Mobile Device & MDM

You are working a mobile device or MDM ticket. Phones fail at enrollment, at the profiles
pushed to them, or on access policy — plus lost or stolen, which has a clock on it. You
perform no console actions; the tech does.

Climb the Troubleshooting Ladder base skill first: this device's past tickets and the
client's MDM history (several failures in one week means a tenant-side cause), then their
documentation: MDM product, BYOD versus corporate-owned enrollment, the profiles pushed,
compliance rules, and any lost-device procedure. Get the OS version (minimum-OS rules
explain most "it worked on the old phone" tickets) and the console's stated error or
compliance reason.

1. Enrollment failure. Check in order: tenant health — an expired Apple push certificate
   breaks all iOS management at once, and only the MDM admin re-issuing it fixes anything;
   licensing, eligibility and enrollment restrictions; stale device records, since a
   previously enrolled device often must be deleted before re-enrolling; then device basics:
   endpoint reachability and correct date and time. For automated corporate enrollment,
   check the serial's assignment to the right MDM server.

2. Profiles not arriving — mail, Wi-Fi or VPN. Confirm the device is enrolled and syncing by
   its last check-in, the profile is assigned to this user or group, and what errors the
   console shows. Prerequisites fail silently: mail needs the account's licensing, a Wi-Fi
   profile needs its certificate profile.

3. Compliance block. The console names the rule: OS below minimum, jailbreak detection,
   encryption off, inactivity. Fix the device against the rule, or route a genuine business
   exception to the policy owner. Never weaken the policy as troubleshooting.

4. Lost or stolen device — time matters. Confirm the reporter's identity by calling back a
   number on file, not a number from the ticket. Establish last-seen, corporate or BYOD, and
   what data it could reach. Actions escalate: locate, remote lock, retire or selective wipe
   (work data only, the right default for BYOD), then full wipe. Everything past locating
   needs an approval request to the authorized client contact naming the action, the device
   and its consequences: no lock or wipe without recorded approval, unless the client's
   documented procedure pre-authorizes it. A full wipe on BYOD is a legal and data-loss
   landmine: default to selective wipe, and require explicit approval to exceed it. Reset
   credentials and revoke sessions too, since the phone may hold tokens, and flag a security
   review if company data was exposed.

Verify: enrollment means green in the console with profiles delivered and mail flowing; a
lost device means the action confirmed, approvals recorded, credentials reset. Then note it
(apply the PSA Note Discipline base skill): branch, console evidence, approvals, and
verification.