Ahh, hooked up console and I think I found the problem: error 09:51:01.071909-0800 appstored [BUY347258D/com.apple.TestFlight:899247664] Failing installation after receiving error: Error Domain=IXUserPresentableErrorDomain Code=1 "Unable to Install “TestFlight”" UserInfo={NSLocalizedDescription=Unable to Install “TestFlight”, NSLocalizedFailureReason=Please try again later., NSLocalizedRecoverySuggestion=Failed to get CFBundleVersion from Info.plist for incoming OS app upgrade for bundle ID com.apple.TestFlight, NSUnderlyingError=0xc98a5a300 {Error Domain=MIInstallerErrorDomain Code=33 "Failed to get CFBundleVersion from Info.plist for incoming OS app upgrade for bundle ID com.apple.TestFlight" UserInfo={SourceFileLine=315, NSLocalizedDescription=Failed to get CFBundleVersion from Info.plist for incoming OS app upgrade for bundle ID com.apple.TestFlight, FunctionName=-[MIInstallableBundle _checkCanInstallWithError:]}}} Seems like a TestFlight.app bug... Opening a FB... 13601901

What kind of VPN are you using? If not using Network Extensions, probably going to have a bad time. FWIW, the VPN I am using does not have this problem, so likely a configuration or implementation detail specific to your VPN software.

AFAIK, Apple will only be supporting Account Driven enrollments and will not be supporting profile-driven MDM enrollments on the platform.

Thanks Matt! One detail: we are deploying agentlessly and not using an app with a bundled dns extension. Specifically we are deploying a DoH configuration via an MDM mobile configuration profile: https://developer.apple.com/documentation/devicemanagement/dnssettings Therefore we don’t have an app available to modify these settings. That being said… could a macOS app (that we would have to build to solve this use case) modify the behavior of an MDM deployed DNS settings configuration?

Possibly old news but for the record. According to AppLayer VPN MDM spec MailDomains has been deprecated in 13.4. The suggestion is to "use the VPNUUIDproperty of the Mail or ExchangeActiveSync payload instead."