The profile must originate from a user approved MDM server

Symptoms

A configuration profile is not being installed, pma_agent.log has the following records:

11-19 14:26:00.427 D /OSDiscoveryAgent:138:307/ Remediating 'McAfee settings' ScriptSetting_34b65fb4-0616-46c7-914c-516b912d5ea2
11-19 14:26:00.428 D /PrlCommonUtils:138:307/ Started '/bin/bash' '-s' '--' 'profile_not_installed'
11-19 14:26:00.664 D /PrlCommonUtils:138:307/ Process '/bin/bash' finished with (0:0)
11-19 14:26:00.664 D /OSDiscoveryAgent:138:307/ Stdout: 'profiles install for file:'/var/tmp/12066/pma_config_profile' and user:'root' returned 13 (The profile must originate from a user approved MDM server.)profile_has_been_installed'
11-19 14:26:00.664 D /OSDiscoveryAgent:138:307/ Stderr: ''
11-19 14:26:00.664 D /OSDiscoveryAgent:138:307/ Process '/bin/bash' finished. Exit status:0 code:0.

Cause

The profile must be deployed with option "Install via MDM server" and Mac user must approve the MDM profile.

Resolution

Recreate the configuration item with enabled option "Install via MDM server" and make sure that users have approved the MDM profile: