Managed Device Not Checking In or Sync Failed in ManageEngine MDM Fix
The console says the phone last checked in three days ago, your policy push sits pending, and the user swears the phone is on. Here is the systematic check order, server side first, that finds the real cause.
🎥 Full video — watch device inventory and scan actions live in the console
Every MDM action — policy, app install, location, wipe — waits for the device to check in with the server. When a device stops syncing, the console still shows it, but with a stale "last contacted" time and commands stuck in a pending state. On ManageEngine MDM Plus the causes fall into two groups: server-side (something the admin must fix in the console) and device-side (something on the phone itself). Work through them in this order and you will find it without guessing.
Inventory → Devices — Sync Health Check
Sales Phone 12 — last sync3 DAYS AGO
Policy push statusPENDING
Device powered on, user saysYes
First suspect on AndroidBattery optimisation
A stale sync time with pending commands is the signature of a communication break — not a broken policy. Fix the contact first.
1
Step 1 — Force a Scan from the Console
Start with the cheapest test:
Open Inventory → Devices, select the device and use Actions → Scan Now
Wait a few minutes and refresh — if the last-sync time updates, contact is fine and the earlier gap was just the device being off or offline
If the scan fails with a message like Unable to contact the device, move to the platform checks below
2
Step 2 — iPhone or iPad Not Contacting: Check APNs
For Apple devices, one expired certificate stops the entire fleet — and a blocked push channel stops individual devices:
Verify the APNs certificate expiry under Enrollment → APNs Certificate; renew it if the date has passed
Confirm the device itself has internet and is not stuck in airplane mode or on a network that blocks Apple push traffic
On on-premises setups, make sure the server can reach api.push.apple.com:443 and that HTTPS inspection is not intercepting Apple hosts — Apple services fail under SSL interception
3
Step 3 — Android Not Syncing: Battery Optimisation Is the Usual Killer
Modern Android aggressively sleeps background apps to save battery — and it sleeps the MDM agent too. On the device:
Open Settings → Apps → ME MDM (the ManageEngine agent) and check it is present and enabled — a missing agent means it was removed or the enrollment broke
Go to Settings → Battery → Battery optimisation (name varies by brand) and set the ME MDM app to Not optimised / Unrestricted
Open the ME MDM app once and leave it — this also re-registers its background sync
Confirm the device has working internet: open any website on mobile data and on Wi-Fi separately — a captive office Wi-Fi login page is a classic silent blocker
Brands differ in aggression: Xiaomi, Oppo, Vivo and Samsung One UI are the most common offenders. On those, also lock the agent in the recent-apps screen if the brand offers it.
4
Step 4 — Rule Out Tampering and Account Problems
If the agent is present but the device still will not talk:
Agent removed or device unenrolled: a BYOD user can remove management from their own phone at any time — the console then shows the device as unenrolled. That is their right on a personal device; talk to the user, do not treat it as a fault
Date and time wrong: a device with a badly wrong clock fails secure connections — set automatic date and time
Server unreachable (on-premises): if ALL devices stop syncing together, the problem is your server or network, not the phones — check the MDM server service and its public reachability first
🟢 How to read the pattern: one device silent = device-side cause (battery, agent, network). A few iPhones silent = check APNs. Everything silent at once = server, licence or network at your end. The pattern tells you where to look before you touch a single phone.
🎥 Watch the Complete MDM Setup in the Video
Every step shown live in the ManageEngine MDM console — enrollment, profiles, apps and security commands, in full detail.
How often does a managed device normally check in?
Devices contact the server periodically and whenever they receive a push or a network change, so a healthy device's last-sync time is usually recent the same day. A gap of several days on a phone that is switched on and online is abnormal and worth investigating.
The user says the phone is on. Why does Scan Now still fail?
Being on is not the same as being reachable. The phone may be on a Wi-Fi network with a login page pending, mobile data may be exhausted, Android may have put the MDM agent to sleep through battery optimisation, or — for iPhones — the APNs certificate may have expired on the server.
An employee removed the MDM agent from their personal phone. Can I stop that?
No — and you should not try. On BYOD devices the owner can always remove management; that is the deal that makes BYOD acceptable. On company-owned fully managed devices the agent is protected and cannot be removed, and tampering attempts are reported to the console.
This guide is based on the ManageEngine MDM video by Technical Anshu • Stuck on a step? Ask in the video comments — that is where answers come fastest 🙏