profile manager: iOS device can delete management profile

How does one prevent deletion of management profiles?

I have marked mt "profile for everyone" -> General -> Security -> Never

I marked "never" in relevant device profile "general" setting as well.

I can push the profile & see it updated on the device. And then go to "remove profile", enter my passcode, and it's gone.

What is the trick to make a profile stick?

Thanks.

I am using Yosemite OS X Server & iOS 8 devices.