Deprovisioning Devices

• Overview
• Why deprovision devices?
• Marking Device Status

Overview

Keeping a track of all the mobile devices in an organization is a very important device management task to be performed by any mobile device management solution. IT admins need to have complete information about the devices that are in use and the ones that are not currently a part of the workforce. The admin should also be able to deprovision the devices that are not in use. Using Mobile Device Manager Plus, all the IT admin has to do, is to mark the devices to be deprovisioned. 

Why deprovision devices?

Following are the various cases for which we need to mark the devices for deprovisioning.

1. Device is in repair- Mobile devices generally require frequent servicing and while they are in repair these devices are not a part of the workforce and tend to have corporate data that might be at risk if it falls in the wrong hands. Therefore, when a device is being repaired, the device can be marked as Device in service on the MDM server. Doing this will completely wipe the corporate device and just wipe the corporate data in personal devices. The device can be re-enrolled once it has been repaired. If for some reason the device could not be repaired and will be permanently removed from the workforce, the status can be changed to Retire Device.

   Note: If the device was enrolled using KNOX enrollment, the device will get re-enrolled automatically upon boot up. Even if the device is enrolled using DEP, the device will have to be re-enrolled from the Actions option.

2. Employee has left the organization-When an employee leaves the organization, it becomes the admins duty to remove all the data present on the devices, be it corporate or personal devices. The following actions will be performed once the device has been marked as Employee Left Organization.
   • Personal Devices- In case of personal devices, only the corporate data such as the distributed apps and configurations, will be removed from the devices. The device will then be marked as Retired and removed from management.
   • Corporate Devices- For corporate devices, the complete device can be wiped. If the device is going to be used again by another employee, then the device can be added to the admin's stock by marking the device as In Stock. The device can be re-enrolled before handing it over to the new user.In the case of Windows devices, the enrollment is retained (OS version 1803) even after the wipe is performed. If PPKG enrollment is used for other devices, the provisioning package is retained. The device can be used again by just assigning new users. If the device is not going to be used again, the status can be changed to Retire Device, after which the device will be unmanaged.
3. Retire Device- Once the device has served its purpose and will not be used again, it can be marked as Retire Device.  This will unmanage the devices in cases of enrollments other than DEP and KNOX. For these enrollment methods, the devices will have to be manually removed from their respective portals. Additionally, the devices will be wiped The personal devices will be available on the server for 90 days, after which they will be removed.

Marking Device Status

Follow the steps given below to mark the various status for the devices:

1. Click on Enrollmenttab.

2. Choose the device(s) to be deprovisioned.
3. Under Actions, click on Deprovision.
4. Select the required status for the device.
5. If choosing Others, select the type of wipe to be performed along with the reason to deprovision the device. The personal devices will be added to the Retired Devices while the corporate devices will be In Stock.
6. Click on Deprovision to complete the deprovisioning.
All the groups available based on the operating system will be listed from which you can choose and save the default group.

Remove Deprovisioned DEP Devices

If a device enrolled using DEP is deprovisioned, the device will be unmanaged but not removed from the DEP portal. Follow the steps given below to remove the device from the DEP portal

1. Login to the DEP portal using your credentials.
2. Under Manage Devices enter the serial numbers of the devices that were deprovisioned.
3. Select Unassign Devices from Actions.
4. ClickOK to complete the unassignment process.