MDM profile

How it works

The term is Apple's. On iOS, iPadOS and macOS, a configuration profile is an XML file (.mobileconfig) made of payloads: one for Wi-Fi, one for a passcode rule, one for restrictions, one for a VPN. The MDM payload is special. It contains the server URL, the push topic and the access rights the server is granted, and installing it is what enrollment means on an Apple device.

How that profile arrives changes everything. Installed by hand from Settings, it can be removed by the user from the same screen, and the device drops out of management when they do. Installed through Automated Device Enrollment during Setup Assistant, the profile is non-removable, the device is supervised, and a factory reset just reinstalls it because the assignment lives in Apple Business Manager.

Android doesn't use the word. The equivalent is the policy applied by the device policy controller, whether Android Device Policy in a work profile or on a fully managed device. Windows talks about enrollment through the MDM CSP and receives settings as SyncML. Admins still say "MDM profile" for all of them, which is why this page exists.

Since iOS 15, Apple has been moving settings to Declarative Device Management, where the device holds declarations and reports changes itself instead of waiting for the server to poll. The profile is still the enrollment anchor; what travels inside it is changing.

Why it matters for a fleet

Two consequences follow from how the profile was installed. The first is removability. A field team that can delete the profile will do so the day an app annoys them, and you'll find out at the next audit. The second is supervision: single-app mode, silent app installs, Activation Lock bypass and web content filtering only work on a supervised device, and supervision without a USB cable only comes with ADE.

Profiles also expire. Certificates inside them have validity dates, and a Wi-Fi profile with an expired root certificate is a very quiet way to disconnect 200 tablets on a Monday morning.

How Appaloosa handles it

Appaloosa installs its MDM profile through Automated Device Enrollment when devices are assigned to it in Apple Business Manager, which makes the profile non-removable and the device supervised from first boot. Devices bought outside that channel enroll through a link or QR code with a removable profile, and personal iPhones under BYOD get only the work apps and accounts Appaloosa deploys. Restrictions, Wi-Fi, certificates and compliance rules are then pushed per device group from the console described on the mobile device management page.