Methods and systems for detecting profile changes based on device behavior. One example method includes assigning a network configuration to a device associated with a network, applying a mobile device management (MDM) profile to the device, the MDM profile including settings configuring the device according to the network configuration, monitoring network activity of the device to detect one or more actions by the device that are prohibited by the network configuration, determining that the MDM profile has been altered based at least in part on the detection of one or more actions prohibited by the network configuration, and performing a remediation action associated with the device based on the determination that the MDM profile has been altered.