Resolve enrollment issues

​

Why this status?

​

During deployment

A device is considered partially enrolled when the enrollment process (or MDM deployment) has not been fully completed. As a result, the MDM is not yet active on the device. This can happen for several reasons:

• The employee did not complete all the enrollment steps.
• The Fleet agent installation is incomplete (mainly on macOS).
• The employee did not stay connected long enough to complete synchronization.
• The agent or MDM profile was uninstalled or blocked.

​

When the device is already enrolled

Here are the different possible scenarios:

​

Missing or inactive agent

This status indicates that the Fleet agent installed on the device is no longer sending data to Fleet. Possible causes:

• The agent was uninstalled or corrupted
  • The employee or a script manually removed the agent.
  • A system update or configuration error corrupted the installation.
• The agent is no longer running
  • The osqueryd service (used by Fleet) has stopped.
  • The agent fails to start due to permission issues.
• Network or connectivity issues
  • The device is on a network that blocks access to the Fleet server.
  • The device has been offline for too long, preventing the agent from reconnecting.
  • A proxy or firewall is blocking communication between the agent and the Fleet server.
• The certificate or MDM configuration has expired or is corrupted
  • If your APN (Apple Push Notification) certificate has expired.
• Fleet issue

​

Missing MDM profile (Mac only)

This status indicates that the MDM profile is either missing or inactive on the device. Possible causes:

• The profile was removed by the employee
  • On macOS, an admin user can remove an unlocked MDM profile.
• The profile has expired or is invalid
  • An issue with Apple Push Notification Service (APNS) may prevent the device from validating its profile.
  • If the APNS token has expired or been revoked, the MDM profile may become invalid.
• The device was accidentally removed from MDM management
  • If the turn off mdm action was executed from Fleet on the device.

​

Enrollment statuses

In the cockpit, a device’s enrollment status indicates the current state and any issues. The following statuses are available: A device that appears offline even though it is in active use typically indicates a missing agent or network issue.

​

Identify partially enrolled devices

In the cockpit, you can identify partially enrolled devices in two ways:

1. The device’s enrollment status shows one of the error states listed above.
2. The device appears offline even though it is actively used by an employee.

​

Troubleshooting

Here are the solutions for each situation:

• Missing agent ⚠️: In the device panel, click on the device status button to remotely trigger the agent installation. If this does not work, ask the employee to log into their Primo enrollment page and click on their assigned device. They can then download the agent independently.
• On in another MDM ⚠️: Find the necessary documentation regarding migration from your previous MDM.
• Off (offline device): Ask the employee to re-enroll their device. You can automate this: in MDM > Settings, turn on Activate automatic unenrollment.

Once the employee completes these actions, the device should appear as correctly enrolled within 30 minutes (the synchronization period).