Ahh, hooked up console and I think I found the problem: error 09:51:01.071909-0800 appstored [BUY347258D/com.apple.TestFlight:899247664] Failing installation after receiving error: Error Domain=IXUserPresentableErrorDomain Code=1 "Unable to Install “TestFlight”" UserInfo={NSLocalizedDescription=Unable to Install “TestFlight”, NSLocalizedFailureReason=Please try again later., NSLocalizedRecoverySuggestion=Failed to get CFBundleVersion from Info.plist for incoming OS app upgrade for bundle ID com.apple.TestFlight, NSUnderlyingError=0xc98a5a300 {Error Domain=MIInstallerErrorDomain Code=33 "Failed to get CFBundleVersion from Info.plist for incoming OS app upgrade for bundle ID com.apple.TestFlight" UserInfo={SourceFileLine=315, NSLocalizedDescription=Failed to get CFBundleVersion from Info.plist for incoming OS app upgrade for bundle ID com.apple.TestFlight, FunctionName=-[MIInstallableBundle _checkCanInstallWithError:]}}} Seems like a TestFlight.app bug... Opening a FB... 13601901

What kind of VPN are you using? If not using Network Extensions, probably going to have a bad time. FWIW, the VPN I am using does not have this problem, so likely a configuration or implementation detail specific to your VPN software.

AFAIK, Apple will only be supporting Account Driven enrollments and will not be supporting profile-driven MDM enrollments on the platform.

Thanks Matt! One detail: we are deploying agentlessly and not using an app with a bundled dns extension. Specifically we are deploying a DoH configuration via an MDM mobile configuration profile: https://developer.apple.com/documentation/devicemanagement/dnssettings Therefore we don’t have an app available to modify these settings. That being said… could a macOS app (that we would have to build to solve this use case) modify the behavior of an MDM deployed DNS settings configuration?