top of page

MDM Removal Before IT Disposal: Business Device Offboarding Guide

Correct offboarding removes active device management, automated enrolment and account or activation controls before business IT equipment is reset, collected or processed.

MDM and device-management platforms to check

  • Intune · Windows Autopilot: Remove the device from active management and any automated enrolment or deployment records that could reapply control after reset.
  • Apple Business Manager / School Manager: Release organisational assignment and check Activation Lock / Find My status before the device leaves your control.
  • Knox Mobile Enrollment: Remove the device from Knox enrolment where applicable so management is not automatically restored during setup.
  • Jamf: Remove management records and any deployment or activation controls used by the organisation.
  • Workspace ONE: Retire or unenrol the device and clear automated enrolment relationships where configured.
  • Google FRP / Apple Activation Lock: Check user-account and activation protections as a separate step; a factory reset alone may not release them.

Phase 01: Identify

Know what is managed before you start.

Step 01: Confirm the device and owner

Record serial number, asset tag, assigned user and the organisation or tenant that currently controls the device.

Step 02: Identify the management platform

Confirm whether the device is controlled by Intune, Autopilot, ABM/ASM, Knox, Jamf, Workspace ONE or another MDM platform.

Step 03: Check account and activation protection

Identify Apple Find My / Activation Lock, Google FRP and other user-account controls that can remain after reset.

Phase 02: Release

Remove organisational control before reset.

Step 04: Retire or unenrol the device

Use the management platform to retire, unenrol or otherwise remove active management from the device.

Step 05: Remove automated enrolment

Clear Autopilot, Apple automated device enrolment, Knox enrolment or equivalent deployment records that can reapply management.

Step 06: Release organisational ownership

Where the platform separates ownership from active management, remove the organisation assignment as well as the MDM profile.

Phase 03: Unlock

Remove barriers that can survive the wipe.

Step 07: Remove activation locks

Sign out of user accounts and disable Find My / Activation Lock or Google account protection where required.

Step 08: Remove firmware restrictions

Clear BIOS, UEFI, firmware or management passwords that would prevent testing, secure processing or reuse.

Step 09: Retain recovery information until verified

Keep relevant recovery keys or administrative access available until the device has been confirmed released and ready for processing.

Phase 04: Verify

Prove the device is really free of management.

Step 10: Allow platform changes to synchronise

Some removals are not instantaneous. Confirm the management service has accepted the change before treating the device as released.

Step 11: Recheck the device record

Confirm the serial number or hardware identity no longer appears in the relevant active management or automated deployment list.

Step 12: Record exceptions before collection

Flag devices that could not be released so they can be identified, stored and handled separately during processing.

Common MDM offboarding mistakes

  • Factory reset only: Resetting the device does not necessarily remove cloud management, automated enrolment or activation locks.
  • Removing only the MDM profile: A device can be unenrolled yet remain in Autopilot, ABM/ASM, Knox or another automated deployment service.
  • Deleting the user too early: Removing access before confirming the device is released can make activation-lock or recovery steps harder.
  • Assuming wipe means reusable: A securely erased device may still be unusable for refurbishment if organisational or activation controls remain.
  • No exception list: Unresolved locked devices are much easier to manage when serial numbers and the suspected control are recorded before collection.
  • Waiting until collection day: Large estates should be checked in advance; management-platform changes may need time to synchronise.

Locked devices and additional administration

Unresolved management or activation controls can reduce reuse potential. A £10 administration charge per locked device may apply where extra identification, client contact, remote-removal assistance, storage, rechecking or reprocessing is required.

Preparing equipment for collection · Secure data destruction · Knowledge Centre

bottom of page