Removal of Configuration Profile behavior

[jttavares]

I use Apple Configurator and Imazing Profile Editor to create configuration profiles.

If a configuration profile was pushed out with "Prevent users from removing this profile" as true, can JAMF still remove this profile?  Isn't this just so users can't remove it locally on the workstation but the MDM server still can ?

Also If pushing out the same configuration profile with same Payload ID to a workstation that already has it, won't the profile just be overwritten with the newer one?   Or do I need to remove it first and then push it out again if I make changes.

I know I can just push out another restrictive profile but I like to keep the profiles to a minimum.

Just curious on what exactly would happen.  Appreciate any feedback.

[sdagley · Accepted solution]

@jttavares As you thought that setting just prevents the user from removing the Configuration Profile themselves, and Jamf Pro will be able to replace it if you make an update to the profile settings and re-deploy it. 

[sdagley · Accepted solution]

@jttavares As you thought that setting just prevents the user from removing the Configuration Profile themselves, and Jamf Pro will be able to replace it if you make an update to the profile settings and re-deploy it. 

[AJPinto · Accepted solution]

As the key says, it prevents the user from removing the configuration profile; not the MDM. However with JAMF there is not much reason to use that key as JAMF already prevents user removal so long as the configuration profile is not self serviced. 

[jttavares]

Thank you for the responses.   I will make my changes to the profiles then push them out to overwrite the same profile thats already out there.  These profiles were made with Imazing Profile Editor.  My main concern was will I be able to overwrite the existing ones without issue even with the "Prevent users from removing this profile" as true thats on them.   I did think the server that pushed them out, should be able to overwrite them.