Post not yet marked as solved
First guesses would be:
Device doesn't have WiFi access to internet, or a firewall is blocking access to Apple's server(s).
Expired distribution profile (only good for 1 year).
Expired distribution certificate (only good for 3 years).
According to the WWDC app, "Platforms State of the Union" starts at 2:30 PM PT in the Bill Graham Civic Auditorium.
Post not yet marked as solved
An iOS Distribution Certificate can be used with many different Distribution Profiles. Just edit the profile and select the other (newer) certificate. Then I think you have to go to the Xcode preferences, choose the Accounts page, select your team, and click Download Manual Profiles. You can download the other (newer) certificate from the developer site and install it in your keychain, and I think you also have to get the corresponding private key from a machine that already has it installed and install it in your keychain. When you distribute your app in Xcode, you can choose manual signing and make sure you choose the newer certificate.
EDIT: after re-reading your post, I realized that you may be saying that the other certificate is also about to expire. If that is the case, I don't think there's anything you can do, because I think the 2-cert limit applies whether you are manually managing your certs or letting Xcode/cloud manage them.
Post not yet marked as solved
There is a similar question here, with a possible solution, but it is not specific to OIDC. I have no experience with OIDC.
Post not yet marked as solved
Our Enterprise account renewal has never required us to regenerate anything.
Post not yet marked as solved
Did you make sure your distribution profile is not expired? Also that the Distribution Certificate is not expired?
Post not yet marked as solved
Each user will have to go to the device's Settings app > General > VPN & Device Management (Device Management on older iOS versions). There should be an ENTERPRISE APP heading with a company name to tap. I don't remember the exact sequence, but you have to tap there and tell the device to trust the developer.
Post not yet marked as solved
Make sure your distribution profile (valid for one year) and the certificate it is based on (valid for 3 years) are still valid.
Post not yet marked as solved
If you don't do anything, they will stop working.
I don't know if I'd call it renewing the profile or updating the profile, but you can click on the profile (in the apple developer web site), click edit, choose the new certificate, click save, and download the updated profile.
3 - 5. Sorry, I don't have any experience with commercial MDM products in general or Intune specifically. You may be able to just put the new profiles on the server and it will push them.
Post not yet marked as solved
Last I heard, bundle IDs must be universally unique and can not be deleted for re-use:
Old Thread 1 - https://developer.apple.com/forums/thread/46407
Old Thread 2 - https://developer.apple.com/forums/thread/81233
Post not yet marked as solved
Also, you can have as many distribution profiles and apps as you want. They can use either of your active certificates.
Post not yet marked as solved
You can have two active distribution certificates. They are good for 3 years, so you normally "stagger" them by creating the second one when there is about one year left on the first one. You can revoke one before it expires, but then none of the apps signed with it, or apps using a distribution profile signed with it will run.
Post not yet marked as solved
OTA still works, that might be what they are referring to with "using the iOS App (IPA) file".
Post not yet marked as solved
No need to regenerate/redistribute app. As long as your account is renewed, the apps will work until May 2021.
Post not yet marked as solved
The plus symbol is in a blue circle after the word Certificates at the top of the list on the main Certificates page now. If it isn't there, you might not be assigned to the Admin role.
