Device Support and Troubleshooting: Logs, Recovery, and Diagnostics
Where to look
Troubleshooting questions test whether you know the right tool. On macOS, Console.app and log collect gather unified logs; /var/log holds legacy logs. On iOS/iPadOS, the device analytics data and MDM command responses are primary. Profile installation failures usually surface as payload-specific errors - check the profile's payload type and whether supervision is required.
Recovery modes
Know the difference between macOS Recovery (Command-R), Internet Recovery (Option-Command-R), and DFU/Recovery mode for Apple silicon and iOS devices. Apple Configurator can revive or restore Apple silicon Macs and iOS devices. A trap: erasing a device does not remove supervision if it re-enrolls via ADE; supervision persists through erase for ADE devices.
Common failure patterns
Enrollment failures often trace to: expired APNs certificate, device not assigned in ABM, network blocking Apple endpoints, or a profile that requires supervision on an unsupervised device. App installation failures trace to licensing (VPP assignment), device storage, or a required OS version. Wi-Fi profile failures often involve certificate trust or SCEP misconfiguration.
Worked rule of thumb
When a device "won't enroll," check in order: is it assigned in ABM? Is the APNs certificate valid? Can it reach Apple's enrollment endpoints? Is the profile compatible with the OS version? This ordered checklist resolves most exam scenarios faster than guessing at the MDM console.