How to remove iOS supervision?

Supervision is a special mode introduced by Apple exclusively for institutionally owned Apple devices. When an organization establishes supervision on iOS devices, they will receive the ability to impose granular control over the devices. However, if you do not wish to do so, you can revert the device back to its unsupervised state. Removing the device supervision depends on a number of factors, like the method employed to generate device supervision and the MDM policies associated with the device.

Supervision can be activated on the devices upon MDM enrollment. The following enrollment methods in Hexnode facilitates device supervision:

• Apple Configurator enrollment
• Apple Business/School Manager enrollment
• Apple Business/School Manager enrollment using Apple Configurator

How to identify supervised iOS devices?

You can check the supervision state of the device either from the device end or from the Hexnode portal.

To check the supervision state of an individual device from the Hexnode portal,

1. On your Hexnode console, go to Manage > Devices.
2. Find the device and click on the device name.
3. On the Device Summary page, go to the Hardware Info wizard. The supervision state of the device will be displayed there.

If you want to check the supervision state of all enrolled iOS devices in the portal,

1. Go to Manage > Devices.
2. Click on the pencil icon on the top left of the device list table. Check the box corresponding to Supervised and click Done.
3. Check the filter Platform > iOS. This will update the table with the list of all iOS devices added to the portal.
4. Now check the Supervised column to identify the state of the device.

To check if a device is supervised from the device, go to Settings. On supervised devices, a text saying that the device is supervised and managed by XYZ company will be displayed.

Remove Supervision

1. Apple Configurator enrolled devices

Carry out a full device wipe to remove supervision on Apple Configurator enrolled iOS devices. Note that this will also remove the device enrollment.

Use any of the methods listed below to wipe the device,

• Use the action Wipe Device in Hexnode to remotely wipe the device.

OR

• On your device, go to Settings > General > Reset and click on Erase all Content and Settings.

OR

• Connect your phone with Mac and open Apple Configurator 2.0. Choose Actions > Advanced and click on Erase all Content and Settings.

2. Apple Business/School Manager enrolled devices

Supervision can be removed with or without removing device enrollment on an Apple Configurator enrolled device.

To remove both supervision and enrollment,

1. On your Apple Business Manager account, go to Devices.
2. Select the device and click on Edit Device Management.
3. Click on Unassign and then Continue.
4. Reset your device to the factory settings.

To remove the device supervision without removing device enrollment,

1. On your Hexnode console, go to Admin > Apple Business/School Manager > Apple DEP.
2. Identify your devices from the DEP Devices sub-tab and click on the device name. Note down the Profile Name from the displayed pop-up tab.
3. Go to DEP Configuration Profile sub-tab on the same page and find the profile with the required name.
4. Click on the profile name. This will open a new pop-up tab named DEP Configuration Profile.
5. Disable the check box Enable Supervision and ensure that Enroll devices in MDM is enabled before saving the profile.
6. Now reset your device to its factory settings.

Since ‘Enroll devices in MDM’ is enabled, users will not be provided the option to bypass device enrollment during device activation. So, the device gets enrolled back in Hexnode; however, supervision will be disabled.

Note that users can bypass MDM enrollment if ‘Allow MDM Profile Removal’ is enabled in the DEP configuration profile. This allows removing both the MDM profile and supervision.

3. Apple Business/School Manager devices enrolled via Apple Configurator

Supervision removal on ABM/ASM devices enrolled via Apple Configurator works similar to ABM/ASM enrolled devices.

However, if you are trying to remove only the supervision during the initial 30-days of its deployment (provisional period), users will be provided the option to leave the remote management even if ‘Enroll devices in MDM’ is enabled. If the user chooses to leave management, the device will lose both supervision and enrollment.