iPhone 11 DEP/Supervised mode not activating

[b_bagley]

I have an odd issue at my company with a recent batch of iPhones purchased a few months back.
We've been using DEP with Microsoft InTune as our MDM for a few years now, but a batch of about 40 phones were shipped to use without DEP registration. The phones were deployed to the users before we realized this, but we figured no big deal, the carrier can easily add them after the fact, and they phones should shift into supervised mode.
Well, the carrier did get them added, we saw them show up in DEP/ABM, and then saw them sync over to InTune.
But, the phones have not shifted over to supervised mode. Subsequent batches of phone orders were registered with DEP before they shipped to us, and we've seen no problems with them.
I've tried a number of things, and had support calls with both Apple and Microsoft.
What I've found is that if one of the affected phones is restored from a previous iTunes backup, it never prompts to install the management profile. Apple had me do the reset and restore process a few different ways. Microsoft had me try a few things as well.
I also tried removing the device from DEP, waiting a few days, then adding it back in with Configurator. But, I still see the same results.

Apple told me they see that it was assigned a management profile, but not that it was installed.

I also tried resetting a device, then setting it up as a new device first. This did give me the management profile prompt, and set the phone in supervised mode. BUT, when I restored a backup, it was back as a non-supervised device.

Now, part of the point of supervised mode is to prevent people from stealing a device, wiping it and using it. But, if all you have to do to bypass supervision is restore a backup, that's a pretty big problem. Of course, this is a unique scenario, because as far as I know, we don't see the same problem in the subsequent batches of phones. It only seems to exist with those that were added to DEP after the fact.

Also, all this resetting and restoring is not a reasonable solution to force upon our users to fix the problem, it's pretty inconvenient.

 

[DJLC]

I'm not sure I have any helpful advice and I've not been in a position running an MDM in about 2 years now, BUT:

I used to see this with iPads all the time. Restoring from a backup bypasses DEP supervision. The only way to trigger supervision is to restore and set up as new. Since these weren't in DEP when they were set up initially, they won't be supervised until / unless they're restored as new. You can enable it using Apple Configurator, but that similarly will reset the device back to factory default.

 

[4sallypat]

I know what you mean, we used to have Airwatch MDM take care of supervising all our devices to our employees. When enrolled in DEP as new device, Airwatch works as expected - even if the user wipes restores the iPhone - they can't get around it.

Airwatch installed manually was just as finicky and required the device be wiped, restarted with Management and only certain files could be restored - not the entire iOS.

Now we use Mosyle MDM and it is almost seamless, and OTA makes it a breeze.
We can wipe, restore iOS, install remote management and then it's supervised.

 

[b_bagley]

Oddly, we have not experienced an issue like this before now.

In theory, if a device is in DEP, it shouldn't matter whether it was there before it shipped to us, or was added later by either the vendor/carrier or Configurator.

Most, if not all, of the other devices, to my knowledge, were restored from backups. And we did not see this in the past. The only scenario I haven't tried yet in testing is restoring from iCloud or the proximity restore, which I can't do now as the previous device is long gone. I am planning to try the iCloud restore soon.