Glossary / Enrollment Profile
Enrollment Profile
The configuration payload a device installs to place itself under management — the artifact that establishes the trust relationship between an endpoint and an MDM server.
On Apple platforms specifically, an enrollment profile identifies the management server, carries the certificates and identifiers that authenticate it, and defines what the server will be permitted to do once the device is enrolled. Installing it is the moment a device becomes managed.
Because the profile is what establishes trust, its handling is a security question rather than a distribution one: an unused profile that leaks lets someone enroll a device you did not intend to manage, and profile-generation credentials that a management interface hands back to a browser are credentials that now live in a browser.
Rotation is where this most often goes wrong operationally. Rotating the authority that generates profiles should invalidate outstanding unused profiles — but if it also invalidates the tokens already-enrolled devices are using, a routine key rotation silently knocks a managed fleet offline.
How Nexus handles this
In the Nexus Apple MDM console, rotating profile-generation authorization invalidates only outstanding unused profiles while preserving device-bound tokens, credentials stay replace-only and are never returned to the browser, and revocation requires a typed confirmation.
More terms
MSP (Managed Service Provider)
A company that remotely manages a client's IT infrastructure and end-user systems on an ongoing, proactive basis — usually a flat-fee contract, not break-fix billing.
RMM (Remote Monitoring and Management)
Software that lets an MSP monitor device health and perform remote management tasks — patching, scripting, remote control — across every client site from one console.
PSA (Professional Services Automation)
Software that runs the business side of MSP operations — ticketing, SLAs, billing, contracts, and client records — the system of record most MSP work flows through.
Ready to see it in the platform?
Join the design-partner cohort and we'll show you exactly where this lives.