You have to send an identity certificate with the payload for the device to accept the profile. The PayloadUUID of this certificate needs to be set as the value of the IdentityCertificateUUID in the MDM dict.
Try creating a profile with the iPCU to check the format of the Credential block.