What you will achieve
Tell whether your Mac is MDM-managed by work or school and what that limits.
MDM enrollment means an organisation pushes profiles controlling updates, apps, and encryption. Personal Macs lack Device Management pane. BYOD programs may use lighter user enrollment. Know who can remote wipe before signing into work Apple ID on personal hardware.
1) Check enrollment
- System Settings → General → Device Management (or Profiles).
- Configuration profiles and MDM payload listed = managed.
- About This Mac may show DEP enrollment organisation.
2) What MDM can control
- Password policy, FileVault enforcement, software update deferral.
- App allow/block lists, VPN and Wi‑Fi profiles.
- Remote wipe and Activation Lock for organisation-owned devices.
3) Personal Mac
No Device Management pane; you own firmware password and erase decisions. iCloud Activation Lock still applies if Find My enabled.
4) BYOD nuance
User Enrollment and Account-Driven User Enrollment scope to work account container on personal Mac — less invasive than full device enrollment.
5) Leaving employer
IT removes MDM profile on return. If still enrolled, you may not disable certain settings — contact IT, do not hack around profiles on corp devices.
6) Supervision vs enrollment
Supervised devices get stricter controls — common on school iPads and corp Macs from Apple Business Manager. Personal Mac with work profile may be user enrollment scope only.
7) Profile payloads you will see
Wi-Fi, VPN, SCEP certs, PPPC privacy preferences, software update deferral — each payload has gear icon explaining restriction. Screenshot before leaving job.
8) Activation Lock org
Org-owned Mac can be activation locked to MDM — personal Apple ID should not be primary on work machine if policy forbids. IT removes lock on return via ABM.
Verify
You know enrollment status; policies explained in Device Management info buttons; personal Mac has no unknown profiles.
Additional troubleshooting notes
If steps above do not resolve the issue on the first attempt, reboot once, confirm System Settings → General → Software Update is current, and retry with a second administrator account to rule out profile or keychain corruption in your daily user. Document exact error text from Console.app with timestamp — vague “it still fails” without logs wastes support time. On Apple Silicon, re-test after full shutdown (not just restart) because firmware and Thunderbolt controllers reset only on cold boot. Intel Macs should repeat test in Safe Mode to bypass third-party login items. Before erase or keychain reset, verify Time Machine or clone backup completed — batch 3 guides assume Monterey/Ventura/Sonoma/Sequoia paths in System Settings; search Spotlight for renamed panes if your macOS version labels differ slightly.