When enrolling an Apple device via Automated Device Enrollment, you have an option to lock the enrollment.
Non-locked enrollments can be removed from the Settings app, and the device will not be erased when removed, although MDM-installed apps and data will be removed from the device. If the device is supervised, it will lose its supervised state once unenrolled from MDM.
Devices Recently Enrolled in ABM/ASM
When you manually enroll a device in Apple Business Manager or Apple School Manager using Apple Configurator, enrolling the device in MDM begins a 30-day provisional enrollment.
Provisional enrollment does not affect devices added to ABM by an Apple authorized reseller.
While ADE enrollment is usually mandatory in Setup Assistant, a provisionally enrolled device presents an option to instead remove the device from its organization. If the user selects this option, MDM enrollment will be skipped and the device will be released from ABM.
Additionally, once a provisionally enrolled device is activated and enrolled in MDM, an option will be presented in Settings to unenroll the device. Doing so will factory reset the device and it will be released from ABM.
Some provisionally enrolled devices will display a footnote on the lock screen indicating that the user can leave device management in Settings.
Once the provisional enrollment period lapses, the enrollment becomes truly locked and can no longer be unenrolled.
To prevent end-users from unenrolling organization-owned devices during the provisional period, activate newly ABM-enrolled devices in MDM, then store them for 30 days before delivering them to users. Once the provisional period expires, you can wipe the device and enroll it again without going through another provisional enrollment.
The provisional period only begins once the device is activated in MDM, not when it's enrolled in ABM.
Erasing Locked Devices
Devices under locked enrollments can still be erased, even if you enable the policy to disable the Erase All Content and Settings option in Settings.
Anyone can erase a device by putting it into DFU mode (also called recovery mode) and restoring it with a computer, even if it's under a locked enrollment or they don't know the passcode. If this happens, Vexluna has no way of detecting it.
Devices that still have an ADE profile assigned will require re-enrollment during activation (unless in the provisional period). If you're concerned about theft of organization-owned devices, we recommend using Organization Activation Lock.