Remove MDM from a Device Cleanly Deprovision Without Losing Personal Data
Removing MDM badly leaves two messes: a phone still half-managed, or an ex-employee whose personal photos vanished. Here is the clean removal path for BYOD and company devices, and the truthful data picture for each.
🎥 Full video — device lifecycle from enrollment to retirement in the console
Every enrolled device eventually leaves: an employee resigns, a phone is replaced, a tablet is retired or sold. Deprovisioning is the tidy removal of management — the device leaves the console, the policies and work apps come off, and nobody's data is harmed in the process. In ManageEngine MDM Plus there are two sides to a clean removal: the admin removes the device from the console, and where needed the user removes the profile/agent on the device. What gets deleted depends entirely on whether the device was BYOD or company-owned — this guide keeps the two strictly separate.
Deprovision — What Is Removed and What Stays
BYOD phone: work profile and work appsREMOVED
BYOD phone: personal photos, chats, appsUNTOUCHED
Company phone: everything (if wiped)BY POLICY
Console record of the deviceDeleted on removal
Deprovisioning a personal phone removes only the company's container. Personal data loss is not part of a correct BYOD removal — if it happens, the wrong procedure was used.
1
Before Anyone Touches Anything — Prepare
Confirm the device and owner in Inventory → Devices — model, serial and the person it is assigned to. Deprovisioning the wrong phone is a real-world mistake, not a theory
If company data must be kept (documents in managed apps, files in the work profile), have the user or IT copy it to company storage first — removal deletes the work container completely
Agree the timing with the employee for BYOD: removal ends their access to company email and apps on that phone immediately
2
BYOD Phone — Remove the Work Side Only
The admin starts it from the console; the result is a phone with the company fully gone and the person fully intact:
In the console, select the device and use the deprovision / remove device action for BYOD — this triggers removal of the work profile, managed apps, pushed Wi-Fi/email profiles and the management itself
The device must be online to receive the command; if it is offline, ask the user to connect once, or remove the profile on the device itself (next step)
On the phone, the user can also remove management directly: Android — Settings → Accounts/Work profile → remove work profile (or uninstall via the ME MDM app); iPhone — Settings → General → VPN & Device Management → select the MDM profile → Remove Management
Verify together: work apps and the briefcase-badged icons are gone, company email no longer syncs, and personal apps, photos and chats are all present
3
Company-Owned Phone — Retire or Reassign
A company device stays company property, so the end of an assignment is a reset, not a partial removal:
Take the device back physically, then from the console issue a complete wipe — or factory reset it in hand — so no data of the previous user remains
Then remove the device record from Inventory if it is being retired or sold; an enrolled-then-sold device is a security incident waiting to happen
For Zero Touch/Knox fleets, also remove the device from the Zero Touch/Knox portal if it is leaving the company permanently — otherwise it will try to enroll again for its next owner
If the device is simply moving to another employee, wipe it and enroll it fresh under the new user — never hand over a phone still carrying the previous person's accounts
4
After Removal — Close the Loop
Check the console: the device should no longer appear as a managed device (or shows as removed, per your record-keeping)
Revoke related access outside MDM too — the person's company account, email and VPN credentials are a separate offboarding checklist; removing MDM alone does not disable their login
Update your asset register: who has the device now, or where the retired device went
🔴 Honest note on data: a correct BYOD deprovision never touches personal data — the work container is separate by design on both Android and iOS. But anything stored inside work apps (a document saved only in the managed app, company email attachments kept offline) is deleted with the container. That is why the preparation step — copying needed company data out first — is not optional.
🎥 Watch the Complete MDM Setup in the Video
Every step shown live in the ManageEngine MDM console — enrollment, profiles, apps and security commands, in full detail.
Can an employee remove MDM from their own phone themselves?
Yes, on a personal (BYOD) device they always can: remove the work profile on Android or the management profile on iPhone. The console will show the device as unenrolled. An admin-led deprovision is still better practice, because it is recorded and verified — but the right to remove it is the employee's.
Does removing MDM delete the employee's personal photos?
No. On BYOD devices, MDM removal deletes only the work profile/container and the profiles MDM pushed. Personal photos, chats, apps and accounts are in a separate area the removal never touches. On company-owned devices a full wipe deletes everything — which is why wipes are policy for company property only.
We removed the device from the console but the phone still shows profiles. Why?
The removal command needs the device online to land. If the phone was offline, its profiles remain until it next connects and receives the command — or the user removes the profile manually in the device settings. Confirm removal on the device screen, not just in the console.
This guide is based on the ManageEngine MDM video by Technical Anshu • Stuck on a step? Ask in the video comments — that is where answers come fastest 🙏