KB: Solving iOS MDM Profile Error “Decryption key for this profile is not installed”
Note: As the error message is quite generic it can also be caused by other things in general, for me this steps here solved the issue. Also this specific Error is solved with 21.11. Patch 30 , so the default Value is now 338761996.
Issue Overview:
When enrolling a device in a 21.11 UEM or higher and you newly setup the “Managed Settings” in the Workspace ONE Console you may get an Error on Enrolling iOS Devices with DEP and also via Hub Enrollment. The Issue on the Device looks like this:
the Message of “Decryption key for this profile is not installed” . If you try to set “Encrypt Profiles” in the Settings to ” Disabled” it may still fail with “Invalid Profile”.
Log on iOS Device show:
NSError:
Desc : Profile could not be decrypted
Sugg : Decryption key for this profile is not installed.
US Desc: Profile could not be decrypted
US Sugg: Decryption key for this profile is not installed.
Domain : MCProfileErrorDomain
Code : 1006
Type : MCFatalError
...Underlying error:
__NSCFError:
Desc : The data couldn\M-b\M^@\M^Yt be read because it isn\M-b\M^@\M^Yt in the correct format.
Domain : NSCocoaErrorDomain
Code : 3840
Extra info:
{
NSDebugDescription = "Encountered empty <integer> on line 27";
kCFPropertyListOldStyleParsingError = "Error Domain=NSCocoaErrorDomain Code=3840 \134"Malformed data byte group at line 1; invalid hex\134" UserInfo=\{NSDebugDescription=Malformed data byte group at line 1; invalid hex}";
}Cause
This was caused in my case by the new Functionality of “Required App” and it was set to ” Intelligent Hub (com.air-watch.agent)” which is not a Hex/Integer Value.
As long as you do not touch the Settings with a new Overwrite etc. it is working as expected. if you Overwrite it starting from 21.11 UEM , make sure that the value is set to “338761996” which is the Hub App.
Resolution
Go to the Settings of the Workspace ONE UEM Console :
Select “Devices & Users” then go to “Apple” , select “Apple iOS” and Click to “Managed Settings”
if you have it already overwritten , make sure the “Required App ” is set to “338761996” .
Just in case you want to know why it is 338761996 and nothing else, It is the ID of the Hub App on the iOS AppStore, also visible in the URL in Browser:
Further Information on the Required App can be found in the VMware Documentation: https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/iOS_Platform/GUID-ConfigMngdSettings.html
vExpert, blogger and VMware champion. Worked 10 years as a VMware & Microsoft consultant for a partner before joining VMware in 2017.