Why Users Can Still Remove the Management Profile
If an end user removes the management profile from a device even though MDM Removable is set to No on the enrollment profile, the cause is usually how the device was added to Apple Business Manager (ABM) or Apple School Manager (ASM). This is expected Apple behavior. It isn’t a CapaOne configuration issue or a bug.
How enrollment path affects removal
Section titled “How enrollment path affects removal”The outcome depends on how the device was registered in ABM or ASM.
| Enrollment path | Ownership in Apple’s records | Can the user remove the profile with MDM Removable: No? |
|---|---|---|
| Automated DEP enrollment | Organization-owned immediately | No. The setting applies right away. |
| Manual enrollment with Apple Configurator | Personally owned for 30 days, then organization-owned | Yes, during the first 30 days. No after that. |
Automated DEP enrollment
Section titled “Automated DEP enrollment”A reseller or channel partner registers the device with ABM or ASM at the time of purchase. Apple treats the device as organization-owned from the start. MDM Removable: No takes effect immediately, and the user can’t remove the management profile.
Manual enrollment with Apple Configurator
Section titled “Manual enrollment with Apple Configurator”When you add a device to ABM or ASM manually, for example with Apple Configurator, Apple starts a 30-day transitional period. During this period Apple treats the device as personally owned, even though it already appears in ABM or ASM.
While the transitional period is active, the user can remove the management profile regardless of the MDM Removable setting. After 30 days the device transfers to organization ownership and MDM Removable: No takes effect.
What to do
Section titled “What to do”- If a user removed the profile from a manually added device less than 30 days after enrollment, no configuration change is needed. This is expected behavior.
- To avoid the 30-day window, buy devices through a reseller or channel partner that registers them with ABM or ASM automatically. See Apple Recommendations.
- To reapply management to a device whose profile was removed, enroll it again. See Apple Enrollment.
The on-device management message
Section titled “The on-device management message”Supervised devices show a message under Settings, for example: “This iPad is managed externally. You can turn off external management in Settings.” Apple controls this text and whether it appears. You can’t change or hide it from CapaOne.