How to Remove Company Laptops from Intune and Autopilot Before You Sell Them

If your company laptops are managed with Microsoft Intune, a wipe is not enough to make them saleable. A device that is still registered in your Microsoft tenant will re-enrol itself the first time it boots after a factory reset, lock the next user out, and hand a refurbisher a machine that cannot be sold. It is the single most common reason a buyback collection is delayed or a device is paid at scrap value rather than resale value.

This guide is the sequence we ask every seller to complete before we collect. It takes a few minutes per device once you are in the portal, and it protects you as much as it protects the buyer: a device that is still in your tenant is still, in Microsoft’s eyes, your device.

Why a factory reset does not work

Windows Autopilot ties a device to your organisation by its hardware hash, a fingerprint of the physical machine that is uploaded to your tenant when the device is first registered. It survives a reset, a fresh Windows install and a drive swap. When the device next connects to the internet during setup, Windows checks the hash against Microsoft’s registration service, sees that it belongs to you, and applies your enrolment profile. The next owner is greeted with your company sign-in screen.

That is by design. It is what stops a stolen laptop being wiped and reused. It also means that removing the device from your tenant is a step only you can take.

The three places a device lives

A managed Windows device typically has three separate records, and all three need to go:

1. Intune — the management record: policies, apps, compliance state.
2. Windows Autopilot — the hardware-hash registration that triggers automatic enrolment.
3. Microsoft Entra ID (formerly Azure AD) — the device identity object that lets it sign in to your tenant.

Deleting one does not delete the others. The commonest mistake is to remove the device from Intune, see it disappear from the list, and assume the job is done. The Autopilot registration underneath is untouched, and the device will come straight back.

The order that works

Microsoft’s portals enforce a dependency: an Autopilot registration cannot be deleted while the device still has an active Intune record. So the order matters.

1. Retire or wipe the device in Intune

In the Intune admin centre go to Devices → All devices, select the laptop and choose Retire (removes management and company data, leaves the OS) or Wipe (full reset). For a device that is leaving the business, Wipe is the cleaner choice. Wait for the action to complete; the device needs to be online to receive it. If the device is dead or cannot connect, skip to the Delete option on the same screen — it removes the record without needing the device to respond.

2. Delete the device from Intune

Once retired or wiped, select the device again and choose Delete. This removes the management record.

3. Delete the Autopilot registration

Go to Devices → Windows → Windows enrollment → Devices (Windows Autopilot devices). Find the laptop by serial number, select it and choose Delete. This can take a little while to process; the entry will show as pending before it disappears. Until it is gone, the device is still yours.

4. Delete the Entra ID device object

In the Entra admin centre go to Devices → All devices, find the same serial or device name, and delete it. If your tenant has hybrid join with on-premises Active Directory, the on-prem computer object should be removed too, or the sync will recreate the Entra record.

5. Check the serial is clear

Search the Autopilot devices list one more time by serial number. If it returns nothing, the device is free. Do this for every unit, not a sample; it is the serial-by-serial check that catches the one laptop somebody forgot.

Three things people forget

• BitLocker. If the drive is encrypted, the recovery key is stored in Entra ID against the device object. Deleting the object deletes the key. That is fine if the buyer is going to erase the drive anyway — we do — but if you want any data off the machine first, do it before step 4.
• BIOS and firmware passwords. Some organisations set a supervisor password, or use Dell, HP or Lenovo management tools that lock the BIOS. Clear it before the device leaves you. A laptop with a locked BIOS cannot be reimaged and is worth very little to anyone.
• Windows Hello for Business and MFA tokens. These die with the tenant records and need no separate action, but the person who used the device should be told they will need to re-register on their new machine.

If you are selling Macs as well

Apple devices have an equivalent and it is just as strict. A Mac must be signed out of iCloud with Find My Mac turned off, and if it is in Apple Business Manager it must be released from your organisation there. A Mac still tied to an Apple ID is Activation Locked and cannot be resold. A reset does not remove it. We have written up the Mac process separately.

What we ask for at collection

We do not take a seller’s word for it, and you should not want us to. At collection our driver asks the person handing over the equipment to sign a short seller’s declaration confirming that devices have been removed from Intune, Autopilot and Entra ID, that no BIOS passwords remain, and that the company holds title. You keep a copy. It is a one-page document, and it means that if a device does turn up still enrolled, both sides know where the conversation starts.

If you are planning a refresh and want to know what your current fleet is worth before you begin, send the list to info@hgctechnologies.uk or WhatsApp us on 0800 208 8010. Model numbers and quantities are enough to start; we will tell you what else moves the price. Details of how we buy, erase and pay are on our IT buyback page.