Guides → Practical guides

Disposing of company phones and tablets: activation locks, MDM and wiping

25 September 2026 · 4 min read

A company iPhone that's still tied to someone's Apple ID can't be set up by anyone else. It can't be resold or reused, and it has no value except as scrap. Getting phones and tablets ready for disposal is mostly about releasing them from their accounts before they leave.

The two locks that catch people out

Apple Activation Lock

When "Find My" is switched on, an iPhone or iPad is linked to the Apple ID that enabled it. After a reset, the device asks for that Apple ID's password before it can be activated. It's excellent theft protection. It also means a phone from a leaver who never signed out is locked for good unless you can get their password or use your management tools to clear the lock.

Google Factory Reset Protection

Android has the same idea. After a reset that wasn't done through the device's own settings, it asks for the Google account that was last signed in. On business devices, the account is often a personal one the user added, so the company doesn't have the credentials.

Why it matters for disposal

A locked device has no resale value, so its cost can't be offset against the disposal. More importantly, you can't confirm what state it's in. It has to go for physical destruction, which is fine for security but means a working device with value gets shredded.

Before phones and tablets leave

1. Record the IMEI and serial of each device against the register.
2. Remove it from your MDM (Intune, Jamf, Workspace ONE and so on) so it doesn't re-enrol, and release it from Apple Business Manager or Android zero-touch enrolment if you use them. Otherwise it may try to rejoin your organisation for its next owner.
3. Clear the activation locks. Sign out of the Apple ID or Google account. For supervised Apple devices, your MDM can provide an Activation Lock bypass code.
4. Remove SIM and memory cards. Cancel or reassign the SIM. Delete eSIM profiles. Memory cards are separate flash media and need destroying in their own right.
5. Erase the device from its settings menu or through your MDM.
6. Hand it over, with the serial list, to a carrier who will verify it or destroy it.

How well does a phone reset work?

Better than on a computer. Modern iPhones and Android phones encrypt all user data by default, and a proper erase destroys the encryption key, which leaves the data unreadable. That technique is called cryptographic erase, and it's recognised in NIST 800-88 (see is encryption enough?). For a reasonably modern, working device that's going back into use, an erase that's verified and logged is a sound approach.

It's less reliable for:

• Older devices from before encryption was on by default, or that have gone years without updates.
• Damaged devices that won't power on or finish an erase.
• High-sensitivity devices, where you want certainty rather than confidence in the vendor's implementation.

All of these should be physically shredded. Phone storage is flash memory soldered to the circuit board and it can't be degaussed, so shredding the whole device is the answer.

Tablets in schools and shared settings

Shared iPads and Android tablets are often managed in bulk and rarely tied to one person, which makes releasing them easier, as long as it's done before they're boxed up. Chromebooks follow a similar pattern through the Google Admin console, where they need deprovisioning. There's more on that in our guide to IT disposal for schools.