When attempting to install an MDM enrollment profile on a device with an existing profile, the following error may appear if the push certificate used in the new profile does not match the current one:
To install an enrollment profile with a different push certificate, the current profile will need to be removed from the device. This will unenroll the device from MDM, until it is re-enrolled using the new profile.