MDM Removal Before IT Disposal: Business Device Offboarding Guide

Record the serial and management identity, preserve required recovery information securely, and choose the appropriate Intune retirement or wipe action for the intended outcome. Allow the device to check in and verify the result. Separately follow Microsoft's deregistration process for the Windows Autopilot registration: removing a profile assignment is not the same as deregistration.

Review any remaining Microsoft Entra identity and other management relationships using the current platform guidance. Where Windows Autopilot device association is used, follow its distinct removal process as well; removing a list entry alone may not clear an association already stored on the device.

After the approved reset and synchronisation, verify setup does not restore your organisation's enrolment. Keep unresolved devices on the exception list rather than marking them released.

Microsoft guidance: Retire · Wipe · Delete · Autopilot Reset · Autopilot registration · Device association removal.

Apple organisation assignment, the active MDM profile and Activation Lock are separate checks. Use the authorised account or management route to turn off Activation Lock before releasing ownership. A wipe from Jamf or another MDM does not, on its own, prove that the organisational assignment has been released.

Follow the release workflow for the Apple portal your organisation uses. Apple describes released devices as remaining in the inventory with a Released status; do not mistake that retained history for an active assignment. After release, erase and restore as required, then verify that setup no longer requires the previous organisation or user's credentials.

Apple's current device-release guidance explains the Activation Lock restriction and the required erase/restore step. Interface names may differ between Apple Business, Business Manager and School Manager.

Check active Android Enterprise management, zero-touch registration, Knox Mobile Enrollment where used, and Google Factory Reset Protection separately. A reset can reinstall management when automated enrolment remains configured.

For an ownership transfer, Google's guidance calls for deregistration from zero-touch. Selecting No config temporarily excludes a device from automatic enrolment but is not the same as deregistering it. Verify the serial or IMEI before deregistering; re-registration requires the reseller.

For Samsung devices, complete the authorised unenrolment and Knox Mobile Enrollment removal steps for your setup. Check other relevant Knox services and account protection too. Do not assume clearing an enrolment profile also removes every lock. Record what was actually removed and what remains pending.

Vendor guidance: Google zero-touch device administration · Knox Manage unenrolment · Knox Mobile Enrollment device removal.

For Jamf, Workspace ONE, Ivanti and other systems, have the responsible IT administrator document the platform-specific removal action and the separate deployment services it uses. Removing one agent or management record is not a substitute for checking every applicable enrolment and activation relationship.

Before collection, check BIOS/UEFI administration and boot restrictions as well as MDM. Retain the authorised support route for controls such as HP Sure Admin or Dell BIOS administration; record unresolved restrictions against the device serial. Do not put passwords, recovery keys or temporary unlock codes in the client collection spreadsheet.

Record the device serial/asset tag, platform, original lock finding, removal result, check date and a contact able to resolve exceptions. Keep requested, pending, failed and verified results distinct. A client declaration remains separate from Bioteknik's subsequent inspection and data-treatment records.