MDM enrollment processes present on my iPhone without my authorization

I have been having the same issues with my current iPhone 13 purchased in May 2025 that I've had with past iPhones since 2013, specifically the inability to back it up to my iCloud. I executed sysdiagnose 11-23-25 after recently learning that it is a good tool to use in diagnosing problems with the device. i opened one of the first files I came across in its main folder named "jetsam_priority," which contains 397 processes. Listed within those are: managedappdistributiond, ManagedSettingsAgent, dmd, and betaenrollmentd. I have not authorized enrollment in MDM or beta, and no one except me has had physical access to my iPhone. There also are no visible profiles in my iPhone's settings.

Does anyone have any input on how this situation could happen or why these processes would be present? I read online that covert MDM enrollment is possible, although rare. Does anyone know anything about this?

[Re-Titled by Moderator]

Original Title: Covert MDM Enrollment?

Posted on Nov 27, 2025 8:05 PM

Top-ranking reply

lobsterghost1

Community+ 2025

Level 10

183,221 points

Posted on Nov 27, 2025 8:11 PM

If you open Settings > General > VPN & Device Management, if you don't see anything listed there you DON'T have an MDM installed on your phone, period. Whatever 3rd party you're using is suspect as there are no tools, which can accurately read the file structure of an iPhone. I'd say you're letting some 3rd party tool spook you.

View in context

43 replies

Nov 27, 2025 8:41 PM in response to 000over_it000

If you have installed any profile on your own --> Install or remove configuration profiles on iPhone - Apple ...

Nov 28, 2025 1:10 AM in response to lobsterghost1

It's unfortunate that questions by consumers who maybe aren't as tech-savvy as some others, but have a legitimate concern nonetheless, get defensive and/or insulting responses on this forum. Unfortunately, I haven't been able to get any answers directly from Apple, because they "don't get involved in these types of issues," which is why I came here.

Since I am so off-base here, perhaps someone can tell me why in my cellular usage under System Services it lists "Corporate Accounts." Or does that show up on everyone's iPhone that isn't enrolled in MDM, too?

I truly wish I could afford to go buy a bunch of books on how to collect and decipher sysdiagnose logs or hire a forensic analyst to answer my questions; however, I am disabled and live off of modest disability benefits that don't offer me that kind of expendable income.

Nov 28, 2025 1:24 AM in response to 000over_it000

000over_it000 wrote:

Since I am so off-base here, perhaps someone can tell me why in my cellular usage under System Services it lists "Corporate Accounts." Or does that show up on everyone's iPhone that isn't enrolled in MDM, too?

Yep. Totally normal. Shows up in mine too.

Nov 28, 2025 1:41 AM in response to lobsterghost1

Forgive me for jumping to conclusions based on my limited knowledge of iPhone processes. To the average person, it's alarming to see processes running that you as a consumer don't use, which is apparently the norm in iOS. In my own defense, I am perhaps a little presumptuous here because I opened up my new Gmail account yesterday, which I've used once for email purposes, and found that there are 66 services listed in my Google Takeout, two of which are developer-related.

LD150

Level 10

99,499 points

Nov 28, 2025 1:58 AM in response to 000over_it000

000over_it000 wrote:

And yes, it shows backup here, but there's no backup in my iCloud account, so I have no idea what's going on.

Your thirst for knowledge is bordering on paranoia.

Like many helpers on here, am an invited beta tester, thats the only time I come across sysdiagnose. Know what? I only once tried to read it and realised it was for Apple computers to read, not people.

You are not the hero who will find the spy bug nobody else can see, just relax and enjoy the iphone.

Nov 28, 2025 2:16 AM in response to 000over_it000

Re: “I truly wish I could afford to go buy a bunch of books on how to collect and decipher sysdiagnose logs”

I doubt if there are such books available to the general public, even through Apple’s Developer program and online Developer documentation. Something meant only for Apple and/or carriers to use might well have references to things that only employers with access to source code and development tools would have a chance of fully understanding.

Nov 28, 2025 3:59 PM in response to TT123B

TT123B wrote:

why do people always suggest check VPN settings etc.

Because VPNs alter network routing, add privacy exposures, add connection overhead, and can add other surprises.

Some VPN-related fodder to ponder:

when iam in screen time and share across devices. Iam asked for my age. Its as if I have a child account

What service or mechanism or prompt is asking for your age? Websites routinely ask that, snd those prompts are presently unrelated to your Apple Account.

