What Is MDM Lock? How to Check If a Phone or Mac Is Managed

You buy a cheap MacBook or iPhone, erase it, and during setup a screen appears: “Remote Management — [Company name] can automatically configure your Mac.” You can’t skip it. That’s an MDM lock, and it means the device still belongs, on paper, to a business or school.

MDM devices are a growing share of the used market as companies refresh their fleets. Some are released properly; many aren’t. Here’s how MDM works, how to check any iPhone, iPad, Mac or Android before you buy, and the only legitimate way to get it removed.

What MDM means

MDM (Mobile Device Management) is software organizations use to control their phones, tablets and computers. An administrator can push apps and Wi-Fi settings, enforce passcodes, block features, see device details and remotely lock or erase the device.

There are two very different levels:

• Profile-based enrollment — someone installed a management profile manually. It can usually be removed in Settings, and erasing the device removes it.
• Automated enrollment — the device’s serial number is registered to the organization in Apple Business Manager or Apple School Manager (Automated Device Enrollment, formerly called DEP). Every time it’s erased and set up again, Apple’s servers send it back to the company’s MDM. This is the “MDM lock” people mean, and resetting doesn’t remove it.

Android has an equivalent: Android Enterprise zero-touch enrollment and, on Samsung, Knox Mobile Enrollment. A registered device re-enrolls in the company’s management after a factory reset.

Signs a device is managed

iPhone and iPad

• During setup: a Remote Management screen naming an organization.
• On a working device: Settings › General › VPN & Device Management lists a management profile or “Mobile Device Management”.
• A line at the top of Settings or on the lock screen saying the device is supervised or managed by an organization.

Mac

• During setup: the Remote Management screen.
• In macOS: System Settings › General › Device Management (older versions: System Preferences › Profiles) shows an MDM profile.
• Company apps you can’t delete and settings that are grayed out.

Android

• During setup: “This device belongs to your organization” or a prompt to install a company app.
• On a working device: a work profile, or apps listed in Settings › Security › Device admin apps (the menu name varies by brand), such as a device policy or Knox management app you can’t deactivate.

How to check MDM status on a Mac with Terminal

On a Mac that boots to the desktop, Terminal gives you a definitive answer in seconds. Open Applications › Utilities › Terminal and run:

sudo profiles status -type enrollment
sudo profiles show -type enrollment

Enter the Mac’s login password when asked (nothing appears as you type). The first command shows two lines:

• Enrolled via DEP: Yes — the serial is assigned to an organization through Automated Device Enrollment. Expect the Remote Management screen after an erase.
• MDM enrollment: Yes — the Mac is currently managed. “Yes (User Approved)” means it was enrolled with user approval.

The second command asks Apple for the device’s enrollment record. If it’s assigned to an organization, you’ll typically see configuration details that can include the organization name; if not, it reports that no configuration was found or that the device isn’t assigned. Both lines saying No is what you want on a used Mac. More commands are in our Mac Terminal serial and MDM commands guide.

Check MDM status by IMEI or serial number

Terminal only works on a Mac you can unlock, and iPhones don’t have it at all. For any Apple device — including one you haven’t seen yet — use a remote check:

• MDM status on/off check by IMEI for iPhones and iPads.
• MDM status check by IMEI or serial for all Apple devices, including Macs.
• Pair it with a MacBook Find My (FMI) check — a company Mac can also be iCloud-locked.

For a deeper history, an Apple full GSX report can show sales and activation details. See our MDM check page for more options.

How MDM is removed legitimately

Only the organization that owns the device can release it. A proper release looks like this:

1. The organization’s IT admin removes the device from its MDM server.
2. They release the device from Apple Business Manager / Apple School Manager (or remove it from Android zero-touch or Knox Mobile Enrollment).
3. The device is erased. On the next setup, the Remote Management screen no longer appears.

For Android, the equivalent is the organization removing the device from its zero-touch or Knox Mobile Enrollment portal and its management console, then resetting it. Until that happens, the phone re-enrolls on every setup, however many times it’s reset.

What to ask the seller for

Ask for the serial number in advance, the name of the organization the device came from, and a written statement or invoice showing it was released and sold legitimately. Refurbishers who buy ex-corporate stock in bulk deal with this every day; a seller who can’t answer these questions probably hasn’t done it.

If you bought from a company, school or IT reseller, contact them with the serial number and ask for a release. Legitimate refurbishers do this before resale — and should confirm it in writing. If you bought from a private seller, ask them where the device came from; an ex-employee who “kept their work laptop” may not own it at all.

Buying a used device that might be managed: checklist

• Ask for the serial number or IMEI and run an MDM check before meeting.
• Be extra careful with business-grade models sold in bulk, ex-lease laptops and anything with an asset tag sticker.
• On a Mac, run the two Terminal commands above. On an iPhone, check VPN & Device Management.
• Erase the device together with the seller and go through setup. If Remote Management appears, don’t buy.
• Also confirm Find My is off — see Activation Lock explained — and use our used MacBook checklist.

Run an MDM check now: