Restore a Supervised or MDM-Managed iPhone with IPSW
Restoring a supervised or MDM-managed iPhone with a signed IPSW wipes local content and the on-device management payload. If the serial is still assigned in Apple Business Manager (ABM) or Apple School Manager (ASM), Automated Device Enrollment (ADE) re-enrolls the device at Setup Assistant — so the iPhone returns to MDM even though you just erased it. Activation Lock is independent and survives the restore.
Direct Answer: Restoring a supervised or MDM-managed iPhone with an IPSW removes the on-device management profile but does not release the device from Apple Business Manager. If the serial remains in ABM/ASM, Automated Device Enrollment re-installs supervision during Setup Assistant. Activation Lock stays on. To permanently free the device you must release it in ABM/ASM or use Apple Configurator 2.
What Supervision Actually Means
Before you click Restore, align on three terms Apple uses precisely:
- Supervision. A device-level flag set when an iPhone is enrolled into an MDM server. It is held by the configuration profile and cannot be toggled by the user from Settings unless Apple Configurator says otherwise.
- MDM enrollment. The connection — enrollment profile, certificates, MDM payload — between the device and the company's MDM (Jamf, Intune, Addigy, Kandji, Mosyle, etc.).
- Automated Device Enrollment (ADE). What used to be called DEP. A serial-number-based handshake between Apple Business Manager, your MDM server, and the device's Setup Assistant. It is what re-installs supervision even on a freshly erased iPhone.
If you remember only one thing: supervision is a state held in three places — the device, the ABM/ASM assignment, and the MDM server. A local IPSW restore only touches the first one.
What an IPSW Restore Does to Supervision
| Layer | Behavior after a signed IPSW restore | Notes |
|---|---|---|
| Local user data | Wiped | Standard Restore action |
| Configuration profiles (incl. MDM) | Removed | Profiles cannot survive a Restore |
| Activation Lock | Preserved if Find My was on | Independent of supervision |
| Apple Business Manager assignment | Not changed | Lives in Apple's cloud |
| MDM server inventory | Not changed | Server still "owns" the serial |
| Re-enrollment at next boot | Yes, via ADE/DEP | The catch IT admins forget |
This matches Apple's own deployment documentation: restoring a device does not unbind it from the MDM server. Supervision is removed by the factory reset, but the ABM assignment is unchanged. Restore is allowed from any host in Recovery Mode regardless of supervision.
When This Works
Use a signed IPSW restore when all of the following are true:
- You have proven the iPhone belongs to you, your employer, or your customer — or you are deliberately testing ABM behavior on a lab device.
- The serial is either (a) not in ABM/ASM at all, or (b) explicitly released before you restore via Apple Business Manager → Settings → Devices → tap serial → "Release Device."
- The IPSW you intend to install is still signed by Apple's signing server.
- You can put the device into Recovery Mode (or DFU if root-level corruption is suspected).
- You are running macOS, the Apple Devices app on Windows 11, or iTunes 12.7+ on older Windows.
- You have an Internet connection (Apple's signing server is queried before the IPSW is accepted).
When This Won't Work
Skip the IPSW restore and use a different tool when:
- The Activation Lock screen appears immediately after restore — you must remove the Apple ID, or get a Managed Apple ID bypass code from ABM.
- The iPhone is still assigned in ABM/ASM and you want supervision genuinely gone — release in ABM first, or use Apple Configurator 2 → Unsupervise.
- The device shows Error 3194 (host can't reach Apple's signing server) or Errors 4013 / 4014 (USB bridge faults).
- The iPhone is in a boot loop because of a corrupt MDM payload — DFU Mode restore is safer than Recovery Mode.
- The serial is in Lost Mode / Managed Lost Mode — the device will re-MDM-lock on first boot regardless of your restore.
What You Lose
- Local photos, messages, app data not in iCloud.
- Configuration profiles — VPN certificates, Wi-Fi payloads, per-app VPN, browser restrictions.
- The on-device MDM payload.
- Any supervised-only restrictions (single-app mode, always-on VPN, etc.).
- Cellular plan if eSIM — you can transfer with Quick Transfer, but if the device went back to Activation Lock first you may need to reactivate through the carrier.
What Happens Next
- iPhone boots to Hello screen.
- If Find My was on: Activation Lock screen.
- If serial still assigned in ABM/ASM: Setup Assistant adds Remote Management as a mandatory screen (it cannot be skipped unless the MDM admin marked the PreStage as "skip Setup Assistant panes").
- The user is forced to download a management profile from the MDM server.
- The MDM server pushes back its policies, apps, and restrictions.
Activation Lock vs MDM Lock
These are two independent locks that often confuse people:
- Activation Lock. Tied to Find My and the original Apple ID. Survives any local restore.
- MDM lock (Remote Management). Tied to the configuration profile and the MDM server. Removed by Restore, but re-installed by ADE.
They can both be active at once. A device can be Activation-Locked and MDM-managed simultaneously.
| State after restore | What unlocks the device? |
|---|---|
| Activation Lock only | Original Apple ID + password, then ABM Managed Apple ID bypass |
| MDM-only (ADE re-enrolls) | Release in ABM/ASM first, then restore |
| Both | Identity owner AND organization must both release |
Requirements Before You Start
- Signed IPSW for the exact iPhone model (carrier + region matters).
- A modern Mac (Finder), Windows 11 with the Apple Devices app, or Windows 10 with iTunes 12.7 or later.
- Lightning or USB-C cable rated for data (charge-only cables will fail at host handshake).
- Network access to Apple's signing servers (no captive-portal Wi-Fi).
Common Mistakes
- Restoring before releasing the device in ABM/ASM. Result: ADE re-enrolls anyway and the user thinks Restore failed.
- Expecting Restore to remove Activation Lock. It does not.
- Using a charge-only cable and ending up with 4013/4014 — the user assumes supervision caused the failure.
- Confusing Update with Restore. An iOS update preserves configuration profiles (and therefore the MDM payload). Only Restore wipes them.
- Skipping the iCloud / Find My sign-out step. Find My keeps Activation Lock on.
Edge Cases Worth Knowing
- Restoring a backup from a non-supervised iPhone onto a supervised iPhone automatically strips MDM.
- Restoring a backup from the supervised iPhone itself preserves the supervision bit and the management payload.
- Restore Image (.ipsw) via Apple Configurator 2 is the unsupervise-aware variant — it preserves serial assignment in ABM but lays down a downgrade-grade image. Useful for refurbishers returning inventory to stock iOS.
- iPhone with Managed Apple ID + Activation Lock bypass code in ABM: the bypass code can clear Activation Lock post-restore without the original Apple ID.
- Lost Mode + supervised: ABM Remote Commands push a message to the lock screen even on a freshly restored device.
Compatibility and Version Notes
| iOS feature | Effect on supervised restore behavior |
|---|---|
| iOS 17+ | ADE triggers before user Apple ID sign-in, "Remote Management" screen mandatory. |
| iOS 16+ | Introduced eSIM transfer over Bluetooth — preserves plan across restore if Quick Transfer is used before erase. |
| iOS 15+ | Activation Lock bypass codes for Managed Apple IDs are first-class. |
| iOS 13+ | ADE bypass flow hardened; supervised devices with no PreStage must enroll. |
| iPadOS 13.1+ | Same behavior for supervised iPads; this article applies. |
| Apple silicon hosts (M1/M2/M3 Mac) | Finder-based restore is fully supported; Apple Configurator 2.x runs natively. |
How to Actually Do It (Supervised-Aware Variant)
- Release the device in ABM/ASM if you want to free it from MDM. Skip if you want it to re-enroll.
- Find and verify the correct signed IPSW for your exact iPhone model.
- Back up to iCloud or to a Mac/PC.
- Power off the iPhone. Hold the right button combo to enter Recovery Mode or DFU Mode.
- Open Finder / Apple Devices app / iTunes. Select the device, hold Option (⌥) / Shift and click "Restore."
- Choose the .ipsw you downloaded. Restore begins.
- If you hit 3194 / 4013 / 4014, troubleshoot with the linked guides.
- After restore, follow Setup Assistant. If released in ABM, no Remote Management screen. If not released, Remote Management re-appears.
- Resolve Activation Lock if prompted.
FAQ
Does an IPSW restore remove MDM supervision?
An IPSW restore wipes local content, configuration profiles, and the on-device management payload, so the device appears supervision-free immediately after. However, if the device is still assigned in Apple Business Manager or Apple School Manager, Automated Device Enrollment re-applies supervision when Setup Assistant runs.
Will my iPhone re-enroll into MDM after I restore?
Yes, if the serial number is still assigned to an MDM server in Apple Business Manager or Apple School Manager. ADE checks the serial during Setup Assistant and silently re-installs management before the first user-signed-in iCloud account is created.
Is Activation Lock the same as MDM lock?
No. Activation Lock is tied to Find My and the Apple ID that signed out last; MDM lock is tied to the configuration profile and the MDM server. They are independent and can both be active on the same device.
Can a user remove MDM with a signed IPSW?
A signed IPSW restore removes the local MDM payload but does not release the device from Apple Business Manager. To permanently remove MDM the device must also be released in ABM/ASM or removed from the MDM server. Otherwise Setup Assistant will re-enroll it.
Does a DFU restore behave differently from Recovery Mode for supervised devices?
For the supervised-management data plane, no — DFU and Recovery Mode both install system firmware cleanly and erase the configuration profile payload. DFU differs only in how it handles boot-loader-level corruption and is more thorough for low-level firmware issues.
Will I lose Activation Lock if I restore with IPSW?
No. Activation Lock survives any local restore as long as Find My is on. After the restore, the device shows the Activation Lock screen and requires the original Apple ID or a Managed Apple ID bypass code generated from ABM.
What tool should I use instead of an IPSW to free a supervised iPhone?
The correct tool is Apple Configurator 2 (Unsupervise action) for Macs, or — for permanently releasing the device — ABM/ASM Release Device followed by Remove from MDM Server. An IPSW restore only resets the data plane.
Does restoring from a different-device backup delete MDM?
Yes. Apple states that restoring a backup taken from a non-managed device onto a supervised device deletes the management configuration and MDM enrollment; the device then needs to be re-enrolled through DEP or manually.
Will my iPhone supervision flag return if I simply Update (not Restore) IPSW?
Usually yes. iOS Updates preserve configuration profiles and the supervision bit. Only Restore or Erase All Content and Settings removes the local management payload.
Does the Apple Devices app on Windows handle supervised devices?
Yes. The Apple Devices app and iTunes 12.7+ can both restore a signed IPSW onto a supervised iPhone. Behavior with respect to MDM is identical to Finder on macOS: the local profile is wiped, ADE re-enrolls if the serial is still assigned.
