Company laptops leave a business in two ways. Either IT sells or disposes of a batch at the end of a refresh, or an employee is offered their old machine when they leave or get a new one. Both routes run into the same problem: business laptops are designed to stay tied to the company, and that tie has to be removed deliberately.
This guide covers both sides. The first half is for IT managers and finance teams clearing a fleet. The second half is for the employee holding a laptop that has just become theirs. Nothing here is legal advice, and where data protection law is mentioned, your own legal or compliance adviser has the final word.
For IT: start with the asset register
Before anything is wiped, reconcile the devices against the asset register. Note each serial number, the asset tag, the user it was assigned to, and its current state. This is the record that proves where each laptop went, and it is much harder to reconstruct afterwards.
It is also the moment to separate machines by what they are worth. Recent ThinkPads, EliteBooks and Latitudes with 10th gen processors or newer, and Apple silicon MacBooks, have real resale value. Older or broken Windows machines are usually a recycling question rather than a resale one.
- Serial number and asset tag for every unit
- Processor generation, which drives value on business laptops
- Which management system each device is enrolled in
- Whether a BIOS supervisor password is set
- Charger present or not
For IT: release Windows devices from Intune and Autopilot
A Windows laptop registered with Windows Autopilot will go straight back to your company sign-in screen after any reset, on any network, for whoever owns it next. Resetting is not enough. The hardware record has to be deleted from Autopilot, which is a separate step from removing the device from Intune.
- In the Intune admin centre, retire or wipe the device, then delete it from the Intune device list.
- Go to Devices, Windows, Windows enrollment, Devices (under Windows Autopilot), find the serial number and delete the Autopilot record.
- Delete the device object from Microsoft Entra ID if it remains.
- Remove any BIOS or UEFI supervisor password, or record it for the buyer.
- If you use any firmware-level tracking or anti-theft service, release the device from it too.
For IT: release Macs from Apple Business Manager
Macs bought through Apple Business Manager are assigned to your MDM server and will re-enrol automatically after an erase, a process sometimes still called DEP. To sell one, it has to be released from Apple Business Manager itself, not only removed from your MDM.
- In your MDM, unassign the Mac and remove its management profile.
- In Apple Business Manager, find the device by serial number and release it from the organisation. This cannot be undone.
- Make sure any Activation Lock enabled through a user's Apple ID or through MDM is cleared.
- Erase the Mac with Erase All Content and Settings.
For IT: data destruction and POPIA
The Protection of Personal Information Act (POPIA) requires organisations that hold personal information to keep appropriate, reasonable security safeguards in place, and that responsibility does not end because a laptop has been replaced. Retired laptops are one of the more common ways personal information leaves a business by accident.
In practice that means wiping every device, recording that it was wiped, and keeping that record with the asset register. Many companies ask for a data destruction certificate from whoever takes the devices. Ask what your buyer provides before the collection, and check it covers the serial numbers you are handing over. Your compliance officer can tell you what level of evidence your company needs.
Every laptop we buy is wiped before resale. We still recommend wiping before collection, so the data never leaves your control in readable form.
For IT: selling a batch
For 10 or more laptops, use our business route rather than the single-device calculator. Fleets of the same model usually have a mix of conditions and battery wear, and it is quicker to price them together than one at a time. The same rules apply as for a single laptop: Windows laptops must be working, and every device has to be released from management before it can be tested and paid for.
For employees: when your old laptop becomes yours
If your employer offers you your old work laptop, get the transfer in writing, even an email. Anyone buying it from you, including us, needs to be confident it is yours to sell, and a written release from the company is the simplest proof.
Then ask IT one specific question: has it been removed from Intune and Autopilot, or from Apple Business Manager? If they reset it but did not delete those records, the laptop will show your old company's sign-in screen the next time it is set up, and only they can remove it.
- Written confirmation that the laptop is yours
- Confirmation that it has been released from company device management
- The BIOS password, if one was set
- Your personal files copied off, and company data left alone
Release first, then send
We cannot buy a laptop that is still owned or managed by a company. Every laptop has to be fully released before it is collected: removed from Intune, Autopilot or Apple Business Manager, with any BIOS password cleared and, for an employee selling a former work laptop, the company's confirmation that it is theirs to sell. If one arrives still enrolled, we tell you what is showing and it goes back to be released.
The short version
Record every device against the asset register, release Windows laptops from both Intune and Autopilot and Macs from Apple Business Manager, remove BIOS passwords, and wipe before collection. Keep a record of what was wiped for POPIA purposes and ask your buyer what evidence of data destruction they provide. Employees taking over a work laptop should get the transfer in writing and confirm it is out of company management.