How to Release Company Devices from MDM Before Selling

The one thing that kills a corporate buyback

Every other issue with a fleet sale is negotiable. Scratched lids, dead batteries, missing chargers, mixed model years, all of it just changes the number. Management enrolment is different, because it does not change the number, it removes the device from the deal entirely.

The reason is simple. Modern enrolment is enforced by a server, not by the device. Wiping the machine does not help; it makes it worse, because on the next setup the device asks the enrolment server who owns it and gets the answer "you do". Until an admin in your organisation removes that record, the device is permanently yours, whether you still want it or not.

So the release step belongs in your decommissioning process, not in the handover conversation. If you are planning a corporate buyback, run the checklist below before the devices leave your office.

Step 1: Build the asset list first

Before touching any settings, export what you have. You need this for the quote anyway, and you need it to confirm nothing gets missed.

• Serial number and IMEI (phones) for every unit
• Model, year, storage; for laptops also chip, RAM, SSD
• Which MDM or enrolment system each device sits in
• Assigned user, so you know whose accounts need releasing
• Rough condition, working, cosmetic damage, or faulty

Pull this from your MDM console rather than a stock spreadsheet. The console is the source of truth for what is actually still enrolled, and that is the list that matters.

Step 2: Release Apple devices (iPhone, iPad, Mac)

Apple hardware bought through a reseller is usually tied to Apple Business Manager (ABM), and separately managed by an MDM such as Intune, Jamf, or Kandji. You have to clear both.

1. Wipe or retire in the MDM first. In your MDM console, issue an erase or retire command while the device is still online and reachable. Doing this while you still have control is far easier than chasing it later.
2. Delete the device record from the MDM. Retiring removes the profile; deleting removes the record. Do both.
3. Release the device in Apple Business Manager. Sign in to business.apple.com → Devices → select the serial numbers → Release Device. This is the irreversible step that actually frees the hardware. Note that once released, you cannot re-add that device to ABM by serial number, which is exactly what you want when selling.
4. Confirm Activation Lock is off. Managed Activation Lock can survive a wipe. Clear it from the MDM before releasing, or the device stays locked to your organisation. An Activation Locked device cannot be bought by anyone.
5. Sign out personal Apple Accounts. On devices where staff signed in with their own Apple Account, that account must be removed too, otherwise you get standard Activation Lock on top of everything else.

Step 3: Release Android devices

1. Android Enterprise / zero-touch: remove the device from your zero-touch portal, otherwise it re-provisions on setup, the Android equivalent of the ABM problem.
2. Google Workspace: in the Admin console, go to Devices → Mobile & endpoints, wipe the corporate profile, then delete the device record.
3. Remove the Google account (FRP) before the reset. Factory Reset Protection is triggered by an account left signed in at the moment of reset. Remove all accounts first, then reset.
4. Samsung Knox: if the units were enrolled via Knox Mobile Enrolment, delete them from the Knox portal as well. Knox enrolment is independent of your MDM record.
5. Check the SIM situation. Corporate lines are often on telco contracts. We cannot buy telco-locked Android devices, so confirm the units are not carrier-locked before you list them for sale.

Step 4: Release Windows laptops

1. Windows Autopilot: delete the Autopilot device registration in Intune. If you skip this, the laptop re-enrols itself on first boot after a reset, exactly like ABM on Apple hardware.
2. Entra ID / Azure AD: delete the device object so it stops appearing as a managed asset.
3. Intune: retire or wipe, then delete the record.
4. BitLocker: the device must be decrypted or fully reset. Handing over an encrypted drive without keys means the buyer cannot verify the machine, which usually means it cannot be quoted.
5. BIOS and firmware passwords: clear them. A supervisor password on a corporate laptop is a hard blocker, and it is easy to forget these were ever set.
6. Deactivate licensed software (Adobe, Office, engineering or design tools) so the seats return to your pool. This is money you leave on the table otherwise.

Step 5: Wipe, then verify

Reset every device to the out-of-box welcome screen and then check the release actually worked, on a sample if the batch is large:

• Connect the device to Wi-Fi during setup. If it prompts for a management profile, an organisation sign-in, or a previously synced account, the release did not take.
• On iPhone and iPad, look for "Remote Management" during setup. That screen means ABM still holds the device.
• On Windows, watch for a corporate branding screen or a forced work-account sign-in.

Be clear on scope while you plan this: we perform a thorough factory reset on everything we take in, but we do not run certified data-destruction software and we do not issue erasure certificates. If your internal policy requires that, do it before handover. What we do provide is buyback and value recovery for phones and laptops, collection in selected Klang Valley areas, and an official invoice on request.

Step 6: Hand over and get paid

With the fleet released and wiped, the commercial side is straightforward:

1. Send us the device list, model, storage, specs, rough condition.
2. We come back with an estimated batch quote.
3. Arrange collection in selected Klang Valley areas, courier, or drop-off at Sentul.
4. Physical inspection confirms the final figure per unit, with anything that differs from the list flagged back to you.
5. Payment, with an official invoice on request.

If the batch also includes units that are genuinely dead or beyond resale, read IT asset disposal in Malaysia for how the value-recovery and recycling paths differ, and message us the list when you are ready.