A stuck policy is often a sign of stale check-ins, incorrect targeting or enrolment limits rather than a faulty profile. Here’s how to trace the issue, from device status to Apple’s MDM push certificate.
When an iPhone policy sits on Pending, the fault is often not the profile itself but the basics around it: licensing, enrolment, check-in state, or targeting. Microsoft’s troubleshooting guidance starts with the user record in the Intune admin centre, where administrators can confirm that the user has an Intune licence and that the device appears as managed and has checked in recently. If the phone is not enrolled, or if its last contact with Intune is stale, the policy will not arrive, whatever the configuration says. According to Microsoft Learn, a device that has not checked in for more than a day is already a warning sign.
The next step is to force a fresh check-in. Microsoft says iPhone and iPad devices normally report in about every eight hours after the first hour of enrolment, when they check in more frequently, and that a policy change can trigger an earlier sync, although delivery may still take time. Users can prompt this through Company Portal, while administrators can use the Sync action from the device record in Intune. If the phone has just restarted, is still locked, or is busy applying an iOS update or app installation, Intune may return a busy-state error and defer the command until the device is ready.
If the profile never appears on the device, the assignment is usually the real problem. Microsoft’s assignment guidance makes a clear distinction between user groups and device groups: user-targeted profiles follow the person, while device-targeted profiles stay with the handset. Administrators should also check exclusions, because an excluded group overrides an inclusion when the targeting type matches, and filters can silently remove a device from scope. Microsoft also warns that some combinations of included and excluded user and device groups are not supported, and that dynamic groups may take time to populate after enrolment.
A status of Not applicable usually means the phone cannot use that setting, not that Intune failed. On iPhones, the most common causes are supervision, the enrolment method, or the installed iOS version. Microsoft explains that some restrictions only work on supervised devices, which are typically company-owned and enrolled through Apple Business Manager or Apple Configurator. The device itself will show supervision in Settings, and Intune cannot switch a phone into supervised mode after enrolment without resetting it through Apple Configurator. By contrast, Apple User Enrolment is designed for personally owned devices and supports only a narrower set of management controls.
Conflict is different from Not applicable. It means two settings are fighting each other, or another control already on the device is preventing the change. Microsoft says configuration-policy conflicts must be resolved manually, while compliance-policy settings take precedence over configuration-profile settings. The per-setting report is the most useful place to start, because it identifies the exact setting at issue. Custom Apple configuration files are another common source of confusion: Intune delivers them without inspecting their contents, so Apple may apply overlapping settings unpredictably if they clash with something else. If the policy depends on a certificate-based profile for Wi-Fi, VPN or email, those supporting profiles should be checked first, because an outage there can break the dependent profile as well.
If every iPhone suddenly stops receiving policies, the problem is likely wider than a single device. Microsoft says the Apple MDM push certificate is required for Intune to manage Apple hardware at all, and that it is valid for 365 days with a 30-day renewal window after expiry. Renewal must use the same Apple account that created the existing certificate; replacing it with a new one would force a full re-enrolment of devices. In that situation, administrators should also check tenant status for service incidents before spending time on device-by-device investigation.
The iPhone can also tell you what it actually received. In Settings, under General and then VPN & Device Management, the management profile lists the certificates, restrictions and profiles that landed on the device. That view is useful because it separates delivery from application: if the Wi-Fi profile is present but the network still fails, the issue may lie with the certificate chain or the network itself; if the profile is missing, the problem is higher up, in assignment or check-in. For escalation, Microsoft’s guidance makes it easier to move quickly if you include the user, device name, serial number, iOS version, supervision state, policy name, status, any error code and the last check-in time.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