It would be best to start your own new thread for this prompting question too, as unspecified-origin age-related prompts seemingly have no linkage to concerns arising while reading telemetry-related logs, and mixed threads tend to get confusing for readers and respondents alike.

LD150

Level 10

99,499 points

Nov 29, 2025 2:36 AM in response to TT123B

TT123B wrote:

why do people always suggest check VPN settings etc.

...

Because VPN very often kills iPhone connectivity. We don't recommend checking settings, most of us recommend complete uninstallation.

Sorry, already been answered by Mr H.

LD150

Level 10

99,499 points

Nov 30, 2025 1:06 AM in response to 000over_it000

000over_it000 wrote:

<MCState.log from summaries folder of sysdiagnose.log>

At the risk of being called crazy or paranoid....

Crazy no, paranoid you're on your way. Technochondriasis, definitely.

Nov 30, 2025 8:09 AM in response to MrHoffman

I've been the target of relentless, sophisticated hacking and surveillance for 12 years, first becoming aware when I opened my macBook in 2013 and watched a remotely controlled cursor opening up saved screenshots of my text messages from my iPhone, which I didn't take. I know two of the individuals responsible, and I can assure you it's not that I am anyone important, it's just that one of them is filthy rich and the other worked for McK***ey for 30+years in global ops, and they both enjoy destroying peoples' lives as if it were a sport. I can't tell you how many iPhones I've gone through, and factory resets don't work. Android phones end up hacked/managed/controlled about a million times worse. I'm sure we ALL can agree that Apple makes a much higher quality and more secure product - unfortunately, just not secure enough to keep these cyberterrorists, who have completely eliminated any semblance of privacy I once had, OUT of my phone.

I still have and use the iPhone because I just bought it last May and I can't afford to buy another one. And I don't even USE wifi, they do.

Nov 30, 2025 8:26 AM in response to 000over_it000

Why do you still even have any of this gear, given you’ve reportedly “been the target of relentless, sophisticated hacking and surveillance for 12 years”?

Given the reported dozen years and ongoing, this present strategy involving forum postings and such has abjectly failed.

Or there's something else happening, though whatever that might be is unclear. Maybe some of it was Image Capture opening on connection as can be configured, and offering to import benign screenshots from the iPhone camera roll, for instance. And maybe what was posted here is verified locally, using your own device and your own tests such as an attempted Wi-Fi connection that an MDM enrollment and payload would block.

But again, twelve years of reported unresolved issues is not going to get solved around here. You’ve already gotten all the standard suggestions and multiple times, considered them, and acted on each as appropriate.

Nov 30, 2025 8:35 AM in response to MrHoffman

We can be done with this entire conversation after this post. To answer your whys, because I have tried everything else, including countless reports sent to IC3, which either don't make it to the intended recipient or simply are ignored. I WILL attempt to try some of the options you mentioned. I have already stated that I'm not well-versed in the technical aspects of electronic devices, especially device management as the result of malicious software or exploits. I've had to learn as I go, and there's A LOT yet for me to learn.

Nov 30, 2025 8:42 AM in response to FelipeV

Funny you mention my online identity. My credit reports, after disputing and removing the fraudulent data, are now empty. Not sure where the factual data went. And I have a very hard time verifying my own identity these days.

Nov 30, 2025 9:47 AM in response to MrHoffman

I have one device: this iPhone. I don't share, pair or sync with anything or anyone. I don't even know how Bluetooth gets paired with iCloud, because I've never used Bluetooth myself, but that's one constant I see, even though it remains toggled off on my iPhone.

Nov 30, 2025 12:00 PM in response to MrHoffman

This is truly way over my head. I did want to share a couple more points, though, that may be relevant?

logs>MCState>Shared>PublicInfo>MCMeta.plist references "AllowedGrandfatheredRestrictions" and "LastMDMMigratedBuild"; and also in Shared folder is MCSettingsEvents.plist, which I mentioned earlier, and it shows this after each setting: "value: set", "process: MCRestrictionManagerWriter.Recompute

EffectiveUserSettings". The "forced" settings I referenced earlier in Truth.plist correspond with these settings. This is all basically foreign to me. Like I said, I have a lot to learn regarding MDM. I do appreciate your input.

MDM enrollment processes present on my iPhone without my authorization