I have two automatic profiles installed on all devices. One is a passcode requirement, and the other is a mail profile. They're not installing automatically on enrollment. However, if I simply change the Organizational Group from one group to another and right back, they're immediately applied. Obviously touching every new device by hand is cumbersome. I recently had a password issue on the account that installed the latest upgrade, but that was all resolved (as far as I know). This issue did seem to happen around the same time. I'm not sure what other services might have those credentials built in. It doesn't strike me as a password issue because of the org group moving behavior but who knows. I'm open to ideas before I put in a ticket with VMWare.