InstallProfile

MDM command that installs a configuration profile (plist) onto the device to apply settings/restrictions.

What to Know

InstallProfile is the primary mechanism for enforcing device configuration and security policies at scale. Configuration profiles contain payloads for Wi-Fi, VPN, certificates, passcode requirements, restrictions, and dozens of other settings that would be impossible to manually configure on each device. A single InstallProfile command can simultaneously configure network access, enforce security baselines, and lock down unauthorized features — instantly transforming a consumer device into a compliant corporate asset.

Profiles also provide atomic configuration management, meaning all settings within a profile are applied together and removed together. This prevents “configuration drift” where individual settings might be partially applied or removed, leaving devices in inconsistent states. When a device is unenrolled, all MDM-installed profiles are automatically removed, ensuring corporate configurations don’t persist on devices that are no longer under management.

Common Scenarios

Enterprise IT: Deploy Wi-Fi and VPN profiles to provide seamless corporate network access without requiring users to know SSIDs, passwords, or server addresses. Push certificate profiles for authenticating to internal systems, email profiles for Exchange/Office 365 access, and restriction profiles to disable features like iCloud backup or AirDrop on devices accessing sensitive data. Use passcode profiles to enforce minimum password complexity across all corporate devices.

MSP: Deploy client-specific configuration profiles including Wi-Fi (unique SSIDs/passwords per client), VPN (different endpoints per client network), and security baselines (tailored to each client’s risk tolerance and compliance requirements). Use custom profiles to configure third-party apps, system preferences, or security agents with client-specific settings that can’t be managed through standard MDM commands.

Education: Deploy restrictions profiles to lock down student devices by disabling app installation, camera access during testing, AirDrop, or Safari access during exams. Push Wi-Fi profiles to automatically connect student devices to school networks, and web content filter profiles to enforce age-appropriate browsing restrictions. Use shared iPad profiles to enable multi-user support on classroom device carts.

In Addigy

Addigy abstracts InstallProfile commands through its Profiles interface, allowing admins to build profiles using a web UI rather than hand-editing XML plists. Addigy includes pre-built profile templates for common payloads (Wi-Fi, VPN, passcode, restrictions) and supports Custom Profile uploads for advanced configurations. When profiles are assigned to devices or groups, Addigy automatically issues InstallProfile commands and tracks deployment status. Profile updates trigger automatic reinstallation, and removing a profile assignment causes Addigy to issue RemoveProfile commands to clean up the configuration.