Disabling "Allow Safari" for iOS devices may prevent users from loading the configuration profile.

If disabling Safari is necessary, one solution is to introduce a SCEP server into the environment, which enables profile updates to be pushed to the device without user involvement.