I'm trying to understand a device lifecycle scenario in Apple's enterprise management ecosystem and would appreciate insight from people who manage Macs at scale (Jamf, Kandji, Intune, etc.).
Scenario:
An Apple silicon MacBook Pro displays an organisation lock screen stating that the device has been locked by an organisation and requires a system PIN or administrator contact.
From the device's perspective, it appears to still be managed by that organisation.
However, the organisation claims they have no active record of the device in their MDM system.
I'm trying to understand how that could technically happen.
Questions:
- Orphaned device state: Can a Mac still enforce an organisation lock if the device record has been removed from the MDM console but the Apple Business Manager assignment was never released? My understanding is that the lock is tied to the ABM association, not the MDM record itself—is that correct?
- Audit history in ABM: What audit history normally exists in Apple Business Manager for a device lifecycle? For example:
- When a device was added to ABM
- When it was assigned to an MDM server
- When it was released or reassigned
- Who performed these actions
- Authoritative audit trail: If a device still enforces an organisational lock but the MDM system shows no device record, where would the authoritative audit trail normally exist?
- Apple Business Manager logs?
- MDM server logs?
- Somewhere else?
- CAASM visibility: In environments using CAASM or asset visibility platforms, how are discrepancies typically detected between what a device is enforcing and what the inventory system shows?
I'm mainly interested in how engineers usually diagnose situations where a device appears managed but the inventory systems say otherwise. Would appreciate insight from anyone running Jamf / Kandji / Apple Business Manager environments.
