Customer HubDevice does not communicate with Relution
In school environments and other scenarios where iOS devices are centrally managed using Mobile Device Management (MDM), disruptions can occasionally occur. One common issue is the failure of devices to process MDM actions, which can cause significant problems – either during ongoing lessons or in the general operation of the devices. This article describes potential error patterns, analyzes their underlying causes, and provides solutions to address such situations.
See also: Actions stuck in Not now → — it covers pending actions with the status Not Now and other device-related causes.
Expired Certificates
Error Pattern:
MDM actions remain in the Pending status and are not executed by the device.
Cause: The identity certificate of the iOS device has expired. This often occurs in devices that have been stored for an extended period and were not in communication with the MDM server shortly before the automatic renewal of the certificate.
See also: Identity Certificate → — it describes the validity period and automatic renewal, as well as manually renewing an expired certificate via the option Trust expired identity certificates in the device details (Information tab, Security block).
Devices with an expired identity certificate can be found in the inventory using the filter Identity certificate expired. In dynamic groups, the criterion Identity certificate expires with the value Expired is available for this purpose.
VPN Apps
Error Pattern: iOS devices get stuck during lessons, or time-based configurations, such as starting or ending a lesson, are not executed.
Cause:
Often, end users, particularly in educational contexts, install VPN apps on their own, which blocks communication with the MDM server.
Some VPN apps also offer a Kill-Switch feature, allowing users to intentionally disconnect all internet communication. This interrupts MDM actions, such as starting or ending lessons.
On affected devices, VPN apps can be identified in Relution in the Installed apps tab.
Solution: In Relution, a restriction can prevent unmanaged VPN configurations from being created on the devices. To do this, the option Allow VPN configurations creation, which is enabled by default, is disabled in the Restrictions configuration. The option only takes effect on supervised devices. VPN apps can then still be installed, but they can no longer create their own VPN configuration.
DNS
Error Pattern: iOS devices get stuck during lessons, or time-based configurations – such as starting or ending a lesson – are not executed.
Cause:
A common reason is that end users, especially in schools, configure an alternative DNS manually. This can block communication with the MDM server, causing MDM actions to fail.
On affected devices, custom DNS configurations can be checked under Settings → Wi-Fi → DNS.
Solution: To prevent such issues, the Encrypted DNS settings configuration can be applied in Relution. Communication through the managed DNS server then takes priority, and changes made to the DNS by end users do not take effect (the change itself remains possible). To prevent users from disabling the managed DNS settings, the option Prohibits users from disabling DNS settings is also enabled. The option is disabled by default and only takes effect on supervised devices.