Only authorized IT administrators should remove management from company-owned Macs to maintain security, compliance, and device oversight.
The risk: Unauthorized MDM removal disrupts policy enforcement, limits remote management, and creates compliance gaps.
The solution: Use Automated Device Enrollment (ADE) with non-removable MDM profiles, role-based permissions, and documented approval workflows.
Hexnode’s role: Hexnode UEM supports non-removable enrollment, UEM Profile Password controls, technician permissions, and administrator-initiated disenrollment to help IT maintain control throughout the Mac lifecycle.
Who should be allowed to remove management from a company Mac?
Only authorized IT administrators may remove MDM from company-owned Macs, following a documented approval process. Local administrator privileges alone should not give employees unrestricted control over device enrollment.
Consider an employee with local administrator access who attempts to remove the MDM profile from their company-issued Mac. While these privileges may be necessary for certain development, troubleshooting, or configuration tasks, removing device management can disconnect the Mac from organizational oversight.
This creates an administrative challenge: IT must provide employees with sufficient access to perform their responsibilities without compromising device management and security controls.
To prevent MDM removal on a company Mac, administrators must distinguish between three factors:
Local account privileges: What the user can modify within macOS.
Organizational authorization: Who is permitted to approve and execute unenrollment.
The actual ability to remove management depends on the enrollment method and configured restrictions, not simply the user’s account privileges.
What happens when users remove MDM from corporate Macs?
Unenrolling a corporate Mac from MDM breaks its management connection, preventing IT from enforcing or updating policies. Depending on configured removal settings, the system may also purge MDM-delivered configuration profiles, restrictions, and managed applications.
Reduced administrative control: IT loses access to MDM-based remote actions, configuration changes, and management commands.
Missed security updates: The Mac may no longer receive MDM-enforced security configurations, software update policies, or compliance requirements.
Compliance gaps: IT cannot reliably assess the device’s current configuration or enforce organizational standards through MDM.
Increased administrative workload: Teams must investigate unauthorized removal, assess affected controls, and restore management.
Consider a departing employee removing management before returning their Mac, or a remote worker unintentionally unenrolling their device. Shared Macs can also become unmanaged between users, disrupting established security procedures.
Importantly, losing MDM management does not automatically disable every installed security control or delete corporate data. However, it limits IT’s ability to verify, maintain, and enforce the device’s required security posture.
Can a Mac administrator remove an MDM profile?
Local administrator privileges do not automatically grant permission to remove an MDM profile. Whether removal is possible depends on the Mac’s enrollment method, configured restrictions, and any additional authentication requirements.
A macOS local administrator can modify system settings and install software, but this does not make them an authorized endpoint administrator.
How enrollment methods affect MDM removal:
Manual Device Enrollment: Macs enrolled through manually installed MDM profiles generally allow users with appropriate administrator credentials to remove management, subject to configured restrictions or removal passwords.
Automated Device Enrollment (ADE): Macs enrolled through Apple Business Manager or Apple School Manager can be configured with non-removable MDM profiles, preventing user-initiated unenrollment through System Settings or the profiles command-line tool.
Supervision: A supervised Mac supports additional management controls, but supervision alone does not make its MDM profile non-removable.
Administrators must also distinguish between different removal actions:
Removing the MDM enrollment profile: Terminates management and removes configurations and managed applications associated with that enrollment.
Removing a configuration profile: Removes the settings or restrictions it contains without necessarily ending MDM enrollment. However, profiles installed and controlled by an MDM service generally must be removed through that service or as part of unenrollment.
Uninstalling a management application: Removes software but does not necessarily terminate the underlying MDM enrollment.
Factory resetting: Erases local data and management profiles but does not remove the Mac from its organization’s Automated Device Enrollment assignment. If the Mac remains assigned to an MDM service, it can be automatically enrolled again during setup.
These distinctions determine which removal controls IT must enforce to protect corporate Mac management.
Who should have permission to unenroll a company-owned Mac?
MDM unenrollment permissions should follow the principle of least privilege, allowing only authorized personnel to remove management from company-owned Macs. Organizations should assign permissions based on administrative responsibilities, with separate approval requirements for sensitive actions.
A recommended role-based permission model includes:
Role
Recommended permissions
Endpoint administrators
Execute approved unenrollment requests and verify device status.
IT helpdesk technicians
Investigate issues and initiate requests. Grant unenrollment access only when operationally necessary.
Security or IT leadership
Oversee removal policies, approve exceptions, and review sensitive cases.
Employees
Submit unenrollment requests without independently removing corporate management.
Execution privileges should not automatically include approval authority. An administrator capable of issuing an unenrollment command should still require appropriate authorization. Named administrator accounts, documented approvals, and separation of duties help maintain accountability.
