How to Get an MDM Key to Activate a Mac

Eric DawsonByEric Dawson Computers & Software

If you’re searching for how to get an MDM key to activate a Mac, you generally cannot obtain one as an individual owner. An MDM key usually means an Apple Business Manager server token that an organization’s authorized administrator downloads and connects to its MDM platform, or an Activation Lock recovery option controlled by that organization.

For a work or school Mac, contact the IT department or school administrator. If the Mac was bought used, ask the seller or previous owner to remove Find My and have the organization release the Mac from Apple Business Manager. When the screen requests an Apple ID and password, that points to Activation Lock, which can be cleared with the original account holder’s credentials, an MDM bypass code, or Apple Support assistance with proof of purchase.

Can You Get an MDM Key to Activate a Mac?

An MDM key normally refers to an organization-controlled credential, not a code issued to an individual buyer. Instead, the company, school, or other organization that manages the Mac controls the Apple Business Manager and MDM connection. If a setup or recovery screen offers “Activate with MDM key,” an authorized administrator may use that route when it is available.

For organization deployment, the more common meaning is an Apple Business Manager MDM server token. In Apple Business Manager, an administrator opens Settings, chooses MDM Servers, selects the server, and downloads its server token. That token is uploaded to the organization’s UEM or MDM platform, linking Apple’s activation services to the management service.

Administrators then assign Mac serial numbers or Apple purchase-order CSVs to that MDM server instance. One server connection is managed with its own key or token, rather than a separate key for every Mac. Renewal is required annually because an expired token can interrupt activation, enrollment, or ongoing management.

When the Mac belongs to an employer or school, its IT department or administrator handles enrollment, token access, and any permitted activation assistance. Neither wiping the Mac nor removing a locally visible MDM profile reliably releases a device that remains assigned in Apple Business Manager.

Once an assigned Mac reaches first power-on, it contacts Apple’s activation servers and can automatically enroll, receiving the organization’s configuration. Depending on the MDM setup, that configuration can include Wi-Fi settings, security policies, apps, VPN settings, encryption, password rules, FileVault, Gatekeeper settings, and restrictions. Accordingly, an independently purchased “MDM key” is not a supported ownership-transfer solution.

Confusion arises because “MDM key” can also describe an Activation Lock recovery path in Recovery Assistant, rather than the server token used for enrollment. Activation Lock ties a Mac to an Apple ID and can be removed using the associated Apple ID and password or an MDM bypass code; Find My Mac turns it on automatically.

By contrast, an Activation Lock bypass code lets authorized IT administrators unlock an organization-controlled device when a user leaves or forgets credentials. Before spending money on a supposed key or a bypass tool, recognize that profile-blocking tools have uncertain effectiveness and are not an ownership-transfer solution.

Tell MDM Enrollment from Activation Lock

MDM enrollment connects a Mac to an organization’s device-management service, while Activation Lock ties the Mac to an Apple ID. Activation Lock can require the associated Apple ID and password even after the internal drive has been erased and macOS is set up again.

Organization-managed enrollment is associated with a company, school, or other institution that assigns devices through Apple Business Manager or Apple School Manager and a management service.

What Each Screen Usually Means

Apple ID credentials address Activation Lock because the feature is linked to the account previously used on that Mac. Find My can keep the lock in place after a drive format, preventing another person from activating and using the computer as new. Even when a Mac mentions an MDM key alongside account details, the request may involve two separate controls: organization enrollment and Apple ID-based Activation Lock.

What You See Likely Type of Lock Relevant Party Practical Path
An Apple ID and password are requested after erase Activation Lock The Apple ID owner Sign in with the original Apple ID and password
A company, school, or organization appears during setup MDM enrollment The organization’s device-management administrator Ask the organization to remove or unenroll the Mac
“This Mac belongs to” appears on a used Mac Organization ownership or management warning The seller or named organization Have the Mac released before completing the sale
A device was wiped but management returns during setup Apple Business Manager assignment The organization controlling the assignment Remove the Mac from the organization listing

Local signs of management can include profiles in System Settings under General and Device Management, or the presence of “mdmclient” in Activity Monitor. Formatting the computer or removing a locally removable profile does not necessarily end enrollment when the Mac remains assigned through Apple Business Manager.

When the issue is Activation Lock, the previous owner can remove Find My before resale or use iCloud.com/find to select the device, choose “Erase,” and then choose “Remove This Device.” For an Apple ID password that has been forgotten, account recovery is available through iforgot.apple.com, and Apple Support may be contacted with proof of purchase. Avoid unauthorized bypass tools, since they are not an ownership-transfer solution and may create permanent lock or data-loss risks.

What to Do When a Mac Shows Remote Management

Beyond that, when Remote Management appears during setup, the organization that controls the Mac’s enrollment must release or unenroll it before the device can be set up without that management. Contact the company’s IT department, school administrator, or seller and ask them to remove the Mac from the organization’s device-management service.

Ask the Organization to Release the Mac

Start by saving the exact wording on the setup screen, along with the Mac’s serial number and any order or sale details you have. Record the organization name shown during setup if one appears. Ask the seller or administrator to confirm that the Mac has been unenrolled before you erase it or begin setup again.

