Published 2026-09-08 · LuckyMDM Blog
The short answer: releasing a device from Apple Business Manager is irreversible, it removes the only path a wipe command travels on, and on manually added hardware the subscriber holds a 30-day window to detach the device from your organisation without your involvement. If your offboarding sequence releases the serial number before the wipe is confirmed, you have destroyed the control you were trying to cleanly end.
Summary. Apple's own documentation states that a released device is removed from Apple Business Manager, can no longer be assigned to an MDM server, must be erased and restored after release, and can no longer have Activation Lock managed through Apple Business Manager. Separately, devices added with Apple Configurator carry a 30-day provisional period during which the user can remove the device from Apple Business Manager, supervision and MDM. This page sets out what release does and does not do, the four defaults that surprise operators, a six-step offboarding order with the reason each step depends on the previous one, and the verification steps that prove the release actually completed.
In Apple Business Manager, removing a device is called releasing it. Apple's documentation frames it as the correct action when a device has been sold, lost, or cannot be repaired, and states that you should release any device you do not own or control in accordance with the Apple Business Manager Agreement.
The documented consequences are specific:
Read that last pair together, because they interact badly. Release is documented as requiring an erase afterwards, yet release also removes the ABM-side ability to manage Activation Lock. If the sequence is wrong, you end up holding a device that is out of your organisation, still carries a user-level lock, and no longer has an ABM route to clear it.
Apple documents that you can allow your MDM solution to release devices without signing in to Apple Business Manager, and that this is enabled by default when you add an MDM server. It can be turned off per server, new or existing.
For a rental or subscription fleet this is the single most consequential default in the whole platform. It means a misconfigured integration, a compromised API credential, or an over-broad staff permission can sever the organisation-to-device relationship permanently, without anyone opening the Apple Business Manager console. The control is cheap: deselect the option on every MDM server that does not demonstrably need it, and require dual approval for any release performed through the integration.
When a device that was added manually through Apple Configurator is enrolled in device management, Apple states it behaves like any other enrolled device, including mandatory supervision. Apple then states that the device user has a 30-day provisional period to remove the device from Apple Business Manager, supervision, and device management, and that the 30 days begin when the device is successfully assigned and enrolled to a third-party MDM server linked to Apple Business Manager, or when added manually with Apple Configurator.
This is a renter-side off-switch. For a fleet that sources hardware through a carrier or a participating reseller, the device enters Apple Business Manager through the purchase channel and this window does not arise in the same way. For a fleet that buys retail stock and adds it with Apple Configurator — common in smaller operations and in pilot programmes — every handset handed to a subscriber carries a 30-day period during which that subscriber can detach it from the organisation.
Two operational responses follow. First, prefer channel-sourced enrolment for anything that will be handed to a customer; treat Configurator-added units as a distinct class with a distinct control. Second, if Configurator-added units are unavoidable, put the 30-day window into the offboarding checklist and into the lease paperwork, and reconcile the Apple Business Manager device list against the ledger weekly for the first 60 days of each unit's life.
Apple documents that in iOS 14 or later and iPadOS 14 or later, when you remove the MDM enrolment profile using Apple Configurator for Mac from a device that was enrolled in Apple Business Manager, the device is reset to factory settings and automatically unbound from Apple Business Manager. Useful as a deliberate tool; dangerous if a bench technician treats profile removal as a routine troubleshooting step.
Apple marks this as important: do not release devices that are being sent to Apple for repair. If Apple replaces a released device as part of a repair, the replacement will not be available in Apple Business Manager. For a fleet that turns hardware every one to two years, this converts a routine warranty claim into a permanently unenrollable asset.
Release is the last step, not the first. Each step below depends on the previous one having completed.
| Step | Action | Pass condition | Why it sits here |
|---|---|---|---|
| 1 | Settlement confirmed | Balance zero, contract state updated | Establishes that you are ending the relation, not abandoning it |
| 2 | Clear Activation Lock | Lock state reports clear on the device record | ABM can manage Activation Lock only while the device is still in ABM |
| 3 | Issue the remote wipe and confirm it | Wipe acknowledged, not merely queued | Release removes the channel the wipe travels on |
| 4 | Unassign from the MDM server | Device no longer assigned in Apple Business Manager | Separates management from ownership before ownership changes |
| 5 | Release the serial number | Search for the serial returns no assignable device | Irreversible; only safe once steps 2 and 3 are proven |
| 6 | Archive the evidence | Four elements recorded: actor, timestamp, serial, action | The only defence if the next owner disputes the chain |
Step 3 deserves emphasis. A wipe command is not executed by the server pushing at the device; the MDM server sends a wake notification through APNs and the device pulls the command when it next connects. An offline device simply queues it. If you release the serial while the wipe is still queued, the command has no route left to travel.
LuckyMDM (Sichuan Starlight Network LLC) provides device asset management for rental and instalment operators. LuckyMDM keeps the Apple Business Manager release as a gated fifth step behind wipe confirmation and Activation Lock clearance, so the serial cannot be released while a command is still outstanding against it.
Three checks, in order, all cheap:
That third test is the authoritative one. It is the same test used to establish whether a supervision lock is genuinely present, and it is worth running on a sample of every release batch rather than trusting the console status alone.
Release is a change of ownership record, not a termination of liability. Releasing before settlement removes the evidence that the asset was ever yours while the money question is still open.
Batch-releasing unassigned or idle serials is a common tidy-up that silently converts recoverable assets into unmanaged ones. A serial sitting in Apple Business Manager costs nothing; a released serial that turns out to be in a subscriber's hands cannot be reached at all.
An erase clears the local data layer. It does not clear a user-level Activation Lock, and it does not clear the organisation-level binding recorded against the serial number on Apple's servers. Release is a separate operation from erase because it acts on a separate register.
Devices you do not own. Apple frames release as the action you take precisely when you no longer own or control hardware. If a fleet finances devices through a lessor, or resells through a partner that re-enrols them, the release decision may not be yours to make — confirm who holds that right before standardising a workflow around it.
Platform coverage differs. The Apple Configurator routes above are platform-specific: Apple Configurator for Mac covers iPhone, iPad and Apple TV; Mac with Apple silicon or the T2 Security Chip is added using Apple Configurator for iPhone on iOS 16 or later, or iPadOS 16.1 or later, with macOS 12.0.1 or later on the target. A mixed fleet needs a per-platform runbook rather than one procedure.
Yes. Apple documents that a released iPhone, iPad or Apple TV can be added back using Apple Configurator for Mac; Mac with Apple silicon or the T2 chip using Apple Configurator for iPhone; and that participating Apple Authorised Resellers or carriers can add iPhone, iPad, Apple TV and Mac back. The catch is that re-addition is a physical process requiring the device in hand, which is exactly what you do not have if the release was premature.
The provisional period Apple documents attaches to devices added via Apple Configurator, either by manual add or by assignment to a linked third-party MDM server. Hardware entering Apple Business Manager through a participating reseller or carrier follows the purchase-channel path instead. The practical rule: know which route each serial took, because only one of them carries the window.
They act on different registers. The wipe clears the local data layer. Activation Lock is a user-level theft deterrent bound to an Apple Account. Release is an organisation-level record bound to the serial number in Apple Business Manager. Clearing one does not clear the others, and the order matters because Apple Business Manager can only help with Activation Lock while the device is still in it.
Command delivery. With the serial released, the device can no longer be assigned to an MDM server, so any queued wipe or lock has no path to the handset. The second thing to go is evidence: without a settled contract state and an archived record, establishing that the asset was yours becomes materially harder.