From 540b225d59762c268b8f840c93bc6cfb6581085b Mon Sep 17 00:00:00 2001
From: Konstantin Sykulev <konst@sykulev.com>
Date: Thu, 9 Jul 2026 10:30:05 -0500
Subject: [PATCH 1/2] Android enrollment debug logging

---
 server/mdm/android/service/profiles.go | 10 ++++++++++
 server/mdm/android/service/pubsub.go   | 23 ++++++++++++++++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/server/mdm/android/service/profiles.go b/server/mdm/android/service/profiles.go
index f86431827bc..8831542d704 100644
--- a/server/mdm/android/service/profiles.go
+++ b/server/mdm/android/service/profiles.go
@@ -192,6 +192,10 @@ func (r *profileReconciler) ReconcileProfiles(ctx context.Context, cursor string
 		bulkHostProfs = append(bulkHostProfs, bulkProfs...)
 	}
 
+	if hostCount > 0 {
+		r.Logger.InfoContext(ctx, "android profile reconciler processed hosts", "host_count", hostCount, "profile_count", len(bulkHostProfs))
+	}
+
 	if err := r.DS.BulkUpsertMDMAndroidHostProfiles(ctx, bulkHostProfs); err != nil {
 		return 0, ctxerr.Wrap(ctx, err, "bulk upsert android host profiles")
 	}
@@ -443,6 +447,12 @@ func (r *profileReconciler) sendHostProfiles(
 			}
 		}
 	}
+
+	if skip && !policyReq.PolicyVersion.Valid {
+		r.Logger.WarnContext(ctx, "android policy patch returned not-modified without a version; profiles will have nil IncludedInPolicyVersion",
+			"host_uuid", hostUUID, "policy_request_uuid", policyReq.RequestUUID, "status_code", policyReq.StatusCode,
+			"profile_count", len(bulkProfilesByUUID))
+	}
 	if patchPolicyReqFailed {
 		appendWithheld()
 		return slices.Collect(maps.Values(bulkProfilesByUUID)), nil
diff --git a/server/mdm/android/service/pubsub.go b/server/mdm/android/service/pubsub.go
index 9bcdb3311a9..1fd9fe6e1ae 100644
--- a/server/mdm/android/service/pubsub.go
+++ b/server/mdm/android/service/pubsub.go
@@ -1067,7 +1067,8 @@ func (svc *Service) getPolicyID(ctx context.Context, device *androidmanagement.D
 func (svc *Service) verifyDevicePolicy(ctx context.Context, hostUUID string, device *androidmanagement.Device) {
 	appliedPolicyVersion := device.AppliedPolicyVersion
 
-	svc.logger.DebugContext(ctx, "Verifying Android device policy", "host_uuid", hostUUID, "applied_policy_version", appliedPolicyVersion)
+	svc.logger.DebugContext(ctx, "Verifying Android device policy", "host_uuid", hostUUID, "applied_policy_version", appliedPolicyVersion,
+		"non_compliance_count", len(device.NonComplianceDetails))
 
 	// Get all host_mdm_android_profiles that are pending or failed due to non compliance reasons,
 	// and included_in_policy_version <= device.AppliedPolicyVersion. That way we can either fully
@@ -1080,6 +1081,9 @@ func (svc *Service) verifyDevicePolicy(ctx context.Context, hostUUID string, dev
 		return
 	}
 
+	svc.logger.DebugContext(ctx, "pending install profiles for verification", "host_uuid", hostUUID,
+		"pending_count", len(pendingInstallProfiles), "applied_policy_version", appliedPolicyVersion)
+
 	// First case, if nonComplianceDetails is empty, verify all profiles that are pending or failed install, and remove the pending remove ones.
 	if len(device.NonComplianceDetails) == 0 {
 		var verifiedProfiles []*fleet.MDMAndroidProfilePayload
@@ -1121,6 +1125,23 @@ func (svc *Service) verifyDevicePolicy(ctx context.Context, hostUUID string, dev
 			}
 		}
 
+		if policyRequestUUID == "" {
+			var nilPolicyReqCount, nilVersionCount int
+			for _, p := range pendingInstallProfiles {
+				if p.PolicyRequestUUID == nil {
+					nilPolicyReqCount++
+				}
+				if p.IncludedInPolicyVersion == nil {
+					nilVersionCount++
+				}
+			}
+			svc.logger.WarnContext(ctx, "no matching policy request UUID found for non-compliance verification",
+				"host_uuid", hostUUID, "applied_policy_version", appliedPolicyVersion,
+				"pending_profiles", len(pendingInstallProfiles),
+				"nil_policy_request_uuid", nilPolicyReqCount, "nil_included_in_policy_version", nilVersionCount,
+				"non_compliance_count", len(device.NonComplianceDetails))
+		}
+
 		// Iterate over all policy request uuids, fetch them and unmarshal the payload into the type.
 		// Then re-use the map above, so we can iterate over it again, but now the payload is already unmarshalled.
 		policyRequest, err := svc.ds.GetAndroidPolicyRequestByUUID(ctx, policyRequestUUID)

From 4e36f6776136cb286c1e88bb7790f229e665c729 Mon Sep 17 00:00:00 2001
From: Konstantin Sykulev <konst@sykulev.com>
Date: Thu, 9 Jul 2026 10:52:19 -0500
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 server/mdm/android/service/profiles.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/mdm/android/service/profiles.go b/server/mdm/android/service/profiles.go
index 8831542d704..d14ce3bb817 100644
--- a/server/mdm/android/service/profiles.go
+++ b/server/mdm/android/service/profiles.go
@@ -193,7 +193,7 @@ func (r *profileReconciler) ReconcileProfiles(ctx context.Context, cursor string
 	}
 
 	if hostCount > 0 {
-		r.Logger.InfoContext(ctx, "android profile reconciler processed hosts", "host_count", hostCount, "profile_count", len(bulkHostProfs))
+		r.Logger.DebugContext(ctx, "android profile reconciler processed hosts", "host_count", hostCount, "profile_count", len(bulkHostProfs))
 	}
 
 	if err := r.DS.BulkUpsertMDMAndroidHostProfiles(ctx, bulkHostProfs); err != nil {