Overview: Using the 'sudo profiles renew -type enrollment" Command – Addigy

The sudo profiles renew -type enrollment command refreshes the MDM status of a Mac that was enrolled through Automated Device Enrollment (ADE). It's the tool you reach for when a Mac needs to pick up changed enrollment settings, repair a broken MDM connection, or complete an enrollment it missed during Setup Assistant. Apple documents the command in its deployment guide.

Overview

The command being covered is:

sudo profiles renew -type enrollment

There is also a shorter equivalent:

sudo profiles -N

What it does: Prompts the Mac to re-check its ADE assignment in Apple Business Manager or Apple School Manager and re-apply the MDM enrollment profile.
Who it's for: Administrators and technicians who have hands-on access to a Mac, or who can walk an end user through running it.
Key benefit: Recovers enrollment state without wiping the device, and applies updated ADE settings to a Mac that is already deployed.

Note: This command runs locally on the Mac and requires manual interaction on the device. It cannot be completed silently or entirely remotely.

Requirements

All of the following must be true for the command to succeed:

The device must be running macOS.
The device must be tied to an MDM server in Apple Business Manager or Apple School Manager.
The command must be executed as the first admin user created on the device.
Someone must be present at the device to approve the resulting prompt.

When the Command Does Not Work

If the command returns an error or nothing happens, check these conditions first:

Mismatched push certificates. The device is attempting to install a different push certificate than the one currently installed. For example, the device is enrolled in Policy A but assigned to an MDM server tied to Policy B, and the two policies use different push certificates.
Expired push certificate. The policy that the device's MDM server is tied to is using an expired push certificate.
Broken SecureToken. SecureToken is broken on the user account running the command.

How to Run the Command

Run these steps directly on the affected Mac, signed in as the first admin user created on the device.

Open the Terminal app. Press CMD+Space and search for it, or navigate to Applications > Utilities and open it from there.
Type the command and press Return. Enter your password when prompted.
What happens next depends on the macOS version:
- macOS 14 and later: A full-screen prompt appears. Select Enroll and enter admin credentials.
- macOS 13 and earlier: A notification from System Settings or System Preferences appears. You may need to expand Notification Center to see it.
  
  Click the notification to open the Profiles pane. If it does not open, open System Settings or System Preferences and search for Profiles. Double-click the MDM enrollment profile, select Install, and enter admin credentials.

Once the profile is approved, the Mac re-establishes its MDM enrollment and reports back to Addigy.

Common Use Cases

Modifying the ADE settings on a device

This use case requires an active MDM push certificate.

Say you enforce non-removable MDM so end users cannot remove management from their devices. Normally you remove MDM using the Delete Devices tool. If that isn't working, the MDM profiles otherwise have to be removed manually or the device has to be wiped.

Instead, use this command to apply a changed ADE setting:

Navigate to Policies > (your policy) > Settings > Automated Device Enrollment.
Change the relevant option, then save your changes.
Run the profiles renew command on the device.

MDM will now be removable on that device.

Note: This workflow is especially useful for devices that need to migrate to a different push certificate. For more on that process, see FAQ: My Push Certificate Expired.

Device is not responding to MDM

Macs can run into problems with the MDM Identity certificate, which is required for MDM communication. The profiles renew command reinstalls this certificate. See FAQ: Troubleshooting MDM Connectivity in Addigy for how to confirm this is the cause, including checking whether the MDM Identity Certificate Installed device fact is reporting false.

Device skipped or did not receive the Remote Management screen during Setup Assistant

The Remote Management screen is what performs the ADE process during setup. In cases where a device did not display it, this command has been seen to enroll the device successfully after the fact.

Frequently Asked Questions

Can I run this remotely through Addigy?

No. The command requires manual interaction locally on the device to approve the enrollment prompt.

Does it matter which user account I run it from?

Yes. The command must be executed as the first admin user created on the device.

What's the difference between the long and short forms?

They are equivalent. sudo profiles -N is a shorter way to write sudo profiles renew -type enrollment.

The command ran but nothing appeared on screen. What now?

On macOS 13 and earlier, the prompt arrives as a notification that can be easy to miss. Expand Notification Center, or open System Settings or System Preferences and search for Profiles to find the pending MDM enrollment profile.

Will this work on a device that was not enrolled through ADE?

No. The device must be tied to an MDM server in Apple Business Manager or Apple School Manager.