# MDM Lock on Managed Phone Lots: DEP/ADE Supervision Profile Detection & Wholesale Quarantine Rules
A wholesale buyer checklist for detecting enterprise supervision, Automated Device Enrollment, and Android zero-touch locks before batch release.
- URL: https://nexussupplytech.com/blog/mdm-lock-managed-phone-lots
- Category: Wholesale
- Date: 2026-10-28
- Author: Jack Lau
- Read time: Buyer audit guide
- Tags: Quality Control, Phone Sourcing, MDM Lock
- Related solution: [Explore Mobile Phones Wholesale](https://nexussupplytech.com/mobile-phones-wholesale)
## Key Takeaways
- Inspect the main Settings screen and profile menus on active handsets before erasing any unit.
- Separate non-removable supervised enrollments from user-removable profiles and work profiles.
- Run a factory restore and reconnect to a network during setup to expose dormant enrollment assignments.
- Quarantine any handset that displays an unexpected management prompt; we verify Settings supervision and networked restore clearance on managed-lot units before dispatch and confirm portal release in writing.
## Inspect in-OS Settings for an MDM lock before erasing
Before accepting a wholesale phone batch, check each handset for an mdm lock and reject any unit with an unresolved supervision or enrollment assignment.
For your [mobile phones wholesale](/mobile-phones-wholesale) order, agree the supervision, enrollment-profile, and exception-handling rules before payment.
Use the [mobile phone wholesale quality control checklist](/blog/mobile-phone-wholesale-quality-control-checklist) to coordinate this supervision review with the rest of your receiving inspection.
Supervision gives schools and businesses greater control over the devices that they own.
Supervision generally denotes that the device is owned by the organization, which provides additional control over its configuration and restrictions.
The Supervision message is found at the top of the main Settings page.
On a supervised iPhone or iPad, Settings displays text below the Search field and above the Apple Account area stating that the iPhone or iPad is supervised.
The supervision text in Settings on a supervised iPhone or iPad states that the organization can monitor internet traffic and locate the device.
With supervision, an administrator can apply extra restrictions like turning off AirDrop or preventing access to the App Store.
An organization has the option to display a custom ownership message on the Lock Screen using the Shared Device Configuration profile payload.
On iPhone, installed configuration profiles are visible in Settings > General > VPN & Device Management.
To check installed profiles on iPhone or iPad, tap Settings, then tap General, then tap VPN & Device Management, and tap an installed profile to see what type of changes are made.
Check the main Settings page and profile menu on each handset before recording intake notes.
On Android 5 or later devices, an Android Work Profile can be set up to separate work apps and data from personal apps and data.
On an Android Work Profile device, work apps are marked with a briefcase icon to distinguish them from personal apps.
To check if an Android device has a Work Profile, go to Settings > Passwords and accounts and look for a work tab with Work Profile settings listed underneath.
Record any observed supervision notice, installed configuration profile, or work tab in the unit intake log before proceeding to enrollment classification.
## Separate supervised MDM lock profiles from removable enrollments
When reviewing a [used iPhone wholesale](/used-iphone-wholesale) lot, separate supervised organizational enrollments from user-removable profiles before approving the batch.
By default, an Apple device isn’t supervised, and supervision can only be turned on when setting up a new device.
If an Apple device isn’t supervised now, the administrator needs to completely erase the device to set up supervision.
An iPhone with iOS 13 or later is supervised automatically when enrolled using Automated Device Enrollment.
An iPad with iPadOS 13.1 or later is supervised automatically when enrolled using Automated Device Enrollment.
Organizations can supervise iPhone, iPad, and Apple TV devices manually by using Apple Configurator for Mac, which erases the device so all data is lost.
With Automated Device Enrollment, organizations have the option to prevent the user from removing the device management service’s enrollment profile.
When the Prevent unenrollment option is configured on iOS 7 or later and iPadOS 7 or later, a supervised device can’t be unenrolled by the user.
In Microsoft Intune automated device enrollment for iOS/iPadOS, enabling locked enrollment hides the button in the Settings app that lets users remove a management profile so users won't be able to unenroll their device.
Using Apple Configurator, organizations can add Apple devices to Apple School Manager or Apple Business even if they weren’t purchased directly from Apple.
When a device is added to Apple School Manager or Apple Business using Apple Configurator, the user has a 30-day provisional period to release the device from Apple School Manager or Apple Business, supervision, and the device management service.
In Microsoft Intune locked enrollment, on iOS/iPadOS devices manually added to automated device enrollment, users can see the remove management button in the Settings app for the first 30 days after activating their device, and after that provisional period the option is hidden.
Device Enrollment allows users to manually enroll organizational-owned and already deployed devices into a device management service.
