How to Remove MDM Profile Before Selling Your Phone
MDM profiles stay on the device even after you wipe it clean. Apple and Android each use enrollment programs that connect the management software directly to the phone’s hardware ID, and that data gets stored on remote servers somewhere. Reset the phone to factory settings and then try to set it up again as a new device, and the phone automatically reaches out to those servers during the activation process. At that point, the phone is going to ask for the login credentials that the new owner doesn’t have and can’t get access to. What you are left with is a phone that won’t activate - an expensive brick that nobody can use. For sellers, this situation usually means return requests, payment disputes and sometimes even accusations of fraud.
How you should remove these MDM profiles will change based on your goals. What you’ll need depends on who actually owns the device and how it was enrolled at first. A phone that you personally own but that has work software installed needs different steps than a device that your employer owns outright. Cut corners or skip parts of the removal process, and you could wind up with contract violations or legal problems to sort out. An MDM removal does take extra time before you can list that device for sale. It’s not worth it to skip this.
Let’s go over some of the steps to safely remove that MDM profile together!
How MDM Profiles Work on Your Device
MDM stands for Mobile Device Management, and it’s software that businesses install on their work phones and tablets. The main point is to protect business data and to stay in control over how those devices work. Most organizations will use it on any device that employees might take home or use outside of the office to protect sensitive company information and enforce some policies.
Your employer will usually set this up for you right after you get a company phone, and sometimes they’ll do it if you want to check work email on your own device too. After the profile gets installed on your phone, your IT department can control and manage lots of settings remotely from their office. They can push new apps to your phone without you doing anything at all. Your password policies will start to get enforced on their own and they can block access to some websites if the company policy says to.
Employers can remotely wipe the data off your phone if it ever gets lost or stolen. Most management systems have location tracking too and they’ll monitor which apps you download as well. Network settings can be controlled from anywhere too and this makes sure your device stays connected to the company servers all of the time.
Checking whether an MDM profile is installed on your phone is simple. For iPhone owners, just open up Settings and scroll down until you find a section called either Device Management or Profiles (the label varies). Android phones are a bit different - you’ll need to open Settings and then look under either Security or Accounts for an option that says Device Administrators.
Sometimes a profile will show up with your company name right there attached to it and it’s fairly obvious what you have. Other times these profiles run quietly in the background and you’ll need to dig around a bit in your settings to actually find them. Signing any paperwork about device usage or company phone policies after you first started your job usually means that an MDM profile was installed on your device at some point during that first setup process.
Lots of users find MDM profiles pretty frustrating and the biggest reason is that they run so quietly in the background without giving off any obvious signs. In most cases, you won’t even know one is active on your device until you go to change a setting and find out that the particular option has been disabled or locked down completely.
Do You Have the Legal Right
Before you remove anything, double-check that you actually have the legal right to remove that MDM profile. Who owns the device is what determines this and what you’re allowed to do with it.
Paying for the phone yourself and adding a work profile later for your job falls under what most employers call a personal device (or BYOD - Bring Your Own Device). Your employer installed that MDM software to protect their company data as it lives on a device that you actually own. Leaving the company or no longer needing access to their work systems means you can remove that software and get it back to a normal phone.
Company-owned devices are a different situation. When your employer buys the phone and gives it to you for work purposes, they still legally own that device - not you. It doesn’t matter how much you use it every day or if you make personal calls on it. What matters is who actually owns the hardware. Wiping the MDM profile off a device that technically belongs to your employer and then trying to sell it isn’t something you’re allowed to do and it can land you in legal trouble.
Find your employment paperwork if you’ve still got it tucked away somewhere. A lot of employment contracts will spell out what you should do with company devices after you leave and BYOD agreements usually include terms about how and when you’re allowed to remove those work profiles from your personal phone. It’s worth the effort to go through those documents closely because they’ll tell you what your rights are in this situation.
Removing MDM without the right authorization can land you in some real legal problems. Your former employer might accuse you of stealing their company data if you bypass any of the security measures that they put on the device. Signing an agreement that said you’d return the device or follow certain procedures after you left would give them grounds to file a breach of contract claim against you. And in extreme cases (especially when the device has very sensitive information on it) you could be looking at criminal charges.
The process is pretty simple after you leave that company when the device is your personal property. Company-owned devices are a different story though - you’ll need to return the device to your employer through the right channels or you might be able to work out a deal to buy it from them where they can officially make it yours. Make sure that you have the right authorization before you try to remove any profiles from a device that belongs (or used to belong) to your company.
How to Remove Profiles from Your Device
The removal process is going to change a little depending on which type of phone you’re working with. For iPhone users, open up the Settings app and scroll down until you see an option called VPN & Device Management - it’s the section where your installed profiles live and you should be able to see them listed out there. On Android phones, the process works a bit differently. You’ll need to go to your Security settings menu first and once you’re in there you’ll find an area labeled Device Administrators. This will show you which management software currently controls your phone.
When you go to remove a profile from the device, the system may ask you to enter a passcode before it lets you finish the removal. In most cases, that passcode was set by whatever IT department originally configured the device. The standard removal process just won’t finish without that passcode in hand.
After you remove a management profile from your device, check that the removal actually worked and you’re all set. A couple of signs should tell you pretty fast if it was successful. The management screens that were in your settings menu before will be gone and any features or settings that were restricted or locked before should be accessible again.