Request removal from the Apple Business Manager listing as well when the Mac was previously assigned to that organization’s MDM server. After the organization completes the release, restart setup to see whether Remote Management no longer returns.

  1. Record the Mac serial number and the wording shown on the Remote Management screen.
  2. Ask the employer, school, seller, or previous owner to contact the administrator who manages the device.
  3. Request that the Mac be released from its MDM assignment and unenrolled from Apple Business Manager before resale or transfer.
  4. After confirmation, erase or set up the Mac again and check whether management enrollment reappears.

For a work-owned Mac, the appropriate route is the employer’s IT department because authorized administrators control the Apple Business Manager and MDM relationship. Likewise, a school-issued Mac should be handled by the school administrator rather than by a student or family member trying to obtain an MDM key. Where a business sold the Mac, the seller should have arranged unenrollment before the sale, including removal from the Apple Business Manager listing when required.

Do Not Treat a Wipe as a Release

Deleting a locally visible management profile does not resolve enrollment when the Mac remains assigned to an organization in Apple Business Manager. Formatting the internal drive and setting up macOS again can cause the management profile to download again after activation. Keep any purchase records available if you need to return the Mac to a seller or explain the issue to the organization that enrolled it.

Before buying another used Mac, ask the seller directly if it is enrolled in MDM or linked to an organization. Use the seller’s response, the device’s visible management status, and the terms of sale to decide whether the Mac is suitable to purchase. Bear in mind that a clean local check may not settle the question permanently, because management can reappear after an erase or a macOS upgrade.

How an Apple Business Manager MDM Key Works

Administrators obtain and maintain that token for the MDM server connection; it is not a code generated separately for each Mac.

Rather than functioning as a personal activation password, the token is a cryptographic authentication file associated with an Apple Business Manager account and a specific MDM server. One server connection has its own managed token, which allows Apple’s activation services and the organization’s UEM or MDM platform to communicate. SuperOps describes the downloaded file as a “.pem” authentication token, while other MDM setup guidance calls it an MDM server token.

Creating the Server Connection

Next, the administrator selects the relevant server and downloads its MDM server token. Esper’s setup flow also includes adding a device-management service and uploading the MDM provider’s public key before downloading or renewing the server token.

Once the server connection is active, the organization assigns Macs to that MDM server in Apple Business Manager. Administrators can assign individual device serial numbers or use Apple purchase-order CSV files, depending on how the devices were acquired and recorded. Groups can also be set up so that different Macs receive policies and configuration suited to their users or roles.

What Happens When an Assigned Mac Starts

Following verification, the Mac automatically enrolls with the organization’s selected MDM platform and receives its configured setup. Apple Business Manager supports zero-touch setup, direct MDM integration, supervised mode, and locked enrollment for organization-managed devices.

Annual renewal keeps the Apple Business Manager server token valid. Expired tokens can interrupt activation, enrollment, or continuing device management, so administrators renew them about every 12 months through the same Apple Business Manager server workflow. Many MDM platforms support advance expiry reminders, including notices at 30, 15, and 7 days before renewal is due. Separately, Apple Business provisioning may also require an APNS certificate and a VPP token, which serve different roles from the DEP or ABM server token.

How to Check an MDM Profile on a Mac

Check a Mac’s local settings for management profiles and review its Activation Lock status in System Information. Those checks can show what is visible on the computer, but they cannot prove that the Mac has been released from organization management. Start in System Settings, choose General, then select Device Management to look for installed profiles.

Profiles shown in Device Management can indicate that the Mac has an active MDM profile. There may be an option to select a locally removable profile and use the “-” button to remove it.

Check Activation Lock and Running Processes

Next, check the local Activation Lock entry by clicking the Apple menu while holding Option, choosing System Information, and finding “Activation Lock.” A Mac being evaluated for purchase should show “Disabled” in that entry, according to the used-Mac guidance. Activity Monitor offers another local clue because searching for “mdmclient” can indicate MDM activity on the Mac.

Neither a disabled Activation Lock entry nor an empty Device Management screen gives a complete ownership history. Management can be assigned outside the local macOS installation, so a wiped Mac may download its management profile again during setup. Some users report that profiles do not become apparent until after a macOS upgrade, which makes a clean check only a snapshot of the Mac’s current state.

A Mac that displays “This Mac belongs to” deserves particular caution, since the used-Mac guide says there is a good chance that it is stolen or missing. Formatting the computer and setting up macOS from scratch may still be needed to see whether management reappears, while the organization that controls the device’s enrollment remains the party able to release it.

What to Do About Activation Lock on a Mac

If you bought the Mac from someone else, ask that person to remove the device from their account before you try to set it up again.

For a Mac still linked to your own Apple ID, enter the original account credentials when prompted during activation. Once access to that account is restored, use the Apple ID and password to continue. That approach applies when the setup screen asks for account details after the Mac has been erased or prepared for a new installation.

Alternatively, a previous owner can remove Activation Lock remotely through iCloud.com/find. From the device list, they select the Mac, choose “Erase,” and then select “Remove This Device.” After the Mac is removed from that account, it is no longer tied to the former owner’s Find My settings for activation.

