iPads stopped communicating with JSS all at once

[Ryan_A_GDX]

We have about 130 iPads in or org. enrolled via pre-stage enrollment. Many of these iPads have not been in use as they are issued to traveling sales members who have not been traveling due to Covid.

Recently we have been trying to make sure all devices are in compliance (OS updates, modifying config profiles, etc.). During this process I noticed that about 50 of the iPads stopped communicating with JSS and will not receive pushes. Although some may just not be on, I have verified on multiple in-hand that they are on, connected to internet, and the MDM profile shows as verified on the device and in Jamf. They just do not receive commands.

The other odd item is about 37 of those devices all show the last inventory update of the exact same date and time 8/30/2020 at 2:15pm. So far the only solution I've had is with the devices in hand, if it lets me remove the profile, to remove and re-enroll. For others we have to wipe and reconfigure.

The problem is that all of these devices are remote across the country and it will be a large undertaking to individually connect with each user to potentially wipe the device and reconfigure.

Has anyone experienced anything similar to this and/or know of any other potential solutions?

[CSCC-JS]

Did the Apple Push Certificate expire then got renewed?

[Ryan_A_GDX]

@CSCC-JS It did not expire but it was renewed 2-days prior to expiration. The same apple id was used for the new certificate.

[bzuckrow]

Ryan - I had a similar experience. Not sure I can recall all the details and the "solution" was not in my support ticket so this is what I remember.

My issue - renewed my push cert - erase/restore DEP ipad would not download DEP or enroll - every one I erased. Thought it was push cert - internet filter or firewall. Opened a ticket with jamf - got kicked up to second level engineer who figured it out.

Somewhere in the support process we found that if we deleted the iPad record from JSS - then tried erase it enrolled. Somehow this triggered some long ago recollection about a SMART GROUP that Jamf support was advising customers to create 2-3 years ago in response to a specific problem.

This is where I go blank - I can't remember what the name of the group was. I think it was to collect something about MDM cert renewal. Turned out I had the group from the jamf support doc he was looking at for the original problem - deleted it and all was good - that easy. He thought there was a bug in how the group evaluated that particular criteria and something in jss updates changed over time causing the bug.

My best advice is, if you are stalled with support, to try to get them to kick it up a level. And to look through your Smart Groups and delete any that you are not using - especially if the way it is named doesn't fit your naming conventions - that is probably the tech support group.

Sorry for the sketchy info.