Legitimate reasons for unenrollment include:
Device retirement: Removing management from decommissioned Macs.
Ownership transfer: Preparing a corporate Mac for reassignment outside organizational ownership.
MDM migration: Moving devices to another management platform.
Asset disposal: Disenrolling devices approved for recycling or disposal.
Routine troubleshooting, employee preferences, or unrestricted local administrator access should not independently justify unenrollment. These situations require established approval procedures before management is removed.
How should IT define Mac MDM removal permissions?
IT should establish a role-based MDM removal policy that defines who can request, approve, and execute unenrollment.
Start by identifying company-owned Macs, documenting their enrollment methods, and classifying devices by operational requirements and security sensitivity.
Use a permission matrix to establish responsibilities:
Role
Request Permission
Approval Authority
Execution Permission
Conditions
Employee
Yes
No
No
Submit a documented request
Helpdesk technician
Yes
No
Conditional
Requires approval and assigned privileges
Endpoint administrator
Yes
Limited
Yes
Execute authorized requests
IT/Security leadership
Yes
Yes
Role-dependent
Approve exceptions and sensitive cases
Define clear unenrollment criteria covering device retirement, ownership transfers, and MDM migrations. Each request should include asset verification, a documented business reason, and appropriate manager or IT authorization. Sensitive devices may require additional security review.
For lost, inaccessible, or nonfunctional Macs, establish exception procedures that distinguish administrative record changes from confirmed device-side unenrollment.
Maintain a standardized approval record containing:
Mac serial number and assigned user
Asset owner and removal reason
Approving authority and execution date
Final management status
These records support accountability and audits, even when the MDM platform lacks built-in approval workflows.
How can IT prevent unauthorized MDM removal on company Macs?
To prevent MDM removal on company Macs, IT should enforce non-removable enrollment through Apple Automated Device Enrollment (ADE), supported by appropriate administrative access controls.
Register eligible company-owned Macs in Apple Business Manager and assign them to the organization’s MDM service.
Configure an Automated Device Enrollment profile that prevents users from removing MDM management.
Enroll Macs through the configured ADE workflow, ensuring the removal restriction is applied during enrollment.
ADE-based protection must be established through the appropriate enrollment process. Simply enabling a restriction afterward does not necessarily make an existing enrollment non-removable.
2. Apply additional access safeguards
Where supported, organizations can strengthen removal controls through:
Administrative credential management: Restrict access to privileged accounts and credentials.
Management-console permissions: Limit unenrollment actions to authorized administrators.
Password-based removal protection and ADE-enforced non-removable enrollment are distinct mechanisms with different requirements and limitations.
3. Verify enrollment protection
Before deploying across the fleet, IT should:
Confirm the Mac’s enrollment method and applied removal restrictions.
Test unauthorized removal attempts on a representative pilot Mac.
Verify that the device remains connected to MDM.
Document recovery procedures for failed enrollment or legitimate removal requests.
Removing local administrator privileges or hiding a management application does not replace non-removable MDM enrollment.
What is the correct process for removing management from a corporate Mac?
Removing MDM from a corporate Mac should follow an authorized, documented unenrollment process that verifies device ownership, protects organizational data, and confirms successful management removal.
IT should follow these steps:
Verify device ownership: Confirm the Mac’s serial number, assigned user, asset owner, and current enrollment status.
Validate the removal request: Confirm an approved business reason, such as device retirement, ownership transfer, or MDM migration.
Assess data and application dependencies: Review backup requirements, data-retention policies, managed applications, and configurations that may be affected.
Obtain documented approval: Secure authorization from the designated IT or security approver before proceeding.
Execute unenrollment: Initiate the appropriate disenrollment action through the organization’s MDM console and confirm the Mac receives and processes the command.
Verify and document: Check the device’s final management status and update asset records accordingly.
Marking an offline Mac as disenrolled in the console does not confirm device-side management removal.
After unenrollment, retain the Mac’s Apple Business Manager assignment if it remains company-owned, or reassign it to another MDM service during migration. When permanently transferring ownership, release the device from Apple Business Manager and erase and restore it according to Apple’s documented procedure.
MDM unenrollment, Apple Business Manager release, device erasure, and ownership transfer are separate operations requiring individual consideration.
How UEM Enables macOS Lifecycle Management
Explore how UEM supports Mac enrollment, security, maintenance, and retirement across the device lifecycle.
How does Hexnode control MDM removal permissions on company Macs?
Hexnode UEM helps prevent unauthorized MDM removal on company Macs through non-removable enrollment profiles, password-protected profile removal, and role-based administrative permissions.
