Management: Profiles, Payloads, and MDM Commands
Profiles and payloads
A configuration profile is a plist containing one or more payloads (Wi-Fi, VPN, restrictions, certificates, Exchange, etc.). Understand scope: user-level versus device-level payloads, and that some payloads require supervision. Restrictions payloads can disable camera, app installation, or AirDrop - and many of these are supervised-only. Certificates and SCEP payloads are how devices obtain identity for Wi-Fi and VPN.
MDM command model
MDM is a queue-based protocol: the server sends a push notification, the device checks in, receives commands, and returns responses. Traps include confusing push (APNs) with command delivery - push only wakes the device. Commands like DeviceInformation, InstalledApplicationList, and ProfileList return data asynchronously. A device that is offline simply queues commands until it checks in.
Smart groups and scoping
Management consoles use smart groups (dynamic criteria) versus static groups. Questions often test whether a change propagates automatically: smart group membership updates when criteria change; static groups require manual edits. Scope exclusions override inclusions in many systems - verify the platform's rule.
Worked rule of thumb
To push a Wi-Fi profile silently to supervised devices, you need: a device-scoped Wi-Fi payload, supervision, and the device to check in. If the profile must be non-removable, that requires supervision and the installation as a device profile. If a user can remove it, the profile was installed as user-level or the device is unsupervised.