has Return to Service unchecked, continue with the remediation below.

Resolve the issue by creating a new ADE Enrollment Profile

If the device still shows Return to Service behavior even though the setting is unchecked and the ReturnToServiceEnabled key is not present, create a new ADE Enrollment Profile and re-enroll the device.

1. In the Hexnode UEM portal, go to Admin > Apple Business/Apple School Manager > Automated Device Enrollment > Enrollment Profiles.
2. Create a brand-new Enrollment Profile with the required Automated Device Enrollment settings.
3. Keep the Return to Service option unchecked in the new profile.
4. Assign the affected ADE devices to the newly created Enrollment Profile.
5. Confirm that the affected devices are no longer assigned to the Default ADE profile.
6. Wipe the affected iPhone or iPad.
7. Complete Automated Device Enrollment again using the newly assigned Enrollment Profile.
8. After enrollment completes, check for iOS or iPadOS updates again.
9. Confirm that the device no longer enters or displays Return to Service mode during the software update check.

Important: Re-saving the existing ADE Enrollment Profile or restarting the device may not clear this behavior. The affected device must be assigned to the newly created Enrollment Profile and then wiped and re-enrolled.

If the device still shows Return to Service mode

• Confirm that the affected device is assigned to the newly created Enrollment Profile and not the Default ADE profile.
• Confirm that the device was wiped and re-enrolled after changing the Enrollment Profile assignment.
• Confirm that no other ADE Enrollment Profile is assigned to the device.
• Recheck the active MDM profile on the device for the ReturnToServiceEnabled key or any active Return to Service-related restriction.
• Confirm that the device is assigned under the correct Apple Business or Apple School Manager token.
• Export the device details from Manage > select the affected device > Actions > Others > Export Device Details.
• Contact Hexnode Support with the exported device details if the behavior persists.

Remediation summary

This table summarizes the verification and remediation steps for ADE-enrolled devices that show Return to Service mode during software update checks.