Occasionally, users may be prompted to update the enrollment of an MDM-enrolled device. This generally happens when MDM is no longer communicating properly and the automatic renewal process can't complete on its own.
Note: In most cases, users should never be prompted to update Addigy/MDM certificates — this should happen automatically.
Identification
This issue typically shows up when a device's Is MDM Client Stuck fact reports as true, which generally means the device's MDM connectivity has an underlying issue or the process isn't responding properly. See Monitoring MDM Health for more on identifying this.
When a device's MDM is stuck, its certificates may fail to renew automatically as their expiration date approaches.
How to Remediate
- First, try the Install MDM tool on the Devices page.
- If that doesn't resolve the issue, MDM needs to be removed and reinstalled on the affected device(s):
- To remove MDM from a device without removing the device from Addigy, follow Removing a Device From Addigy.
- To approve the MDM installation once it's removed, follow How To: Manually Enroll macOS into Addigy's MDM.
Frequently Asked Questions
What happens if the certificate expires — can I still renew it?
Yes. Even after certificates expire and become unverified, they can still be renewed using the workflows above. See Addigy MDM SSL Certificate Profile Signing Renewal for more detail.
How do I know if the certificate has been properly renewed?
Check the certificate renewal date on the device's GoLive > Security page. If it still looks out of date, the device's information may not have refreshed yet — try the Refresh Data button on the GoLive page, or run the agent's audit command.