iOS/iPadOS configuration profiles failing in Intune: supervision, errors and conflicts

When an iPhone or iPad profile shows Error, Conflict or Not applicable in Intune, or reports success while a restriction does nothing, the cause is usually one of three things: the device isn't supervised, its OS is too old for a setting, or two profiles disagree. In this post I'll show how to read the status, check supervision and OS requirements, find the competing profile, look at the device side, and prove the fix.

Jump to the fix

Symptoms#

• The profile shows Error, Conflict, Not applicable or Pending for some devices.
• The profile reports success, but a restriction such as blocking the App Store, the camera or iCloud backup has no effect on some devices.
• A setting works on corporate iPads but not on BYOD phones, or on new devices but not on older ones.
• Users can't buy inside an app. Before treating that as a profile failure, check the device's management profile for a restriction: Intune's Block in-app purchases setting (device enrollment and automated device enrollment) blocks them by design.

Why it happens#

What each status means#

Supervision#

Apple reserves many controls for supervised devices. Microsoft's restriction reference groups settings under Settings apply to lines (all enrollment types; device enrollment and automated device enrollment (supervised); or automated device enrollment (supervised) only), and several settings carry the note "Starting with iOS/iPadOS 13.0, this setting requires supervised devices": Block App store, Block camera, Block FaceTime, Block Safari and Block iCloud backup among them.

Devices enrolled with Company Portal and devices in account-driven User Enrollment aren't supervised. Don't rely on the profile status to tell you: a profile can install while a supervised-only restriction in it isn't enforced. And you can't turn supervision on from Intune after enrollment; Automated Device Enrollment (ADE) or Apple Configurator are the routes, and both start from an erased device.

OS version requirements#

Many settings state a minimum, such as "This setting applies to: iOS 14.2 and newer" for Disable near-field communication (NFC), or iOS/iPadOS 15 for Block iCloud Private Relay. A device below the minimum reports Not applicable.

Conflicts#

Configure the same setting with different values in two profiles (a device restrictions template and a settings catalog profile, say, or a custom .mobileconfig) and Intune reports Conflict. On the device, iOS generally enforces the most restrictive value when several profiles carry restrictions or passcode rules, so a conflicted device can end up stricter than you intended.

How to fix it#

1. Find the failing setting. Go to Devices › Manage devices › Configuration, open the profile, and use Per setting status and View report. For a single device, open Devices › All devices, select it, then Device configuration and the profile; selecting a Conflict row lists every profile that sets the same value. The Device assignment status report can lag 24–48 hours behind, so trust the per-device view for recent changes.
2. Confirm supervision. Microsoft's documented check is on the device: the top of the Settings app reads "This iPhone is supervised and managed by <your organization>". In the admin center, the device's Hardware page also shows whether it's supervised. If it isn't and you need the setting, add the device to Apple Business Manager and re-enroll it through ADE (see ADE devices missing in Intune), or prepare it with Apple Configurator on a Mac. Both erase the device.
3. Target supervised-only settings correctly. Put them in their own profile and assign it only to supervised devices, for example a dynamic device group built on enrollmentProfileName for your ADE enrollment profile. Keep settings that work for every enrollment type in a separate profile for BYOD, and remember that User Enrollment supports only a subset.
4. Check OS requirements. Compare the OS version on the device's overview with the setting's minimum, then update the device (see Apple software updates with Intune) or accept Not applicable.
5. Resolve conflicts. Decide which profile owns each setting and remove it from the others. Avoid configuring one setting in a template, the settings catalog and a custom profile at the same time.
6. Fix dependencies behind errors. Wi-Fi, VPN and email profiles that use a SCEP or PKCS certificate fail when the certificate profile fails, so fix the certificate first.
7. Re-sync. Use Sync on the device in Intune, and make sure the network doesn't block Apple Push Notification service traffic; without it, devices stay Pending until their next scheduled check-in.

Check the device side#

• Settings › General › VPN & Device Management, then the management profile: lists the profiles Intune installed and the restrictions in force. A missing profile was never delivered or was removed.
• Console on a Mac: connect the device by cable, select it in the sidebar, start streaming, then sync from Intune and search for the profile name (admins commonly filter on the profiled process too). A rejected payload is logged there in Apple's own wording, which often points to the payload or condition at fault.
• Apple Configurator on a Mac also shows the profiles installed on a connected device, which helps when the Settings app view isn't detailed enough.

Verify the fix#

• Per setting status shows Succeeded for the device and no Conflict rows remain.
• The profile appears under VPN & Device Management on the device.
• The behaviour matches: the App Store is hidden, the camera is gone, AirDrop is unavailable, or whatever the setting controls.
• For supervised-only settings, the supervision banner is present.

Prevent it next time#

• Read each setting's Settings apply to and minimum OS lines before adding it.
• Split profiles by supervision and give every setting a single owning profile.
• Buy corporate iPhones and iPads through Apple Business Manager so they arrive supervised through ADE.
• Tell the service desk which restrictions you deploy, such as Block in-app purchases, so a blocked feature isn't logged as a broken profile.

References#

• View and monitor device configuration policies in Microsoft Intune
• Apple device restriction settings in Microsoft Intune
• Turn on iOS/iPadOS supervised mode