Overview

If your Macs are not in Apple Business, this method is unavailable — pick another from Enrolment methods.

Prerequisites, all of them required:

• The Mac is organisation-owned and registered in Apple Business — bought from Apple or a linked reseller, or added with Apple Configurator
• The Mac is enrolled with the previous MDM through Automated Device Enrollment (ADE)
• macOS 11 or later
• Administrator access to Apple Business, with a role that can set migration deadlines
• Already connected to Apple Business
• If you deploy apps bought in volume, your Volume Purchase Programme token transferred first

Macs added with Apple Configurator can only migrate after their 30-day provisional enrolment period.

How to use 

Reassign in Apple Business

1. Sign in at business.apple.com.
2. Go to Devices and select the Macs to reassign.
3. Click Edit MDM Server, choose your MDM server as the destination, and confirm.
4. Set the migration deadline. Employees can postpone until then. Keep it inside 30 days if you deploy apps bought in volume.

Set the deadline in the same session as the reassignment. Reassigning alone does not start anything: without a deadline the Mac never gets a prompt, and nothing reports the failure — not Apple Business, not the dashboard, not the device. This is the single most common way the migration silently does nothing.

That deadline lives in Apple Business and covers the migration only. It has nothing to do with the OS update deadline you configure for minimum macOS version.

Check network delivery before you start. If the previous MDM delivers Wi-Fi through a profile, the Mac loses that profile the moment it unenrols — and with no network it cannot reach the new server to finish enrolling. Confirm affected Macs can get online another way, over Ethernet or a manually configured network.

MacOS 26 and later

MacOS 26 supports Apple's native migration. Do not unenrol the Macs from the previous MDM — each one unenrols itself.

1. Apple notifies the Mac that a migration is pending.
2. The employee sees a prompt with your deadline and can start it now or postpone.
3. Reminders repeat daily, then hourly in the last 24 hours, then at 60, 30, 10 and 1 minute before the deadline.
4. At the deadline the Mac shows a prompt that cannot be dismissed, then unenrols and re-enrols.

The Mac is never wiped, whether the employee starts it or the deadline forces it.

The unenrolment signal to the old MDM is best-effort, so delete any leftover device records in the old console by hand.

MacOS 15 and earlier

Native migration does not exist before macOS 26. Instead it relies on enrolment enforcement: a Mac assigned to you in Apple Business and no longer enrolled anywhere prompts the employee to enrol.

1. Reassign the Macs in Apple Business as above.
2. Unenrol them from the previous MDM. Remove the management profile from the old console — deleting the device record is not enough, the profile has to come off the Mac. Employees cannot do this: on a supervised Mac the profile is not user-removable.
3. Trigger the prompt. The Mac re-checks its assignment within 24 hours, or on restart or network change. To force it, run with administrator rights:

```bash

sudo profiles renew -type enrollment

```

The employee accepts the Remote Management prompt. One approval, no wipe.

What changes on the Mac

Employees get the Mac back as soon as enrolment completes — before the recovery key, bootstrap token and bypass code are escrowed. Until those land you have no recovery key and no bypass code for that machine, which is why the verification below is not optional.

Verify

1. Check the Mac appears in Devices, enrolled and supervised.
2. Confirm on the device: System Settings > General > VPN & Device Management should show your profile and no trace of the old one. From the command line:
   ```bash
   sudo profiles status -type enrollment
   ```
3. Confirm profiles and apps applied on the device record.
4. Confirm the FileVault recovery key is escrowed. If it is missing, ask the employee to restart and wait for the next sync — the key cannot be escrowed until the bootstrap token is in place.
5. Check the Activation Lock bypass code is escrowed.

Troubleshooting and FAQ

Troubleshooting

• Apple Business offers no migration deadline for a Mac. It does not meet the requirements. Bulk actions fail silently for it, so check the Apple Business activity log. Confirm it is enrolled through Automated Device Enrollment and past its 30-day provisional period if it came via Apple Configurator.
• The Mac never shows a prompt. On macOS 26 and later, check the deadline is set — this is the most common cause and nothing reports it. Confirm the reassignment saved and the Mac is online. On macOS 15 and earlier, confirm you removed the old management profile, then run sudo profiles renew -type enrollment.
• The Mac has no network after unenrolling. It shows the Wi-Fi picker, and the enrolment screen offers a Choose a Wi-Fi network link.
• You need to cancel a migration on macOS 26. Reassign the Mac back to the previous server before the migration starts; the device withdraws its prompts.
• The previous MDM is already decommissioned. The Mac is not lost — it keeps working and keeps its data, it is simply unmanaged. On macOS 15 and earlier you still need the old console to remove the profile, and neither you nor the employee can remove it without access. Two options: restore access long enough to unenrol, or erase and re-enrol through zero touch, which wipes the device.
• Before erasing anything, turn off Find My or confirm a valid Activation Lock bypass code. A decommissioned MDM cannot hand over its code, and the migration invalidates it anyway. A Mac erased with Find My still on comes back Activation-Locked and unusable. If you cannot turn Find My off while the Mac still boots, do not erase it.

FAQ

1. Does the employee lose anything?
   No. Data, apps and session survive, whether the employee starts the migration or the deadline enforces it.
    
2. Why does nothing happen after we reassign a Mac?
   You almost certainly did not set a migration deadline. Reassignment alone never triggers a prompt.
    
3. Do we unenrol from the old MDM first?
   It depends on the version, and getting it backwards breaks the migration. On macOS 26 and later, no — the Mac unenrols itself. On macOS 15 and earlier, yes — you must remove the old profile.
    
4. How long until we have a recovery key again?
   A new FileVault key is escrowed after enrolment completes, not during it, and the Activation Lock bypass code can take up to a week.

If Macs remain unenrolled after the deadline, or a FileVault recovery key never appears, contact support@factorial.it with the device serial numbers, the macOS version on each one, the name of your previous MDM, and the migration deadline you set in Apple Business.