When MDM on a managed device becomes unresponsive, it's rarely obvious why from the UI alone. Addigy tracks the health of the Apple MDM client and the native macOS processes involved, giving you specific facts you can use to identify why a device's MDM connection may be broken — and what to do about it.
Overview
The sections below cover the facts that help identify the most common causes of MDM connectivity issues, and the remediation steps for each. This isn't an exhaustive list of every possible cause, but it covers the areas responsible for most cases where MDM connectivity breaks down.
How to Identify MDM Health Issues
MDM Last Connected
The MDM Last Connected fact shows the last time a device connected to or responded from the MDM server. It complements the Is MDM Client Stuck fact by giving you a specific date/time for the device's last connection.
Is MDM Client Stuck
The Is MDM Client Stuck fact reports every 30 minutes, giving you an up-to-date status of whether the device's MDM client is stuck.
MDM Identity Certificate Installed
The MDM Identity Certificate Installed fact shows whether a device has lost its MDM Identity Certificate — the certificate Apple's MDM protocol requires to establish a trusted connection. This certificate (or the keychain it lives in) is known to go missing, most often due to Migration Assistant or direct modification of the keychain.
Is MDM Software Update Stuck
The Is MDM Software Update Stuck fact identifies whether the last MDM command sent to a device was a software update command (for example, AvailableOSUpdates or ScheduleOSUpdateScan). A device must be in this state for at least 90 minutes before it's flagged as stuck.
How to Remediate MDM Health Issues
Remediation: MDM Client Stuck
For devices showing as Is MDM Client Stuck, first cross-reference them against MDM Identity Certificate Installed to confirm they have a valid Identity Certificate. Then run these two community scripts to kickstart and flush the relevant processes:
Copy the scripts from the Community, identify the affected devices using the facts above, and send the scripts to those devices.
Remediation: Missing Identity Certificate
If MDM Identity Certificate Installed shows as missing, the device's keychain was most likely modified or corrupted — during a migration, tampering, or similar — and the MDM Identity Certificate is gone.
- Confirm you're acting as an Administrator.
- Confirm the device is Automated Device Enrollment (ADE) eligible or ADE enrolled.
- From a terminal in an interactive user session, run:
sudo profiles renew -type enrollment - Click the notification that appears to open the Profiles pane and complete the enrollment update.
Automating Remediations
Automate these remediations carefully — an automated fix that fires during an important process can cause more disruption than the original issue. Addigy is still working on using this data to automatically identify the best time to cycle these processes based on existing conditions.
Note: Devices with a missing MDM Identity Certificate are not healed automatically by this mechanism.
If you want to automate remediation now, run the relevant scripts in a Maintenance Job on a cadence that matches your update schedule (for example, daily, weekly, or monthly).