The organization that enrolled the phone is the one that can take off a passcode, a work profile, biometrics, remote wipe, or full supervision. A company email prompt after a reset is leftover MDM. It's not a bad cable.
Did you leave a job with work apps still on a personal phone, or pay for a used handset advertised as unlocked?
Names like Remote Management, Knox, Intune, or a Work tab in Settings show up a lot. Thing is, the serial can still sit in Apple Business Manager, Knox Mobile Enrollment, or Android Enterprise, so a factory reset often fails. Skip random bypass APKs and "MDM remover" dongles. Usable paths are the named organization, Apple or Google account recovery when that is actually the lock, the seller, and a U.S. fraud complaint if the listing lied.
What a phone unlock policy is (and is not)
IT can demand a PIN, lock the screen, split work apps into a profile, or supervise the whole device so you can't peel the profile off. A phone unlock policy here is workplace access control. Carrier SIM unlock is a different problem. Those locks only block other networks.
Apple's supervised-device guidance covers another layer. If an iPhone, iPad, Mac, or Apple Vision Pro is supervised, the organization that owns it can restrict features. It may show an ownership message too.
Factory Reset Protection on Android sits beside those rules, and after a wipe Google may ask for the previous account. That account lock is not a work profile. A work profile is not the same as full-device company ownership, and they can all exist on one phone.
You won't find a public consumer toggle that overrides a company that still claims the serial. Enrollment records win.
Check the lock before you do anything else
Open the device sitting in front of you.
- Screenshot every screen
- iPhone or iPad setup may say the device is supervised and managed by an organization; after setup, open Settings, then General, then VPN & Device Management
- Look under Settings, then Accounts or Passwords & accounts, for a Work tab, briefcase-badge apps, or a work profile notice that returns after you swipe it
- Write down the IMEI and serial
Activation Lock is an Apple Account sign-in after an erase, while a Google account prompt after an erase is FRP. A SIM or network message about unlocking is a carrier lock. That IMEI and serial pair is what IT, Apple, a carrier, or a marketplace will ask for.
Android work profile on a phone you own
Your personal photos should stay if you can delete a work profile in Settings on a personal BYOD phone. Work apps and work data drop with that profile. Company-owned, fully managed units play by another rule. The remove button may never appear.
A factory reset can check in with the company again, especially on Samsung units still listed for Knox Mobile Enrollment. Use this order if a delete control is still there:
- Open Settings.
- Tap Accounts or Passwords & accounts.
- Open the work account or the Work tab.
- Choose delete or remove work profile, then confirm.
- Open a personal app and make sure your photos and logins are still there.
Stop clicking if the profile comes back. Mail the old employer with the serial and IMEI and ask them to unenroll the device. Keep a copy.
Remote Management on iPhone and iPad
Apple's supervised-device page says the owning organization can restrict features when setup reports an iPhone or iPad is supervised and managed, and the serial still sits in that company's MDM enrollment. Only that organization can release it.
Forgotten passcode when Intune is in the mix
Workplace Android users on Intune sometimes get a passcode reset from the Company Portal website. IT has to allow the action.
Microsoft documents which devices qualify, including personal phones with a work profile on Android 8 and later, some dedicated devices, and older device-administrator enrollments. The existing passcode is removed first. A temporary letter-and-number passcode replaces it.
You must sign back into Company Portal within five minutes or the reset doesn't finish.
After that reset, anyone who is holding the phone can reach most of the personal and corporate information on it. Microsoft's own warning is blunt.
Plenty of tenants never turn the passcode action on, so it never shows. Plenty of other phones still need a factory reset after a forgotten PIN, and that reset can land you on FRP or MDM enrollment next.
Buying a used phone that might still be managed
Get the IMEI and serial in writing before you pay. Run setup in person.
| What you see | What it usually is | Who can clear it |
|---|---|---|
| Supervised or Remote Management | Company MDM | The organization named on the phone |
| Work tab or briefcase apps | Android work profile | You, on some BYOD phones; otherwise the company |
| Apple Account after erase | Activation Lock | The Apple Account holder, or Apple with purchase proof |
| Google account after erase | FRP | That Google account's owner |
| Other carrier SIM refused | Carrier lock | The wireless carrier |
Don't take the phone home on a promise when Remote Management appears.
Sellers who say it just needs a reset, or they lost the old password, or a cheap software tool will strip management after you send the money, are not offering a five-minute home fix; you are staring at a handset that still reports to someone else's MDM console, and that console can keep pulling the profile back onto the same serial after every wipe, which is why those "too cheap, fully unlocked" listings keep showing up with the same story.
The setup screen is more honest than the listing title. Turns out a lot of ads reuse the word unlocked for phones that still phone home. Walk away unless they unenroll it while you wait.
Why bypass tools and a reset are the wrong plan
A factory reset is not an unlock on a Samsung still listed for Knox Mobile Enrollment, because the company list can re-apply management. It comes back after every wipe.
Sellers of MDM strippers, no-jailbreak removers, and one-click ADB kits are not Apple, Google, or Samsung support. Some take the payment and vanish. Some deliver junk software.
Stripping management from a device you don't own is not a consumer-protection recipe. A price that only makes sense if MDM pops off is a warning label.
If you already left the job, or you already paid
Write IT and ask them to remove the serial from MDM, Knox, Intune, or Apple Business Manager, and attach photos of the lock screen plus IMEI and serial. If the hardware was yours, say that. If it was theirs, set a return.
Use the marketplace's buyer protection and your card or payment app's dispute process if you already paid. Save the listing that said unlocked and your screenshot.
You can file a report with the FTC if the sale looks deceptive. The FCC Consumer Inquiries and Complaints Center is the place for carrier unlocking, billing, and equipment fights. It will not delete a company's MDM profile.
To be honest, nobody can promise you a refund from a help article. That outcome lives in the seller's policy, the marketplace rules, and your payment method.
Open Settings or the setup screen tonight. Screenshot the exact wording and write the IMEI and serial on the same note. Send that packet to the organization named on the device, or to the seller and the marketplace if this was a used purchase.