The Stalled Enrollment Wave
A K-12 district is onboarding 1,400 shared iPads across 22 schools using Automated Device Enrollment through Apple School Manager. Devices are purchased through a reseller, and 200 of them were bought two years ago before the reseller relationship was set up, so they are not in Apple School Manager. The MDM is cloud-hosted and the network team has configured a proxy that inspects TLS. Enrollment succeeds for about 60 percent of devices, but the rest sit at the Remote Management screen and time out after 90 seconds. The proxy logs show connections to an Apple host being reset. The district wants all 1,400 devices managed by Friday.
1. Diagnose the enrollment failures and describe the most likely cause and fix.
Read the worked answer
The symptom (devices stuck at Remote Management, 90-second timeouts, TLS resets to an Apple host) points to the enrollment profile fetch failing because the TLS-inspecting proxy is intercepting Apple's certificate-pinned enrollment endpoints. Apple's enrollment and activation traffic uses pinned certificates; a proxy that performs TLS interception breaks the trust chain and the device aborts.
Fix: exempt the Apple enrollment/activation hosts from TLS inspection (bypass/allow-list in the proxy), not merely from authentication. Then re-trigger enrollment. The 60 percent that succeeded are likely on network segments where the proxy policy differs or where the device had cached material.
Do not assume the MDM server is at fault; the reset is to an Apple host, which is the tell.
2. What must happen for the 200 legacy iPads to be managed, and what are the tradeoffs?
Read the worked answer
Devices not in Apple School Manager cannot use Automated Device Enrollment. Options:
- Add them to Apple School Manager retroactively if the reseller can supply order numbers / the devices qualify for the reseller's historical order import. This is the cleanest path and gives supervision-capable ADE.
- Manually enroll via Profile Manager/ enrollment URL - but manual enrollment does not confer supervision, so supervision-only payloads (e.g., some restrictions, certain MDM commands) are unavailable.
- Apple Configurator to prepare and supervise, then enroll - requires physical USB handling and wipes the devices.
Tradeoff: manual enrollment is fast but loses supervision and cannot be silently re-enrolled after wipe; Configurator is labor-heavy for 200 devices. The Friday deadline is not achievable for all 1,400 if the 200 require Configurator wipes; negotiate scope.
3. The district asks whether they can skip supervision to hit the deadline. What is your recommendation?
Read the worked answer
Recommend against skipping supervision. Supervision is what enables silent app install, web content filtering, restricting pairing, and - critically - non-removable MDM enrollment. Without it, a student can remove the management profile, and the district loses control of shared devices. For a shared K-12 deployment, supervision is a baseline requirement, not optional.
Better: enroll the 1,200 ADE-eligible devices now, and run a staged Configurator/import plan for the 200 legacy units. Communicate that the deadline applies to the majority and that the remainder follow a documented remediation track.