Can I remove MDM from a MacBook I bought used?

Only if it's a user-installed management profile. Open System Settings → General → Device Management (Privacy & Security → Profiles on macOS 13 and earlier), select the profile and remove it with an admin password. If the Mac is registered in Apple Business Manager (DEP / Automated Device Enrollment), no setting, erase or Terminal command removes it — only the organization can release the serial number.

Does erasing the Mac remove MDM?

It removes a user-installed profile, but not Automated Device Enrollment. During setup after the erase, the Mac contacts Apple, sees the serial is assigned to an MDM server, and shows a Remote Management screen that forces re-enrollment. Erasing is actually how many buyers discover the problem.

What is an MDM bypass and is it the same as removal?

No. A bypass skips or blocks the Remote Management screen so the Mac boots to a desktop, but the serial stays registered to the organization. The next reinstall, Recovery erase or Apple check-in can bring the enrollment back, and many bypass methods break macOS updates. It's a workaround, not removal, and the Mac is still legally part of that organization's fleet.

Can Apple remove MDM for me if the company is gone?

In practice, no. Apple treats devices in Apple Business Manager as the organization's property and won't release them to a third party on request. If the organization has closed, the Mac is effectively permanently enrolled. This is why checking before buying matters more than any removal method.

How do I confirm MDM is really gone?

Run `sudo profiles status -type enrollment` in Terminal. Both lines should read No: `Enrolled via DEP: No` and `MDM enrollment: No`. Then erase the Mac and run through setup — if no Remote Management screen appears, it's clean.

How to Remove MDM From a MacBook (What Works, What Doesn't)

Search "how to remove MDM from MacBook" and you'll find two kinds of answers: legitimate steps that work for one type of MDM, and "bypass" tools that promise to work for everything. The gap between those two is where used-Mac buyers lose money.

This guide is the honest version. It covers what you can actually remove, what you can't, and what to do in each case.

TL;DR: A user-installed MDM profile can be removed in System Settings or with one Terminal command. DEP / Automated Device Enrollment cannot be removed by you at all — only the organization that owns the serial number can release it in Apple Business Manager. Anything advertised as an "MDM bypass" is a workaround that leaves the enrollment in place.

Step 0: Find Out Which Kind of MDM You're Dealing With

Everything depends on this. Open Terminal and run:

sudo profiles status -type enrollment

You'll get two lines:

Enrolled via DEP: Yes/No — is the serial number registered in Apple Business Manager (or Apple School Manager)?
MDM enrollment: Yes/No — is a management profile currently installed?

Three outcomes:

Result	Meaning	Removable by you?
DEP: No, MDM: Yes	User-installed or manually enrolled profile	Yes — see Part 1
DEP: Yes, MDM: Yes	Automated Device Enrollment, fully active	No — see Part 2
DEP: Yes, MDM: No	Registered in ABM but profile skipped — the fingerprint of a bypass	No — see Part 2

If you're not sure what any of this means yet, read what an MDM locked MacBook actually is first — it explains the two enrollment types in plain language.

Part 1: Removing a User-Installed MDM Profile

This is the good case. The organization (or a previous owner) installed a management profile manually, and the serial number is not tied to Apple Business Manager.

Option A — System Settings

Open System Settings → General → Device Management. On macOS 13 Ventura and earlier it's System Settings → Privacy & Security → Profiles; on macOS 12 and older, System Preferences → Profiles.
Select the management profile (usually named after the organization or the MDM vendor — Jamf, Kandji, Mosyle, Intune, Addigy).
Click the – (minus) button or Remove, and enter an admin password.
Repeat for any configuration profiles that were pushed by the MDM. They'll typically list the same organization.

If the Remove button is missing or grayed out, the organization marked the profile as non-removable. That doesn't automatically mean DEP — but go back to Step 0 and check, because a non-removable profile combined with Enrolled via DEP: Yes is the second case.

Option B — Terminal

List installed profiles:

sudo profiles list

Remove a specific one by its identifier:

sudo profiles remove -identifier com.example.mdm.profile

Or remove every configuration profile on the Mac at once:

sudo profiles remove -all

Then re-run the Step 0 status check. Both lines should now read No.

