How to Prevent Users from Removing an MDM Enrollment Profile on iOS?

Hello everyone!

I'm a software engineer currently working on the development of a Mobile Device Management (MDM) system.

I'm trying to implement a restriction that prevents users from manually removing the MDM enrollment profile from their iOS devices.

While researching Apple's Device Management documentation, I came across two configurations that seem related to this functionality:

PayloadRemovalDisallowed: A Boolean key that appears to control whether users can remove a configuration profile.

com.apple.profileRemovalPassword: A payload that allows a removal password to be configured using the RemovalPassword key.

However, after attempting to implement these configurations in our .mobileconfig files, I haven't been able to achieve the expected behavior. In some cases, these changes also interfere with our device enrollment process, preventing devices from successfully enrolling in our MDM system.

Questions

What is the correct way to use PayloadRemovalDisallowed and com.apple.profileRemovalPassword within a .mobileconfig file? Should they be used together, or are they intended for different scenarios?

Where exactly should these configurations be placed? Should PayloadRemovalDisallowed be defined at the root level of the configuration profile, while com.apple.profileRemovalPassword is included as a separate payload inside PayloadContent?

Can these configurations be included directly in the MDM enrollment profile? Or should they be delivered through a separate configuration profile after successful enrollment?

Do these configurations require the device to be supervised? Is it possible to prevent profile removal on manually enrolled devices, or is Automated Device Enrollment (ADE) required?

Why might these configurations interfere with device enrollment? Are there any restrictions on combining an MDM payload (com.apple.mdm) with a profile removal password payload?

Does setting PayloadRemovalDisallowed to true actually prevent removal of the MDM enrollment profile itself, or does it only apply to regular configuration profiles?

Is there any supported way to make an existing MDM enrollment profile non-removable after enrollment?

Could someone provide a working .mobileconfig example demonstrating the correct implementation of these configurations?

Expected Behavior

Once a device has been successfully enrolled in our MDM system, the user should not be able to remove the MDM enrollment profile manually through the device settings.

Ideally, this restriction should not interfere with the initial enrollment process or subsequent communication between the device and our MDM server.

Current Behavior

When attempting to configure PayloadRemovalDisallowed and com.apple.profileRemovalPassword, the expected removal restriction does not work correctly, and the enrollment process may fail.

I'm trying to understand whether this is caused by incorrect placement of the configuration keys, limitations imposed by the enrollment method, or specific Apple device management requirements.

Any guidance, official documentation, or working implementation examples would be greatly appreciated.

Thank you in advance for your help!