Configuration profiles
A configuration profile is a signed bundle of settings iOS applies to the device: certificates, VPN and Wi-Fi configuration, restrictions, MDM enrolment, developer provisioning. This module lists what is installed and lets you add or remove one.
Listing
Section titled “Listing”For each profile: display name, identifier, what it configures, who signed it, and when it expires.
Reading this list is the first thing to do when a device “behaves differently to the others” and nobody can say why.
Why an unexpected profile matters
Section titled “Why an unexpected profile matters”Profiles change the rules the device runs under, silently:
- A root certificate makes traffic interceptable. If a device has one you did not install, everything it does over TLS is suspect.
- A VPN configuration routes traffic somewhere you did not choose — which shows up as latency, as a different apparent region, or as requests failing on one handset only.
- Restrictions disable features. An app that “does not work on that phone” sometimes just cannot use a capability the profile turned off.
- MDM enrolment hands device control to whoever owns the MDM.
- An expired developer profile stops sideloaded builds from launching, with an error that does not say so.
Installing
Section titled “Installing”Install a .mobileconfig from your computer over the cable. iOS still requires confirmation on the device — installing a profile is a security decision and the platform will not let a computer make it unattended.
Useful for pushing a Wi-Fi or test configuration onto a fleet of test devices without setting each one up by hand.
Removing
Section titled “Removing”Remove a profile you no longer want. Two cautions:
- Removing an MDM enrolment profile can wipe managed apps and their data.
- Removing a Wi-Fi or VPN profile may take the device off the network you are talking to it over — which, on a Wi-Fi connection, ends the session mid-operation. Do it on the cable.
Provisioning profiles
Section titled “Provisioning profiles”Developer and ad-hoc profiles show here too, with their expiry and the devices they cover. When an IPA install fails with a signature error, this list and the UDID are the two places to look: either the device is not in the profile, or the profile has expired.
Hygiene for a test fleet
Section titled “Hygiene for a test fleet”- Audit the profile list when a device joins the fleet.
- Remove certificates and VPN configurations left over from previous work.
- Note expiry dates for provisioning profiles — a fleet that stops installing builds on the same day usually means one profile expired.
- Audit again before a device leaves, especially before it goes back to a person.