Apple Support can sometimes help with an Activation Locked Mac when the owner has proof of purchase. Bring purchase documentation and use getsupport.apple.com from another device to start a chat or request a phone call. Support may also direct an account holder to iforgot.apple.com when the Apple ID password has been forgotten.

Avoid unauthorized bypass tools, which a support case warns can lead to permanent lock or data loss. Formatting the internal drive does not remove Activation Lock because the protection can continue even after macOS is set up as new. Ownership records and the Apple ID connection, rather than the files stored on the Mac, determine whether activation can proceed.

Why Erasing or Bypass Tools Do Not Solve Enrollment

Erasing a Mac or deleting its local settings does not reliably end organization enrollment. A device that remains assigned to an organization’s MDM server can download its management configuration again after it is wiped and set up. Because the assignment is held through the organization’s Apple Business Manager and MDM connection, it is not limited to files stored on the Mac.

Instead, the organization that controls the Apple Business Manager listing must unenroll or release the device before a sale. When a business-sold Mac has not been properly released, Remote Management can return during setup even after a full erase. An organization may need to remove the Mac from its Apple Business Manager listing, rather than merely delete a local profile. Simply wiping the drive and reinstalling macOS does not change that server-side assignment.

Local Profile Removal Has Limits

Option-clicking the Apple menu, choosing System Information, and reviewing the Activation Lock entry can also help assess the Mac before purchase. Activity Monitor may show “mdmclient,” another indicator that MDM is present. Used-Mac buyers have also reported management reappearing after a macOS upgrade.

Unsupported tools are not a dependable ownership-transfer solution. Their effectiveness is uncertain, and unauthorized bypass tools carry risks that include data loss or a permanent lock. Neither a profile-blocking tool nor the minus button beside a removable profile resolves an Apple Business Manager assignment that causes the Mac to enroll again. Only the administrator controlling the organization-managed enrollment can make the change that prevents repeat enrollment.

For a used Mac that returns to Remote Management, identify the named organization before completing the purchase. Keep in mind that a wipe can remove local data while leaving the underlying enrollment relationship intact. That distinction is why an MDM profile on a Mac and an Apple Business Manager assignment require different remedies.

Frequently Asked Questions

Can I Buy an MDM Key for a Mac?

An MDM key is not a consumer product or a code assigned to an individual Mac buyer. It is generally an Apple Business Manager server token that an organization’s authorized administrator downloads and connects to its MDM platform. For a work, school, or previously owned Mac, contact the organization, school administrator, or previous owner instead of seeking a key independently.

What Does “Activate with MDM Key” Mean on a Mac?

“Activate with MDM key” is a Recovery Assistant option associated with an organization-managed Mac and an Activation Lock recovery route. It does not mean that any Mac owner can generate an unlock code. Where that option appears, an authorized administrator may be able to provide the required Activation Lock bypass capability or use the organization’s management arrangement.

Can Apple Remove MDM from a Used Mac?

A used Mac that remains assigned to an organization’s Apple Business Manager account needs to be unenrolled or released by the organization that controls that account. For context, a business-sold Mac should have been unenrolled before sale. Apple Support can sometimes help with Activation Lock when proof of purchase is provided, but MDM enrollment and Activation Lock are separate issues.

Will Erasing a Mac Remove an MDM Profile?

Erasing or reformatting a Mac does not reliably remove organization management when the device remains assigned in Apple Business Manager. During setup, the Mac can contact Apple’s activation servers and download the management profile again. Removing a locally visible profile also does not resolve an Apple Business Manager assignment that causes re-enrollment after an erase.

How Can I Tell Whether a Used Mac Has Activation Lock?

On the Mac, click the Apple menu, hold Option, choose System Information, and check the “Activation Lock” entry. For a used Mac, the cited guidance says that entry should read “Disabled.” Before purchase, also ask the seller whether the Mac is iCloud locked or enrolled in MDM, and inspect System Settings > General > Device Management for profiles.

How Often Must an Apple Business Manager Server Token Be Renewed?

An Apple Business Manager MDM server token must be renewed annually, typically every 12 months. Meanwhile, an expired token can interrupt activation, enrollment, or continuing management. Some MDM services provide expiry reminders 30, 15, and 7 days before the renewal deadline.

In practice, an MDM key is normally part of an organization’s Apple Business Manager and MDM setup, not something a private Mac owner can buy or generate. First identify the screen you are seeing: an Apple ID request points to Activation Lock, while Remote Management or an organization name points to managed enrollment. For a second-hand Mac, work with the seller or organization that controls the device record, because wiping the Mac alone may trigger management enrollment again.

References

Sources read in September 2026.

Eric Dawson

I'm Eric Dawson, and I write The Money Watch from north Columbus, Ohio. Most of what I cover comes from my own life: renting, a 2014 Honda Fit, parking, computers, food and the bills behind all of it. I spent four years in an apartment-property office and eleven on a distributor's operations desk, reading leases and invoices. Where you need real information, I research the maker's or agency's own page and independent sources and report what they publish. I don't give tax, investment, legal or medical advice.