Under Device Enrollment, when a user removes an enrollment profile, all configuration profiles, their settings, and managed apps based on that enrollment profile are removed with it.
On an iPhone, if you delete a configuration profile, all of the settings, apps, and data associated with the profile are also deleted.
Account-driven User Enrollment is designed for BYOD deployments where the user, not the organization, owns the device.
With account-driven User Enrollment, IT teams can manage only an organization’s accounts, settings, and information provisioned with a device management service, never a user’s personal account.
Account-driven User Enrollment (minimum iOS 15, iPadOS 15) does not supervise the device upon enrollment.
Account-driven Device Enrollment (minimum iOS 17, iPadOS 17) does not supervise iPhone, iPad, or Apple Vision Pro upon enrollment.
Profile-based Device Enrollment does not supervise iPhone (minimum iOS 4) or Apple TV (minimum tvOS 9) upon enrollment.
Profile-based Device Enrollment (minimum iPadOS 13.1) does not supervise iPad upon enrollment.
## Run a networked restore to expose dormant ADE and zero-touch locks
Follow the reset and networked setup steps below to test whether a clean-looking handset still carries an active organizational assignment.
To erase an iPhone or iPad from Settings, tap General, then tap Transfer or Reset iPhone (or iPad), and tap Erase All Content and Settings.
On an Apple device, erasing (or wiping) obliterates all the keys in effaceable storage and renders all user data cryptographically inaccessible.
A factory restore using a computer erases the iPhone, iPad, or iPod, installs the latest iOS, iPadOS, or iPod software, and removes all information and settings from the device.
During a computer factory restore via the Finder on Mac or the Apple Devices app on a PC, once the restore process finishes, the Hello screen appears on the device, and restoring an iPhone doesn't delete its eSIM.
Stage erased handsets beside a computer and USB cable to observe post-restore setup and activation screens.
Automated Device Enrollment lets organizations configure and manage Apple devices from the moment someone removes a device from its box.
The Hold device in Setup Assistant option (supported on iOS 9 and iPadOS 9 or later) holds the device in the Setup Assistant so the device management service can apply critical configurations or install critical apps.
The Configuration web URL option (supported on iOS 13 and iPadOS 13 or later) specifies a URL that the device loads in the Setup Assistant for authentication, custom branding, or consent text.
When using Automated Device Enrollment, if a device doesn’t meet the minimum operating system version that the service expects, the operating system guides the user through a software update or upgrade before they can continue with Setup Assistant.
In Microsoft Intune ADE Setup Assistant settings, Department appears when users tap About Configuration, and Department Phone appears when users tap the Need Help button.
On first boot, Android zero-touch enrollment devices check to see if they’ve been assigned an enterprise configuration.
If assigned an enterprise configuration on first boot, an Android zero-touch device initiates the fully managed device provisioning method and downloads the correct device policy controller app.
After a configuration is applied to a device in the Android zero-touch enrollment portal, the device automatically provisions itself on first boot, or next factory reset.
Android zero-touch enrollment shows the configured company name during device provisioning and the support email address before device provisioning.
Android zero-touch enrollment supports a mobile or tablet device running Android Pie (9.0) or later purchased from a reseller partner.
Android zero-touch enrollment supports a compatible device running Android Oreo (8.0) purchased from a reseller partner.
Android zero-touch enrollment supports a Pixel phone with Android Nougat (7.0) purchased from a reseller partner.
An Android device must be compatible with Google Mobile Services (GMS) and Google Play services must be enabled at all times for zero-touch enrollment to function correctly.
## Enforce wholesale quarantine rules and verify portal release
Pair this quarantine workflow with the [used iPhone wholesale grading and QC checklist](/blog/used-iphone-wholesale-grading-qc-checklist) when documenting device exceptions.
If setup on a used iPhone presents an unexpected Remote Management or enrollment step, pause the unit's acceptance and request clarification, while the absence of one screen alone does not prove release from Apple Business Manager.
The only time an administrator can view the location of a supervised Apple device is if they put the device into Managed Lost Mode.
When an administrator puts a supervised Apple device into Managed Lost Mode, the device locks and displays a message on the Lock Screen.
An organization can’t track the location of a supervised Apple device without locking it and showing a notification.
Remote wipe using Erase All Content and Settings isnʼt possible for accounts using User Enrollment.
For Android Enterprise fully managed Samsung devices in Microsoft Intune, if Factory Reset is blocked and a Wipe action is initiated, the device loses contact with Intune and is unable to complete the factory reset.
Segregate handsets with unresolved management prompts into a dedicated quarantine tray; we resolve or replace any flagged unit before release.