1. Prevent removal through Automated Device Enrollment
For company-owned Macs enrolled through Apple Automated Device Enrollment (ADE), administrators can configure a non-removable MDM profile.
In the Hexnode portal:
Navigate to Admin > Apple Business/School Manager > Apple DEP > DEP Configuration Profiles.
Select Configure DEP Profile.
Disable Allow MDM Profile Removal and save the configuration.
Associate the profile with the devices during enrollment.
This prevents users from manually removing the MDM profile, including those with local administrator privileges. Enforcing non-removable MDM profile restrictions strictly requires automated provisioning via Apple Automated Device Enrollment (ADE); macOS security architecture prohibits applying profile-lock payloads to endpoints onboarded through manual, user-approved enrollment workflows.
2. Protect profiles with removal passwords
Hexnode’s UEM Profile Password provides an additional removal control for macOS.
Navigate to Enroll > Settings or Admin > Enrollment > Security > UEM profile password.
Administrators can configure:
Unique device passwords: Generate individual removal passwords for enrolled Macs.
Common password: Apply a shared removal password.
No password: Does not require an additional UEM profile removal password. Manual MDM profile removal requires verified local administrative privilege elevation and remains technically restricted unless the endpoint’s supervisory profile explicitly designates the enrollment payload as removable.
For existing devices, navigate to Manage > Select Device > Device Info > Security Info > UEM profile password to view, configure, renew, or remove passwords.
Changes to global password settings apply to newly enrolled devices. Existing devices retain their configurations unless updated individually.
Hexnode’s Admin > Technicians and Roles also supports custom roles and access scopes, allowing organizations to restrict administrative operations according to assigned permissions.
3. Execute and verify authorized disenrollment
To remove management, navigate to Manage > Devices > Select Device > Actions > Device Control > Disenroll Device.
Administrators can review completed removals under Reports > Device Reports > Disenrolled Devices.
For offline devices unable to complete disenrollment, Mark as Disenrolled clears the pending portal record but does not confirm device-side removal.
Together, these controls support accountable Mac enrollment, management, and retirement.
Featured Resource
Explore Hexnode Mac Management
Explore how Hexnode helps IT teams enroll, secure, configure, and manage corporate Macs throughout their lifecycle.
How can IT check if a company Mac has a removable MDM profile?
IT can review the Mac’s enrollment status and MDM configuration to determine whether settings prevent profile removal.For Macs enrolled through Automated Device Enrollment, administrators should verify that the enrollment profile prevents users from removing management.
Can IT make an existing Mac’s MDM profile non-removable without re-enrolling it?
No, an existing manually enrolled Mac cannot gain ADE-based non-removable management simply by changing its enrollment settings. The device must complete the appropriate Automated Device Enrollment process with profile removal restrictions configured.
What should IT do if a corporate Mac unexpectedly disappears from MDM?
IT should first determine whether the Mac was unenrolled, is offline, or has stopped communicating with the management service. If unauthorized removal is confirmed, administrators should assess affected security configurations, investigate the cause, and restore management through the appropriate enrollment process.
Can a company Mac be transferred to another MDM without removing it from Apple Business Manager?
Yes, a company-owned Mac can remain in Apple Business Manager while being reassigned to another MDM service. Administrators must coordinate the migration and complete the required enrollment process for the new service without releasing organizational ownership.
Does removing MDM from a Mac automatically remove corporate applications and data?
Artifact retention is strictly governed by the initial deployment architecture—specifically whether software was delivered via managed App Store (VPP) channels or custom package installers—and whether automated teardown flags were actively enforced within the management profile prior to unbinding.
Can a Mac user remove MDM through Terminal if profile removal is restricted?
No, a properly configured non-removable MDM enrollment prevents users from bypassing the restriction through the profiles command-line tool. Local administrator privileges do not override ADE-enforced profile removal restrictions.
Company-owned Macs should remain under organizational management until authorized IT personnel approve their removal. To prevent MDM removal on company Macs, organizations need the right enrollment method, clearly defined administrative permissions, and a documented unenrollment process.
Hexnode UEM supports these requirements through Automated Device Enrollment with MDM profile removal restrictions, UEM Profile Password controls, role-based technician permissions, and administrator-initiated disenrollment.
Secure Mac management with Hexnode to explore how these capabilities help IT teams restrict unauthorized unenrollment, maintain device oversight, and manage corporate Macs throughout their lifecycle.
Keep Your Company Macs Under Management
Explore Hexnode's Mac enrollment restrictions, profile protection, and administrator-controlled device removal.
Associate Product Marketer at Hexnode focused on SaaS content marketing. I craft blogs that translate complex device management concepts into content rooted in real IT workflows and product realities.
