Reassign a Device (iPad/iPhone) to a different user (Best Practice Question)

[KWebb12]

Currently, we're deleting the Device from Airwatch so it goes back into its Enrollment; revoking tokens and refreshing it. Then, we have the user fully wipe the device and then log into the device and set it up as the new users.

Is this the preferred method for reassigning devices to a different user? Or is there a simpler/different way without wiping the device?

[DavidFink]

I've found this doesn't remove the activation lock from the previous users Apple ID. Curious what other folks are doing as well.

[LukeDC]

You shouldn't need to wipe the device, just enroll again. Deleting from Airwatch issues an enterprise wipe and removes enrollment.

@David - Only Apple can remove Activation locks if the device is not supervised. Use DEP (or configurator at the very least) and you can avoid activation lock issues.

[KWebb12]

Just so I'm clear: Hitting 'Delete Device' will cause it to wipe itself, and remove enrollment; which will prep the device to be re-enrolled for the next user?

Basically, it'll do it all in one step for me. I don't need to have the user wipe the device first. Correct?

[LukeDC · Accepted solution]

Delete does 2 things; 1. Enterprise Wipe (removes all managed data and unenrolls), 2. deletes the record from the console.

If you want to fully wipe the device, you could issue a device wipe first, then delete from the console.

BUT, I generally just delete the device from the console and then erase the device through settings on the device.

Like Dave said though, if the device is not DEP enrolled (Supervised) then you could run into activation lock issues. So beware of that situation too.

[AlthafMashood]

Hi Luke,
How can we disable users from setting activation lock on DEP devices ?

[LukeDC]

This page explains the managed settings section and how it pertains to Activation Lock:  https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/9.7/vmware-airwatch-guides-97/GUID-AW97-DevicesU...

[Stansfield]

We always wipe devices between users because that way no data like pictures remains, also it is the only way to force dep re-enrollment and if they re-enroll enterprise wipe on a dep device they can delete the management profiles