## TL;DR
Get the device enrolled cleanly before chasing policies. Confirm the device record in Apple Business Manager is assigned to the Jamf server, the enrollment profile and MDM push certificate are valid, and no stale device record blocks the new enrollment, then re-enroll the laptop and watch profiles land in order.

```text
laptop provisioning status not updating: Jamf enrollment failed with MDM error
```

## Use this when
- A new hire Mac stalls at enrollment or shows an MDM profile error during setup.
- The provisioning dashboard never moves the laptop past the enrollment stage.
- Other devices enroll normally, or a whole batch from one shipment fails together.

## Not for this skill when
- The device is enrolled but an app or policy fails. Troubleshoot the specific policy instead.
- The device is activation locked to a personal account. Resolve activation lock with Apple first.

## Steps
1. Open the Jamf Pro enrollment history and the device setup screen error text for the affected hire and capture the full error detail, the operation that failed, and the identifiers involved, rather than working from the summary banner alone. Keep one hire as the test case for every change so cause and effect stay clear. Verify: the full error detail and one test hire are recorded
2. Read the exact MDM error on the device and in Jamf enrollment logs, distinguishing a push certificate problem, a profile install rejection, and a device assignment problem, because the wording separates them. Verify: the MDM error class is identified from the device message
3. Check the platform foundations in Jamf and Apple Business Manager: the MDM push certificate expiry date, the automated enrollment instance assignment for this device serial, and whether the serial was assigned to a different server during a migration. Verify: certificate validity and device assignment are both confirmed
4. Apply the correction in Jamf Pro and save it, then re-run provisioning for the single test hire only and read the fresh log entry end to end. If it still fails, treat the new detail as the current cause and do not stack further changes on top. Verify: the test hire provisions successfully or a new specific detail replaces the old one
5. Remove blockers in Jamf: delete or unmanage any stale record for the same serial from a previous deployment or return, so the fresh enrollment does not collide with an existing inventory record and its profiles. Verify: no stale record for the serial remains
6. Re-run enrollment on the device through Setup Assistant or the enrollment invitation as appropriate, staying with the device until the management profile installs and the first configuration profiles appear. Verify: the hire device downstream checks pass, with profiles listed on the device

## Why it happens
Mac enrollment chains Apple Business Manager assignment, Jamf enrollment configuration, and the MDM push channel, and a break in any link surfaces as a generic MDM error on the device while the laptop status board simply stops moving. Push certificate expiry is the classic fleet-wide cause, while stale inventory records and wrong server assignment dominate single-device cases. Verifying the chain from assignment through push to profile install locates the break directly, whereas repeatedly wiping the device against a broken server-side link can never succeed.

## Variants and edge cases
### Whole batch fails after certificate renewal
A renewed push certificate must match the same topic and be uploaded completely. Re-upload and restart the Jamf service components if devices still refuse profiles.

### Device enrolls but profiles stay pending
A blocked push channel, often network filtering of Apple push hosts on the office network, stalls delivery. Test enrollment on an open network to isolate it.

### Returned device reissued with old record
Reissued hardware must be wiped and its old record retired first, or the new hire inherits the previous user assignment and policies.

Compatibility: Applies to Jamf Pro with Apple Business Manager automated device enrollment. Requires Jamf admin and Apple Business Manager access.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xqFdoIN4sCmi6o2KfPWHCg