Overview
Enrolment problems fall into two groups, and they need different answers.
The enrolment never finished. The device is partially enrolled: management was started but never completed, so none of your policies apply. Usual causes:
- The employee stopped part-way through the steps.
- The Fleet agent installed incompletely — this happens mostly on macOS.
- The device went offline before the first synchronisation finished.
- Someone removed or blocked the agent or the MDM profile.
The enrolment finished and then broke. The device was managed and no longer is. See the two sections below.
What the statuses mean
Status |
What it tells you |
|---|---|
On |
Fully enrolled, agent reporting normally |
Off |
Not enrolled, or management is inactive |
Missing agent ⚠️ |
The agent has stopped talking to the server |
On in another MDM ⚠️ |
A different MDM owns the device |
Ready for ZTD |
Registered for zero touch, waiting for first boot |
Two ways to spot a device in trouble: its status is one of the warning states above, or it reads as offline while an employee is actively working on it.
Why the agent goes missing
The agent is installed but has stopped reporting. Four families of cause:
- It was removed or damaged. Someone uninstalled it, a script did, or an operating system update corrupted the installation.
- It is installed but not running. The osqueryd service has stopped, or the agent cannot start because of a permissions problem.
- It cannot reach the server. The device sits behind a proxy or firewall that blocks the connection, or it has been off the network long enough to lose its session.
- Its certificate is no longer valid. An expired Apple Push Notification certificate is the common one.
Why the MDM profile goes missing (Macs only)
On macOS the profile itself can disappear:
- An admin user removed it. macOS allows this whenever the profile is not locked.
- It is no longer valid. If the Apple Push Notification token has expired or been revoked, the Mac cannot confirm its own profile.
- Management was turned off. Somebody ran the "turn off MDM" action against the device.
How to use
Fix each case
Status |
What to do |
|---|---|
Missing agent |
Open the device panel and click the status button to reinstall the agent remotely. If nothing happens, ask the employee to sign in to their enrolment page, select their device and download the agent themselves. |
On in another MDM |
Follow the migration procedure for the MDM that currently owns the device. You cannot take it over without releasing it there first. |
Off (offline) |
Ask the employee to enrol again. |
Give it 30 minutes after the employee acts — that is the synchronisation window, so a device that has just been fixed will not update instantly.
Stop doing this by hand
Devices that stay offline long enough are purged, and chasing each one individually does not scale. Go to Settings > MDM, turn on Auto-Unenrolment, and switch on the option to resend the MDM invitation automatically to anyone whose device has been purged.
Tips and Best Practices
- Treat "offline but in use" as the signal to investigate. It is almost never the network. It is a missing agent.
- Turn on automatic re-invitations before your fleet grows, not after. It converts a recurring chase into something that resolves itself.
- Check the push notification certificate expiry date in your calendar. When it lapses, Macs across the whole fleet start failing at once, and the symptom looks like dozens of unrelated problems.
- Wait the full 30 minutes before escalating. Plenty of "it did not work" reports are just the synchronisation window.
- Lock the MDM profile on Macs where you can. An unlocked profile is one menu away from being removed by anyone with admin rights.
Troubleshooting and FAQ
Troubleshooting
- The remote reinstall does nothing. The agent is too broken to receive the command. Send the employee to their enrolment page to install it manually instead.
- The device reappeared and then went missing again. Look at the network before the device: a proxy or firewall rule that blocks the agent will keep producing the same result after every reinstall.
- A Mac lost its profile and the employee swears they did nothing. Check the push notification certificate. If it has expired, the profile became invalid on its own and the fix is at your end, not theirs.
- A device is stuck at "Ready for ZTD". Zero touch has not run yet. The status is correct — the device is registered and waiting for its first boot.
FAQ
-
How long should a fix take to show?
Up to 30 minutes. That is the synchronisation period.
-
What is the difference between "partially enrolled" and "missing agent"?
Partially enrolled means enrolment never finished. Missing agent means it finished and the agent has since stopped reporting.
-
Can we take over a device that is managed by another MDM?
Not directly. It has to be released from the other MDM first, following that product's migration procedure.
-
Does a purged device lose its data?
No. Purging only removes it from management. The device and everything on it are untouched.