Skip to main content
This guide applies to Mac computers, iOS devices, iPadOS devices, tvOS devices, and visionOS devices

​
About Device Erase

You can use the Erase Device command on macOS, iOS, iPadOS, tvOS, and visionOS devices. This command doesn’t require supervision. For Windows computers, see Erase a Windows Computer. For Android devices, see Erase an Android Device.

​
How It Works

The Erase Device command permanently removes all data and settings from a device, returning it to factory defaults. The command is delivered through the MDM framework and executes when the device is online or queued for offline devices.
A locked Apple device cannot receive an Erase Device MDM command. For more information on locking a device, see our Lock a Device support article.

​
Erase Apple Devices

1

Navigate to Device Record

Navigate to the Device Record in the Iru Web App.
2

Open Device Action Menu

Open the Device Action Menu (ellipsis) in the upper right of the device record.
3

Select Erase Device

Select Erase Device.
After you select Erase Device, the confirmation dialog and erase behavior depend on the device. iPhone, iPad, and Apple TV support Return to Service during erase. Return to Service re-enrolls the device automatically after the erase. Mac computers and visionOS devices do not support Return to Service.
1

Confirm Erase

Type ERASE in the confirmation field and select Erase Device to send the command.

​
macOS Erase Behavior

Erase behavior depends on the Mac computer’s hardware. The command either performs Erase All Content and Settings (EACS) or obliteration. If EACS fails, the Mac falls back to obliteration.When obliteration uses a PIN, Iru generates a 6-digit PIN and shows it on the device record after the Mac receives the command. Erase device PINs are not supported on Mac computers with Apple silicon.

​
EACS Requirements

  • Bootstrap token: EACS fails if no bootstrap token is escrowed.
  • Iru Web App: Use the Iru Web App rather than the local Erase Assistant.
  • Auto Advance: Using the Iru Web App prepares the Mac for re-enrollment with Auto Advance.

​
Legacy Firmware Passwords

On Intel-based Mac computers with the T2 Security Chip, Iru sends Erase All Content and Settings. If a legacy firmware password is still on the Mac, the device completely erases and requires a macOS reinstall instead of EACS.To keep EACS, move the Mac to a Blueprint that does not include a Recovery Password Library Item, then send the Erase Device command.

​
Return to Service

Return to Service erases an eligible device, advances it through Setup Assistant, and re-enrolls it in Iru Endpoint without user intervention. The device must be enrolled through Automated Device Enrollment (ADE). It is available for iPhone and iPad devices, and for Apple TV devices running tvOS 18 or later. In the Erase Device confirmation dialog, select Use Return to Service. You can optionally choose a Wi-Fi profile from your Library so the device can join a network after erase.
On iPhone and iPad, remove Activation Lock before you send the command. Return to Service does not work when ADE requires authentication.When you select Use Return to Service:
  • The device proceeds through Setup Assistant to the Home Screen without user intervention.
  • The device re-enrolls in Iru Endpoint after erasure.
  • The device joins the Wi-Fi network from the Library Item you selected.
  • A tethered Ethernet connection, such as a kiosk, works without a Wi-Fi profile.
On iPhone and iPad devices running iOS 27 or iPadOS 27 or later, Retry enrollment appears after you select Use Return to Service. It is selected by default. Deselect it if you do not want the device to retry. If enrollment fails after erase, the device retries automatically, with an increasing delay of up to 5 minutes between attempts. Retry enrollment does not appear on iOS or iPadOS versions earlier than 27.Do not select a Wi-Fi Library Item that uses an EAP-TLS 802.1X network with a SCEP client identity.Self Service apps do not automatically reinstall when you erase the device from Iru Endpoint.

​
Preserve managed apps

Preserve managed apps keeps the managed apps on an iPhone or iPad through a Return to Service erase, so the device does not need to download those apps again after it re-enrolls. All user data is still erased, including the data each app stores on the device.The option appears only when the device meets all of these requirements:
  • The device runs iOS or iPadOS 26 or later.
  • The device is enrolled through Automated Device Enrollment (ADE), which means it is supervised.
  • The device is in app preservation mode.
To put devices in app preservation mode, turn on Allow app preservation during Return to Service in the Automated Device Enrollment Library Item. The checkbox appears below Preserve managed apps during migration in the iPhone and iPad sections. Apple applies ADE profile changes only at enrollment. For a device that is already enrolled, the setting takes effect after its next erase and re-enrollment. The first Return to Service erase on that device is standard, and app preservation starts with the next cycle. Turning the setting off works the same way in reverse.A device escrows a bootstrap token with Iru when it enrolls in app preservation mode. If the token is missing, Preserve managed apps appears disabled, with a message that the bootstrap token is missing. The device escrows a token the next time it enrolls, including the re-enrollment after this erase, so the option is available for the following erase.When the option is on, the erase includes the escrowed bootstrap token. When the option is off, or the device is not eligible, the erase uses standard Return to Service.During the Setup Assistant hold, Iru installs the device’s managed apps, so the preserved snapshot includes them. Apps assigned to the device after it is configured are not preserved for that cycle. If you select Release hold before the installs finish, the remaining installs are canceled, and apps that are not yet installed are not preserved for the next cycle.While a device is in app preservation mode, Apple applies software and app updates only during enrollment. Restoring the snapshot on the next cycle would otherwise revert any update installed in between, so Apple enforces this on the device. To update the OS on these devices, require the update during enrollment.Preserve managed apps is available only on iPhone and iPad. It is not available on Apple TV, visionOS devices, or Mac computers. Iru recommends enabling app preservation on devices running iOS 27.2 or iPadOS 27.2 or later.For Enterprise API details, see the Erase Device endpoint in the Iru API documentation.

​
Apple Device Considerations

Supervision not required

Erase commands work on both supervised and unsupervised devices.

Immediate execution

Commands are sent through MDM and execute when the device is online.

Data recovery

All data is permanently deleted and cannot be recovered.

eSIM preservation

eSIM-based cellular plans are automatically preserved when you erase from the Iru Web App.

​
Erase Command Execution

Erase commands are delivered through the MDM framework.
  • Online devices: The command runs within minutes of being sent.
  • Offline devices: The command is queued until the device next connects to the internet.
Erasing a device permanently deletes all data and cannot be undone. Back up anything you need to keep before you proceed.

Erase a Windows Computer

Remotely wipe a Windows computer with Local, Cloud, or Protected erase

Erase an Android Device

Factory reset a managed Android device, including optional external storage and eSIM erase

Lock a Device

Remotely lock a managed device and optionally display a message on the lock screen

Enable Lost Mode

Activate Lost Mode on managed iOS and iPadOS devices to lock the device and track its location

Deleting a Device Record and Uninstalling Iru Endpoint

Delete device records and uninstall Iru Endpoint when preparing devices for reassignment or removal

Self Service for iOS, iPadOS, and visionOS

Configure Return to Service and other Self Service options for iOS, iPadOS, and visionOS

Configuring Apple Enrollment

Turn on Allow app preservation during Return to Service in the Automated Device Enrollment Library Item