# Why Users Can Still Remove the Management Profile

> Understand why an end user can remove the management profile from an Apple Business Manager device even when MDM Removable is set to No.

Source: https://docs.capaone.com/capaone/mobile-manager/apple-mdm/why-users-can-still-remove-the-management-profile/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

If an end user removes the management profile from a device even though **MDM Removable** is set to **No** on the enrollment profile, the cause is usually how the device was added to Apple Business Manager (ABM) or Apple School Manager (ASM). This is expected Apple behavior. It isn't a CapaOne configuration issue or a bug.

## How enrollment path affects removal

The outcome depends on how the device was registered in ABM or ASM.

| Enrollment path | Ownership in Apple's records | Can the user remove the profile with **MDM Removable: No**? |
|-----------------|------------------------------|--------------------------------------------------------------|
| Automated DEP enrollment | Organization-owned immediately | No. The setting applies right away. |
| Manual enrollment with Apple Configurator | Personally owned for 30 days, then organization-owned | Yes, during the first 30 days. No after that. |

### Automated DEP enrollment

A reseller or channel partner registers the device with ABM or ASM at the time of purchase. Apple treats the device as organization-owned from the start. **MDM Removable: No** takes effect immediately, and the user can't remove the management profile.

### Manual enrollment with Apple Configurator

When you add a device to ABM or ASM manually, for example with **Apple Configurator**, Apple starts a 30-day transitional period. During this period Apple treats the device as personally owned, even though it already appears in ABM or ASM.

While the transitional period is active, the user can remove the management profile regardless of the **MDM Removable** setting. After 30 days the device transfers to organization ownership and **MDM Removable: No** takes effect.

## What to do

- If a user removed the profile from a manually added device less than 30 days after enrollment, no configuration change is needed. This is expected behavior.
- To avoid the 30-day window, buy devices through a reseller or channel partner that registers them with ABM or ASM automatically. See [Apple Recommendations](/capaone/mobile-manager/apple-mdm/apple-recommendations/).
- To reapply management to a device whose profile was removed, enroll it again. See [Apple Enrollment](/capaone/enrollment/apple-enrollment/).

## The on-device management message

Supervised devices show a message under **Settings**, for example: "This iPad is managed externally. You can turn off external management in Settings." Apple controls this text and whether it appears. You can't change or hide it from CapaOne.

## Related articles

- [Apple Enrollment](/capaone/enrollment/apple-enrollment/)
- [Apple DEP Integration](/capaone/mobile-manager/apple-mdm/apple-dep-integration/)
- [Apple Recommendations](/capaone/mobile-manager/apple-mdm/apple-recommendations/)