Glossary / Enrollment Profile

Enrollment Profile

The configuration payload a device installs to place itself under management — the artifact that establishes the trust relationship between an endpoint and an MDM server.

On Apple platforms specifically, an enrollment profile identifies the management server, carries the certificates and identifiers that authenticate it, and defines what the server will be permitted to do once the device is enrolled. Installing it is the moment a device becomes managed.

Because the profile is what establishes trust, its handling is a security question rather than a distribution one: an unused profile that leaks lets someone enroll a device you did not intend to manage, and profile-generation credentials that a management interface hands back to a browser are credentials that now live in a browser.

Rotation is where this most often goes wrong operationally. Rotating the authority that generates profiles should invalidate outstanding unused profiles — but if it also invalidates the tokens already-enrolled devices are using, a routine key rotation silently knocks a managed fleet offline.

How Nexus handles this

In the Nexus Apple MDM console, rotating profile-generation authorization invalidates only outstanding unused profiles while preserving device-bound tokens, credentials stay replace-only and are never returned to the browser, and revocation requires a typed confirmation.

Ready to see it in the platform?

Join the design-partner cohort and we'll show you exactly where this lives.