Newer devices have actually made this process much harder. Apple started adding stronger protections with iOS 15 and Android added similar security measures in version 12 and in the versions after that. Apple and Android designed these updates to stop anyone from removing the profiles without permission and that makes sense for keeping devices safe. The downside is that it can be pretty frustrating when you’re just trying to work on your own phone.
When the removal process gets blocked for any reason, you’re going to start seeing error messages on your screen. The exact wording will change depending on which system you’re on. But most of these messages will tell you something like “you don’t have permission to make this change.” A few of them might also tell you to contact your organization’s IT department for help with the issue.
Once the standard removal methods have failed, a factory reset will look pretty tempting - it wipes everything clean and gives you a fresh start. Management profiles can survive factory resets though. We’ll get into why that nuclear option might not give you the results you’re expecting.
Why Factory Resets Cannot Remove MDM
A factory reset won’t remove your MDM profile. Apple’s Device Enrollment Program and the Android equivalent were built to survive factory resets because the MDM enrollment connects to your device’s serial number or IMEI on a remote server. When your phone restarts, it checks back in with that server and re-enrolls itself.
Once you start the setup process, the phone is going to reach out and check in with those servers automatically. You won’t be able to stop that connection during setup. The MDM profile will reinstall itself every time you wipe the device and start over.
This is a big problem for the next person who buys your phone. When they power it up and move through the setup process, everything will look pretty normal to them. After a few screens though the phone will ask for the corporate login credentials that they don’t have and can’t get.
Apple and Google have released updates in the past year or so made these protections much stronger. The system is way harder to bypass now compared to where it was a couple of years ago - which is great for security purposes. But it can become a big problem if you forget to follow the right removal steps before you sell or give away your device.
The buyer ends up with a “bricked” device on their hands. The phone will turn on and look like it works. But it’s useless to them. It’ll either come back to you full of questions and complaints, or they’ll leave you a nasty review if you sell on a marketplace platform.
If the MDM is still on the device after a factory reset, you can’t fix this on your own. The IT department at your organization is the one with the administrative access to remove that enrollment from the management side and that’s usually the way you’ll have to go.
Contact Your IT Department First
The easiest way to get MDM off your device is to contact your IT department when you leave the company. Most organizations have a standard process where IT staff can remove the MDM enrollment from your device remotely, so you don’t have to handle any technical settings yourself. This usually happens during your exit interview or at least somewhere around that same timeframe when you hand back laptops, badges and any other company equipment they issued to you.
Have a few basic pieces of information ready when you contact IT. Most teams are going to ask you for your device serial number and your employee ID right away - these are standard requests across the board. Depending on how your company handles this, they might also need to know your last day so they can time the removal correctly. The serial number is what they mainly need here because that’s what lets them actually find your device inside their management software.
Many organizations have self-service portals that let you submit a device removal request without having to go through a few different staff members first. I’d recommend checking in with your IT team to see if that’s something they have at your company. If they do have a portal like this available, you’ll probably get your request processed much faster and it saves everyone involved a fair amount of hassle.
IT departments are actually on your side with this and for real reasons. Any device that leaves the company needs to have the MDM profile removed from it or their sensitive data stays at risk and their security systems stay vulnerable. Your IT team wants your phone cleared the right way just as much as you do - and probably more since it’s their responsibility to make sure that it happens.
The biggest problem comes up if you have to contact IT after your last day at the company. Access to your work email and the internal systems will be cut off once you’re officially done and it makes it way harder to communicate with anyone there. Try to get the MDM removal taken care of when you leave. In case the timing doesn’t work out and you do reach out after you’ve left, just hang onto copies of any removal requests you send. That documentation can come in useful if any questions pop up later.
The IT department on the company’s side can also confirm once they’ve actually removed the MDM profile from their system. Having that confirmation helps quite a bit because it gives you some reassurance - you’ll know that the MDM profile has been removed and everything is finalized on their end.
Trade Your Old Phone for Cash Today
To remove an MDM profile correctly takes a bit of extra effort - I’ll admit that much. Anyone who tries to bypass security measures or sells a device with management software still on it will run into problems - legal ones and technical ones. Your best bet is to take care of everything through the official channels and document each step. Get approval from your IT department, verify the owner of the device and make sure that the profile has been removed before you list anything for sale.
MDM removal policies have changed quite a bit over the last few years and the right way matters a lot more now than it did before. Businesses and schools are locking down their devices much harder than they used to and tricks that worked just a year or two ago are useless now. Remove the MDM in the legitimate way and you don’t have to worry about any of the usual problems. No angry calls from whoever bought your device, no legal issues and no returns that show up weeks later because the buyer claims that the device is locked or stolen.
After you take care of the MDM removal, we at ecoATM offer a pretty convenient way to turn your old phone into cash fast. We have over 6,000 kiosks all across the country and each one can test your device right there. All you’ll have to do is bring your phone in, wait for the automatic assessment to finish and then walk out with either cash in hand or a payment that hits your account the same day.
It’s a win for your wallet and a win for the planet at the same time and makes it a solid choice when you’re ready to upgrade to something newer. You can look up a kiosk near you and see what your phone is worth right now.
