Checking configuration profiles and MDM enrollment status from Terminal with profiles

Goal

Determine from Terminal which configuration profiles are installed on a Mac, whether it is enrolled in mobile device management (MDM), and what that means for settings that cannot be changed locally.

Prerequisites

Terminal; some subcommands need sudo to see profiles installed at the system, not just user, level.

Steps

1. List every installed configuration profile, both user- and device-level: sudo profiles list -all.
2. Check MDM enrollment specifically: profiles status -type enrollment, which reports whether the Mac is enrolled and whether enrollment is user-approved — a distinction that affects which payloads MDM may apply.
3. Dump a specific profile's payload content for inspection: sudo profiles show -type configuration.
4. Understand what a configuration profile is before troubleshooting one: a profile bundles one or more payloads — JSON for the newer declarative model, or the older .mobileconfig XML format — each setting one category, such as Wi-Fi, restrictions, or a Privacy Preferences Policy Control payload; more than one profile can be installed at once, and a device can carry payloads from several.
5. Recognize settings a local admin account cannot change no matter what: a payload marked as enforced by the management service overrides the same setting in System Settings, and some capabilities — bootstrap token escrow, forced update deferral, supervised-only restrictions — can only be configured by MDM in the first place.
6. For declarative configurations, expect the device to evaluate status conditions itself and report results back over time, rather than in a single request/response, which is the core difference from the older profile-push model.

Expected result

profiles status -type enrollment returns a clear enrolled/not-enrolled answer; profiles list -all names every profile that needs accounting for before assuming a setting is under local control.

Limits and test basis

profiles subcommand syntax comes from a command reference, since Apple does not publish this tool's flags as a web page; what a device management service and declarative device management are, and that some settings are MDM-only, are documented in Apple's platform deployment guide.