RemoveProfile command not working in iOS MDM protocol

Question

I'm trying to unenroll iOS devices that I enrolled using OTA enrollment described by Apple. But when I send a RemoveProfile command to a device targeting that MDM profile's identifier, I get an error saying "The profile “xxxxxxxxx” is not managed by MDM". This is necessary for me to achieve unenroll OTA. Please help. Thanks in advance... This is the configuration profile installed in my devices:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>ConsentText</key>
    <dict>
        <key>default</key>
        <string>Espere mientras se instala el perfil</string>
    </dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadContent</key>
            <dict>
                <key>Challenge</key>
                <string>594EA2E1A5D1C883EF3BA2EA3B36A670</string>
                <key>Key Type</key>
                <string>RSA</string>
                <key>Key Usage</key>
                <integer>0</integer>
                <key>Keysize</key>
                <integer>2048</integer>
                <key>Name</key>
                <string>MDM-MYCANAME-CA</string>
                <key>Retries</key>
                <integer>3</integer>
                <key>RetryDelay</key>
                <integer>10</integer>
                <key>Subject</key>
                <array>
                    <array>
                        <array>
                            <string>O</string>
                            <string>MyCompany</string>
                        </array>
                    </array>
                    <array>
                        <array>
                            <string>CN</string>
                            <string>1</string>
                        </array>
                    </array>
                </array>
                <key>URL</key>
            <string>https://myWindowsServerCA/certsrv/mscep/mscep.dll</string>
        </dict>
        <key>PayloadDescription</key>
        <string>Configures SCEP</string>
        <key>PayloadDisplayName</key>
        <string>SCEP (MDM-MYCOMPANY-CA)</string>
        <key>PayloadIdentifier</key>
        <string>com.mycompany.SCEP.scep1</string>
        <key>PayloadOrganization</key>
        <string>My Company Name</string>
        <key>PayloadType</key>
        <string>com.apple.security.scep</string>
        <key>PayloadUUID</key>
        <string>B4FAD671-FD52-48CD-B342-5EE557055CAC</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
    </dict>
    <dict>
        <key>AccessRights</key>
        <integer>8191</integer>
        <key>CheckInURL</key>
        <string>https://mycheckinurl.com/WS/Mobile/iOSEnrollmentHandler.ashx?ec=1000156</string>
        <key>CheckOutWhenRemoved</key>
        <true/>
        <key>IdentityCertificateUUID</key>
        <string>B4FAD671-FD52-48C‚eD-B342-5EE557055CAC</string>
        <key>PayloadDescription</key>
        <string>Configures MobileDeviceManagement.</string>
        <key>PayloadIdentifier</key>
        <string>com.mycompany.AMDM.mdm1</string>
        <key>PayloadOrganization</key>
        <string>My Company Name</string>
        <key>PayloadType</key>
        <string>com.apple.mdm</string>
        <key>PayloadUUID</key>
        <string>5274CA69-3F9F-4E3D-A601-761E304AA84F</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>ServerURL</key>
        <string>https://myserverurl/WS/Mobile/iOSCommandHandler.ashx?ec=1000156</string>
        <key>SignMessage</key>
        <true/>
        <key>Topic</key>
        <string>com.apple.mgmt.External.8be7fb6b-321e-4c77-ac24-2055c8519fe4</string>
        <key>UseDevelopmentAPNS</key>
        <false/>
    </dict>
</array>
<key>PayloadDescription</key>
<string>Perfil MDM para control de dispositivos</string>
<key>PayloadDisplayName</key>
<string>MYCOMPANYMDM</string>
<key>PayloadIdentifier</key>
<string>com.mycompany.AMDM</string>
<key>PayloadOrganization</key>
<string>My company name</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>30232328-7BF6-4A37-9642-D07F50BFF28F</string>
<key>PayloadVersion</key>
<integer>1</integer>

Victor Ronin Victor Ronin · Accepted Answer · 2013-11-07T15:23:37

This is correct behavior. You initial profile isn't installed through MDM. It's installed through OTA.

If you want to unenroll a device, you should return error 401 (Unauthorized) when the device will checkin to the server to get next command.

RemoveProfile command not working in iOS MDM protocol

1 Answers