Splitting Configuration Profiles

I would scope to a test device at first, but in general you can just push out all the new profiles first, then when you know the new profiles are successfully installed you can remove the old/original profile. Duplicate payloads can exist without issue, however the most restrictive setting will win out if you happened to change some of the payload settings between your single original and the new multiple batch of profiles you're making.

Example: If Profile A disallows Touch ID and Profile B disallows Touch ID, then nothing changes if both are installed. But if Profile A disallows Touch ID, and Profile B allows it, then the restriction to disallow Touch ID would remain as long as Profile A is still installed.

@sshort Just the info I needed. I'll get to testing. Thank you!

What I did recently was

• clone the original Configuration Profile
• in the copy remove the unwanted parts
• when saving select 'apply to newly scoped devices only' (or similar phrase, I don't recall the details), that way this has no impact on the devices that have the original payload already applied
• remove the contents from the original Configuration Profile, again apply to newly scoped only
• Repeat until done

For cases like this it is very helpful to have a test-mdm available. Porting from test-mdm to prod-mdm is a pain in the lower back, but some tests I prefer to do on a separate instance.