Yup i've run into a similar issue especially on device we are re-enrolling that have existing JAMF computer records. JAMF is applying configuration profiles based on the old inventory data of the device, so even though i have the 802.1X profile scoped to smart group so it doesn't occur during enrolment it still gets applied. The funny thing is we don't see this is a more heavily loaded JAMF instance due to the performance of the platform.

https://www.jamf.com/jamf-nation/feature-requests/9840/802-1x-auto-join-profiles-break-jamf-enrolment-process

I found a workflow that works! extension attributes can be cleared at re-enrolment, i excluded all devices which had the specific attribute as blank. This bought enough time for that first recon to run and the correct scoping to apply!

Hello @Key1, I know this is a very old post but I'm curious what you ended up using for a workflow to get around this issue.  We are seeing the same issue when our wifi profile is applied while enrollment and breaks delivery of jamf binary and self service etc.

I believe it was just as simple setting the re-enrollment setting to clear ext attributes and then if a ext attribute i know is never blank is blank excluded it from the profile this allows the first recon to run first before devices become in scope of the profile.