Removing MDM Locks Before Disposal

Part 1: Windows Devices (Intune, Autopilot, & Entra ID)

To prevent orphaned records and ensure a clean handoff, Windows devices must be decommissioned in a specific order.

Step 1: Wipe and Delete from Microsoft Intune

1. Sign in to the Microsoft Intune admin center.
2. Navigate to Devices > Windows.
3. Search for and select the device. (Pro-tip: Copy the serial number now—you will need it for Step 2).
4. Select Wipe from the top toolbar to securely erase the operating system and user data.
5. Once the wipe command is confirmed successful, select Delete to remove the device from Intune management.

Step 2: Deregister from Windows Autopilot (Critical)

If this step is skipped, the device’s hardware hash remains tied to the company tenant, and the next buyer will be trapped at a corporate login screen.

1. In the Intune admin center, go to Devices > Windows > Windows enrollment.
2. Under the Windows Autopilot section, select Devices.
3. Search for the device using the serial number.
4. Select the checkbox next to the device. If a user is still assigned, click the extended menu (...) on the right and select Unassign user.
5. Click Delete from the top toolbar and confirm. (Note: It may take up to 15 minutes for the removal to fully sync).

Step 3: Remove from Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center (formerly Azure AD).
2. Go to Identity > Devices > All devices.
3. Search for the device. If the device was fully cloud-joined, the Intune and Autopilot deletions may have already removed it.
4. If the device record is still present, select it and click Delete.

Important for Hybrid Environments: If the device was Microsoft Entra Hybrid Joined, do not delete it directly from Entra. You must delete the computer object from the on-premises Active Directory (AD DS) environment and allow the deletion to sync to the cloud.

---

Part 2: Apple Devices (MDM, ABM, & Activation Locks)

Apple hardware requires a permanent release from Apple's enterprise servers to prevent Remote Management (MDM) profiles from reapplying during the out-of-box experience.

Step 1: Wipe and Remove from the MDM (Intune, Jamf, Workspace ONE, etc.)

1. Log into your specific MDM console.
2. Locate the macOS, iOS, or iPadOS device.
3. Issue a Device Wipe / Erase Device command.
4. Once the wipe is acknowledged by the device, Delete or Retire the device record from the MDM.

Step 2: Release from Apple Business Manager (ABM)

Removing the device from the MDM is not enough; it must be disowned at the Apple server level.

1. Sign in to Apple Business Manager (or Apple School Manager) using an administrator account.
2. Navigate to Devices > Inventory.
3. Search for the device by its Serial Number.
4. Select the device, click the action menu, and choose Release from Organisation.
5. Read the warning, check the box confirming you understand the action is permanent, and click Release.

Step 3: Clear iCloud Activation Lock / Find My

If an employee logged into the device with a personal Apple ID and enabled "Find My," the device will be Activation Locked to their account.

• Proactive MDM Bypass: Most MDMs capture an Activation Lock Bypass Code. Retrieve this code from the MDM before you delete the device record. You can enter this code in the password field on the Activation Lock screen.
• User Removal: The previous user can remotely release the hardware by logging into iCloud.com/find, selecting the device, and clicking Remove from Account.
• Apple Support: As a last resort, if Revolve ITAD Solutions has the original proof of purchase from the client, you can submit an Activation Lock Support Request directly through Apple's business portal.