A device that shows up offline while someone is clearly using it has an enrolment problem, not a connectivity one. This article explains what each enrolment status means, what causes it, and what to do about it.
Feature/Functionality
Overview
Enrolment problems fall into two groups, and they need different answers.
The enrolment never finished. The device is partially enrolled: management was started but never completed, so none of your policies apply. Usual causes:
- The employee stopped part-way through the steps.
- The Fleet agent installed incompletely — this happens mostly on macOS.
- The device went offline before the first synchronisation finished.
- The employee, or a script, removed or blocked the agent or the management profile.
The enrolment finished and then broke. The device was managed and no longer is. See the two sections below.
What the statuses mean
| Status | What it tells you |
|---|---|
| On | Fully enrolled, agent reporting normally |
| Off | Not enrolled, or management is inactive |
| Missing agent ⚠️ | The agent has stopped talking to the server |
| On in another MDM ⚠️ | A different MDM owns the device |
| Ready for ZTD | Registered for zero touch, waiting for first boot |
Two ways to spot a device in trouble: its status is one of the warning states above, or it reads as offline while an employee is actively working on it.
Why the agent goes missing
The agent is installed but has stopped reporting. Four families of cause:
- It was removed or damaged. Someone uninstalled it, a script did, or an operating system update corrupted the installation.
-
It is installed but not running. The
osquerydservice has stopped, or the agent cannot start because of a permissions problem. - It cannot reach the server. The device sits behind a proxy or firewall that blocks the connection, or it has been off the network long enough to lose its session.
- Its certificate is no longer valid. An expired Apple Push Notification certificate is the common one.
Why the MDM profile goes missing (Macs only)
On macOS the profile itself can disappear:
- The employee removed it. On macOS anyone with admin rights on the machine can remove a profile that is not locked.
- It is no longer valid. If the Apple Push Notification token has expired or been revoked, the Mac cannot confirm its own profile.
- Management was turned off. Somebody ran the "turn off MDM" action against the device.
How to use
Fix each case
| Status | What to do |
|---|---|
| Missing agent | Open the device panel and click the status button to reinstall the agent remotely. If nothing happens, ask the employee to sign in to their enrolment page, select their device and download the agent themselves. |
| On in another MDM | Follow the migration procedure for the MDM that currently owns the device. You cannot take it over without releasing it there first. |
| Off (offline) | Ask the employee to enrol again, or let automatic unenrolment do it (below). |
Give it 30 minutes after the employee acts — that is the synchronisation window, so a device that has just been fixed will not update instantly.
Stop doing this by hand
Chasing each offline device individually does not scale. Go to MDM > Settings and, under Automatic unenrollment, choose how long a device can stay offline before it is unenrolled: 30, 60 or 90 days. Then turn on Invite the employee to re-enroll. Together they handle both halves: the device is unenrolled once it passes the delay, and the employee is invited to enrol again, with nothing for you to do in between.
Tips and Best Practices
- Treat "offline but in use" as the signal to investigate. It is almost never the network. It is a missing agent.
- Set an automatic unenrolment delay and the re-enrol invitation before your fleet grows, not after. It converts a recurring chase into something that resolves itself.
- Check the push notification certificate expiry date in your calendar. When it lapses, Macs across the whole fleet start failing at once, and the symptom looks like dozens of unrelated problems.
- Wait the full 30 minutes before escalating. Plenty of "it did not work" reports are just the synchronisation window.
- Lock the MDM profile on Macs where you can. An unlocked profile is one menu away from being removed by anyone with admin rights.
Troubleshooting and FAQ
Troubleshooting
- The remote reinstall does nothing. The agent is too broken to receive the command. Send the employee to their enrolment page to install it manually instead.
- The device reappeared and then went missing again. Look at the network before the device: a proxy or firewall rule that blocks the agent will keep producing the same result after every reinstall.
- A Mac lost its profile and the employee swears they did nothing. Check the push notification certificate. If it has expired, the profile became invalid on its own and the fix is at your end, not theirs.
- A device is stuck at "Ready for ZTD". Zero touch has not run yet. The status is correct — the device is registered and waiting for its first boot.
FAQ
-
How long should a fix take to show?
Up to 30 minutes. That is the synchronisation period.
-
What is the difference between "partially enrolled" and "missing agent"?
Partially enrolled means enrolment never finished. Missing agent means it finished and the agent has since stopped reporting.
-
Can we take over a device that is managed by another MDM?
Not directly. It has to be released from the other MDM first, following that product's migration procedure.
-
Does a device that is unenrolled automatically lose its data?
No. Unenrolment only removes it from management. The device and everything on it are untouched.