Buy a used Mac and you may run into a wall of enterprise vocabulary: MDM, DEP, ADE, ABM, supervised, Remote Management, enrollment profile. Sellers use these terms loosely — sometimes to sound informed, sometimes to obscure a problem. Knowing what each one actually means is the difference between a bargain and a paperweight.
This is the plain-language glossary, organized by how the pieces fit together.
TL;DR: Apple Business Manager is where an organization registers its devices. DEP / Automated Device Enrollment is the mechanism that forces a registered Mac to enroll during setup. MDM is the server that then controls the Mac. A Mac can have MDM without DEP (removable) or DEP with MDM (not removable by you). "Enrolled via DEP: Yes" is the line that matters.
The Three Layers
Think of it as a chain of custody.
Layer 1 — Apple Business Manager (ABM)
Apple's web portal for organizations. Also exists as Apple School Manager (ASM) for education. An organization uses it to:
- Register the Macs, iPhones and iPads it owns — either automatically when buying from Apple or an authorized reseller, or manually with Apple Configurator.
- Assign each device to an MDM server.
- Create Managed Apple IDs for staff.
- Buy apps and books in volume.
ABM does not manage devices itself. It's the registry. The one action that matters to a used-Mac buyer is Release — when an administrator releases a device, it leaves the organization's registry for good and Apple's servers stop associating the serial with any MDM.
Layer 2 — DEP / Automated Device Enrollment (ADE)
Device Enrollment Program is the old name; Apple renamed it Automated Device Enrollment in 2019, but macOS still prints "DEP" in Terminal, and the used market still says "DEP locked."
ADE is the mechanism that connects Layer 1 to Layer 3. When a Mac registered in ABM runs Setup Assistant, it contacts Apple's activation servers. Apple replies: this serial belongs to organization X, enroll it with their MDM server. The Mac shows the Remote Management screen and cannot finish setup without enrolling.
Because the assignment lives on Apple's servers, tied to the serial number:
- It survives erasing the disk.
- It survives reinstalling macOS.
- It survives replacing the SSD.
- It ends only when the organization releases the device in ABM.
This is what Enrolled via DEP: Yes means in sudo profiles status -type enrollment.
Layer 3 — MDM (Mobile Device Management)
The server that does the actual managing, and the software profile on the Mac that talks to it. Jamf Pro, Kandji, Mosyle, Microsoft Intune, Addigy, Fleet, Apple's own Business Essentials — all MDM servers.
Once a Mac is enrolled, whoever runs the MDM can push Wi‑Fi and VPN settings, install or block apps, enforce passwords and FileVault, set a Recovery lock, mark the device lost (which locks it), or wipe it remotely.
This is what MDM enrollment: Yes means. An MDM enrollment can exist with or without DEP behind it — and that's the whole distinction for buyers.
The Two Enrollment Paths Compared
| User-approved enrollment | Automated Device Enrollment (DEP) | |
|---|---|---|
| How it starts | Someone installs a profile manually, or from a link | Setup Assistant forces it via Apple's servers |
| Requires ABM registration | No | Yes |
| Terminal status | DEP: No, MDM: Yes | DEP: Yes, MDM: Yes (or No if bypassed) |
| Supervised | Not by default | Always |
| Profile removable by user | Usually yes | No (since macOS 11) |
| Survives erase / reinstall | No | Yes |
| Who can end it | You | Only the organization, in ABM |
| Used-market risk | Low — fixable | High — potentially permanent |
If you only remember one row, remember the last one. Step-by-step instructions for each path are in how to remove MDM from a MacBook.
Supporting Vocabulary
Supervised. A device-level flag that grants the MDM extra powers (silent app installs, activation lock management, stricter restrictions, non-removable enrollment). Macs enrolled via ADE are supervised automatically. You'll sometimes see "This Mac is supervised and managed by …" in System Settings.
Enrollment profile. The specific configuration profile that links the Mac to the MDM server. Removing it ends management for a user-approved enrollment. For ADE it's non-removable, and re-installed on the next setup anyway.
Configuration profiles. The individual settings the MDM pushes — Wi‑Fi, restrictions, certificates. They come and go with the enrollment profile.
Remote Management screen. The Setup Assistant step that says the organization will automatically configure the Mac. Seeing it means ADE is active. There's no "skip" button on a legitimately registered device.
Managed Apple ID. An Apple ID created by the organization in ABM. If a used Mac's Activation Lock is tied to a Managed Apple ID, the organization — not a person — has to remove it. This is a separate lock from MDM; see how to check Activation Lock before buying.
Recovery lock. On Apple Silicon Macs, an MDM can set a password required to enter Recovery mode. A Mac with Recovery lock cannot be erased or reinstalled without that password. Worth testing on any ex-corporate machine.
Apple Configurator. Apple's tool for manually adding devices to ABM (for devices not bought through Apple's channel). Relevant only in that a released device can be re-added this way during a short provisional period — not something a used buyer needs to worry about.
"MDM bypassed." A seller's term meaning the Remote Management screen was skipped with a workaround. The ABM registration is untouched. See what "MDM bypassed" really means.
How to Read the Status Output
Run this on any Mac you're considering (the seller can run it too and send a screenshot, though a screenshot is easy to fake — which is one reason a scanned ClariMac report is more useful):
sudo profiles status -type enrollment
| Output | Translation |
|---|---|
Enrolled via DEP: No / MDM enrollment: No | Clean. Not registered, not managed. |
Enrolled via DEP: No / MDM enrollment: Yes | Managed, but removable. Ask the seller to remove the profile, or do it yourself. |
Enrolled via DEP: Yes / MDM enrollment: Yes | Registered and managed. Only the organization can free it. |
Enrolled via DEP: Yes / MDM enrollment: No | Registered, enrollment skipped — a bypass. Same problem as the row above, hidden. |
Why This Vocabulary Exists in the Used Market at All
None of this was designed with resale in mind. ABM and ADE exist so that a company can hand a new employee a sealed box and have the Mac configure itself. The problem is the end of the device's life: when a leasing company, a bankrupt startup or an ex-employee sells the Mac without anyone clicking Release in ABM, the enrollment follows the machine to its next owner.
That's why ex-corporate Macs deserve their own checklist — MDM is one of four locks that can ship with them. Read the ex-corporate MacBook buying guide before buying one, and start with what an MDM locked MacBook means if any of the terms above were new to you.