Device offboarding checklist: when to retire, wipe, reassign, or remove a device from MDM

Most IT offboarding checklists cover accounts and app access in detail and give the device a single line: collect the laptop. That line hides the decisions that cause real problems. Retire a company phone instead of wiping it, and the next user inherits the last one’s data. Wipe it before clearing Activation Lock or Factory Reset Protection (FRP), and the device may not activate again. Delete it from MDM too early, and it drops out of your inventory while still holding company data.

This checklist covers the device side of offboarding: what each MDM action does, which one fits each scenario, and the order of steps that keeps devices reusable and data protected.

Retire, wipe, reassign, delete: what each action does

Action names vary by MDM. Microsoft Intune’s definitions are a useful reference because many platforms offer a similar set (Microsoft Learn):

Two details often cause problems. First, Retire waits for the device: Intune triggers it the next time the device checks in, and until then the device can still appear in the console (Microsoft Learn). Second, Delete is not just housekeeping. In Intune, deleting a device triggers a Retire on Windows and Apple devices and on personally owned Android work profiles, but a Wipe on company-owned Android devices (Microsoft Learn). Check what Delete does in your MDM before using it as a cleanup step.

Which action fits each scenario

The device offboarding checklist

Before the last day

1. Confirm every device assigned to the leaver in the MDM inventory and the asset register, including BYOD devices with work data.
2. Agree on the return date and method for company-owned devices, and send prepaid shipping for remote staff.
3. Ensure company files on the device are synced or backed up before wiping anything.
4. For Windows devices joined to Microsoft Entra ID, back up the BitLocker recovery key and local admin credentials. Microsoft warns that deleting or retiring these devices in Intune removes BitLocker key protectors (Microsoft Learn). The Windows LAPS guide covers the admin password side.

On the last day

1. Disable the user’s identity and app access first so a device that isn’t returned cannot reach company data.
2. Retire BYOD devices. Remove only work apps, data, and profiles; personal data stays.
3. Collect company-owned devices and check them against the inventory.
4. For devices not returned, enable Lost Mode or a remote lock with a return message, then wipe remotely once your policy window passes. The company cell phone policy template includes clauses for returns and lost devices.

Before wiping a company-owned device

This is the step many checklists skip, and the one that turns a reusable device into a brick.

• Apple: Activation Lock comes in two forms, and you clear them differently. Organization-linked Activation Lock requires Apple Business (formerly Apple Business Manager) or Apple School Manager: the MDM creates its own bypass code and sends it to Apple, and if the MDM cannot clear the lock, an Apple Business user with the right privileges can turn it off, provided the device has not been released. User-linked Activation Lock ties the device to an employee’s personal Apple Account through Find My and is only possible if the MDM allows it. For user-linked locks, the MDM must retrieve and store the device-generated bypass code before the user turns the lock on; on iPhone and iPad, that code is available for up to 15 days after the device is first supervised (Apple Platform Deployment). Before you wipe, check the device’s lock type and confirm the matching bypass works.
• Android: a reset outside Settings, such as through the recovery menu, can trigger FRP if a Google account is on the device. Enterprise FRP lets admins name the Google accounts that can unlock a reset company-owned device, and it must be set before the reset (Google Android Enterprise Help). On Android 15 and later, OEM unlocking no longer bypasses FRP (Bayton).
• Windows: Intune’s protected wipe option overwrites free space and continues if power is lost, but Microsoft warns it can prevent some devices from starting again, so use it only where full data destruction is required (Microsoft Learn).

When reassigning to a new user

1. Wipe the device fully. Do not reassign a retired company device; a retire leaves settings and personal data in place.
2. Let it re-enroll automatically through Apple Automated Device Enrollment (ADE), Android zero-touch enrollment, or Windows Autopilot, or enroll it manually. Keep the device registered in those programs so it re-enrolls automatically. For iPhone and iPad, Apple Return to Service can erase and re-enroll a device in one step. The MDM enrollment guide compares the options.
3. Assign the new user in the MDM and the asset register, and confirm policies and apps apply.

When the device leaves the company

1. Turn off Activation Lock and FRP, or confirm the bypass and Enterprise FRP accounts work.
2. Wipe and sanitize the device to the standard your data requires. An MDM wipe status alone is not sanitization evidence under NIST SP 800-88 Rev. 2; the device lifecycle guide covers certificates and ITAD partners.
3. Release Apple devices from Apple Business only after you handle Activation Lock. Apple notes that once you release a device, Apple Business can no longer manage Activation Lock (Apple Business User Guide).
4. Deregister Windows devices from Autopilot. Microsoft says a device that permanently leaves the organization “should always be deregistered” (Microsoft Learn).
5. Remove Android devices from zero-touch enrollment and Samsung devices from Knox Mobile Enrollment where you use them. A factory reset won’t do this: Google notes that you can’t factory reset a device to remove it from your organization’s management, and an admin must unregister it (Google Android Enterprise Help). Unclaiming a device removes it from zero-touch enrollment, and you’ll need your reseller to add it back later (Google for Developers). In Knox Mobile Enrollment, delete the device from the console; once itis removed from all Knox services, only your reseller can upload it again (Samsung Knox). Keep these registrations for devices you reassign internally so they re-enroll automatically.
6. Delete the MDM record, close the asset record, and remove any stale device object from your identity provider.

Common offboarding mistakes

• Retiring a company-owned device and handing it on. Retire ends management but does not reset the device.
• Releasing from Apple Business before clearing Activation Lock. After release, Apple Business can no longer manage the lock.
• Wiping Android devices without Enterprise FRP. A device locked by FRP with no Enterprise FRP accounts set may need the manufacturer to unlock it, according to Google.
• Deleting before the action completes. A deleted record hides the device from the console even if it never checked in to complete the retirement.
• Skipping the asset register. The MDM shows managed devices; the asset register has to show where every device ended up.

Offboarding with Bento MDM

Bento MDM offers retire and full wipe actions from one console across Android, iOS, macOS, and Windows, with corporate wipe for Android work profiles and iOS User Enrollment (see MDM remote control). For BYOD, Bento’s BYOD management uses selective wipe to remove work data when someone leaves. For lost and unreturned devices, Factory Reset Protection and Lost Mode lock the device and display a return message, and device inventory keeps the assignment record used to start offboarding.

Frequently asked questions

Offboard the device, not just the account

Account offboarding is usually automated; device offboarding is usually a ticket that says “collect laptop”. Document which action each scenario gets, and clear locks before any wipe, so a returned device can go back into service the same week instead of sitting in a drawer waiting for a vendor unlock.