In Apple Business, an organization removes a device from the program—called releasing a device—if it’s been sold, lost, or can’t be repaired.
Organizations need to release any devices they don’t own or control in accordance with the terms and conditions of the Apple Business Agreement.
To search for specific devices when releasing multiple devices in Apple Business, an administrator can paste up to 1024 serial numbers from a text file, with each serial number separated by a comma.
After a device is released in Apple Business, it remains in the device listing, cannot be assigned to a device management service, and managing Activation Lock using Apple Business isn’t possible.
After a device is released in Apple Business, its status shows as Released in the search field and the device needs to be erased and restored.
Organizations can deregister devices from zero-touch enrollment when transferring ownership by finding the device using its IMEI or serial number and clicking Remove.
## Copyable MDM lock lot inspection and quarantine record
- Order and packing-list reference; carton identifier
- Handset model, serial number, and IMEI observation
- Pre-reset Settings supervision notice observation
- Installed configuration profile or Work Profile observation
- Post-restore networked activation and Setup Assistant observation
- Observed organization name, department, or support contact on provisioning screen
- Quarantine tray assignment and requested seller release action
- Re-test outcome after erase and restore; reviewer disposition
## Align MDM lock inspection with wholesale order terms
We supply new Android phones and tablets, along with used iPhones, starting at 10 units with no per-SKU minimum, and accessory products starting at 20 units per SKU, which can be combined in one order above US$2,000 total value.
Payment is by T/T or L/C subject to the terms confirmed in your RFQ, with delivery to your nominated address in mainland China or Hong Kong or by buyer-arranged UPS/DHL pickup from our warehouse.
We reply within 1 business day to wholesale phone quote requests.
## Frequently asked questions
## Does a factory reset clear an Automated Device Enrollment or zero-touch assignment?
Erasing an Apple device wipes user data keys so local data is unreadable, but Automated Device Enrollment / MDM assignment is not cleared by a local wipe alone. Unless the organization releases or deregisters the device in Apple Business Manager / School Manager (or removes the Android zero-touch portal assignment), the device can automatically re-enroll on the next online setup.
After a configuration is applied to a device in the Android zero-touch enrollment portal, the device automatically provisions itself on first boot, or next factory reset, until that portal assignment is removed.
After a device is released in Apple Business, its status shows as Released in the search field and the device needs to be erased and restored.
## Can an organization track a supervised Apple phone silently without locking it?
The only time an administrator can view the location of a supervised Apple device is if they put the device into Managed Lost Mode.
When an administrator puts a supervised Apple device into Managed Lost Mode, the device locks and displays a message on the Lock Screen.
An organization can’t track the location of a supervised Apple device without locking it and showing a notification.
## Why does the remove management button disappear after 30 days on manually added Apple devices?
When a device is added to Apple School Manager or Apple Business using Apple Configurator, the user has a 30-day provisional period to release the device from Apple School Manager or Apple Business, supervision, and the device management service.
In Microsoft Intune locked enrollment, on iOS/iPadOS devices manually added to automated device enrollment, users can see the remove management button in the Settings app for the first 30 days after activating their device, and after that provisional period the option is hidden.
## RFQ Fields
[Request a quote](/rfq) with your target handset models, quantity breakdown, and receiving inspection checklist.
- Target smartphone or tablet models, storage, color, and condition grade
- Quantity per line item and combined accessory SKUs
- Pre-reset Settings and post-restore activation check steps
- Quarantine hold and seller portal release confirmation rules
- Preferred payment method and inspection timing before dispatch
- Nominated delivery address in mainland China or Hong Kong, or warehouse pickup plan
## Sources
- Apple Support — About supervision on iPhone and iPad
- Apple Platform Deployment — About device supervision
- Apple Platform Deployment — Automated Device Enrollment and device management
- Apple Platform Deployment — Device Enrollment and device management
- Apple Platform Deployment — User Enrollment and device management
- Apple Platform Deployment — Enrollment methods for Apple devices
- Apple Platform Deployment — Add Apple devices to Apple School Manager or Apple Business Manager
- Apple Platform Deployment — Erase devices
- Apple iPhone User Guide — Install or remove configuration profiles on iPhone
- Apple Support — What to do before you sell, give away, or trade in your iPhone or iPad
- Google Android Enterprise Help — Zero-touch enrollment for IT admins
- Google Android Enterprise Help — What is a work profile?
- Microsoft Learn — Set up automated device enrollment (ADE) for iOS/iPadOS
- Microsoft Learn — Retire or wipe devices using Microsoft Intune
- Apple Business User Guide — Release devices in Apple Business
- Apple Support — Restore your iPhone, iPad, or iPod to factory settings using a computer