Option C — Erase and Reinstall

If the Mac is a fresh purchase and you don't need anything on it, the cleanest route is System Settings → General → Transfer or Reset → Erase All Content and Settings, then set it up as new. For a user-installed profile, this wipes the enrollment completely. For DEP, it does the opposite — see below.

Part 2: DEP / Automated Device Enrollment — Why You Can't Remove It

When a Mac is registered in Apple Business Manager, the enrollment lives on Apple's servers, keyed to the serial number, not on the disk. Every time the Mac goes through Setup Assistant, it contacts Apple's activation servers, which reply "this serial belongs to organization X, enroll it with their MDM server." The Mac then shows the Remote Management screen and won't proceed without enrolling.

That is why:

Erasing the Mac doesn't help. Setup Assistant runs again and re-enrolls it.
Reinstalling macOS doesn't help. Same reason.
Removing the profile doesn't help — since macOS 11, an enrollment profile installed through Automated Device Enrollment is non-removable by design, and even if you get rid of it, the next check-in restores it.
Replacing the SSD doesn't help. The serial number is on the logic board.

There is exactly one legitimate way out.

The Only Real Fix: The Organization Releases the Serial

In Apple Business Manager, an administrator opens Devices, finds the serial number, and chooses Release. Once released, the device is no longer assigned to the organization, Apple's servers stop pointing it at their MDM, and after an erase the Mac sets up like any consumer machine. (Release is permanent — the organization can't re-add the device except with Apple Configurator during a provisional window, which is not something a former owner would do.)

How to ask for it, in a way that actually gets a response:

Get the serial number — About This Mac, or system_profiler SPHardwareDataType | grep Serial in Terminal.
Identify the organization. The Remote Management screen names it. So does the profile in Device Management, if one is installed.
Contact their IT department, not the seller. Sellers rarely have access. Write something like: "I purchased a Mac with serial XXXX that is still assigned to your Apple Business Manager account. I'm requesting that it be released from ABM. Proof of purchase attached."
Attach proof of purchase — the listing, the payment receipt, messages with the seller. IT teams are more willing to release a device when they can see it left their inventory legitimately.
Ask for confirmation, then erase the Mac and set it up again. No Remote Management screen = released.

Some organizations do this within a day. Others have policies against it, or never reply. If the company no longer exists, there is nobody who can release it — and Apple will not do it on your behalf.

Part 3: "MDM Bypass" — What You're Actually Getting

Bypass tools and services skip the Remote Management screen using one of a few techniques: blocking the Mac's connection to Apple's enrollment servers during setup, modifying the hosts file, or exploiting a setup-flow quirk. Afterwards the Mac boots to a normal desktop and the seller lists it as "MDM bypassed."

What's still true after a bypass:

The serial number is still registered in Apple Business Manager. sudo profiles status -type enrollment shows Enrolled via DEP: Yes.
The organization still sees the device in their inventory and can still act on it if the Mac ever checks in.
The next macOS reinstall, Recovery-mode erase, or an Apple-side change can put the Remote Management screen right back.
Several bypass methods work by permanently blocking Apple domains, which breaks macOS updates and some Apple services.
You're relying on a hack that Apple actively closes with macOS updates.

Bypass is not removal. If a listing says "MDM bypassed," price the Mac as a machine that could lock at any time — or, more sensibly, walk away.

After Removal: Verify Properly

Whether you removed a profile yourself or the organization released the device, confirm it with all three checks:

Terminal: sudo profiles status -type enrollment → both lines No.
Device Management (System Settings → General) → empty, or only profiles you installed yourself.
Erase and set up as new → no Remote Management screen at any point.

If all three pass, the Mac is genuinely yours.

The Cheaper Alternative: Don't Buy It Enrolled

Every hour spent chasing an IT department is an hour that a two-minute check before purchase would have saved. When you're considering a used Mac — especially one that looks like it came from an office — ask the seller for a ClariMac report. The scan records the exact Enrolled via DEP and MDM enrollment values, so you see the enrollment status before money changes hands, not after.

If you're specifically shopping for a former company laptop, read the ex-corporate MacBook buying guide — MDM is only one of the four locks that can come with one.