Back up and restore a managed iPhone or iPad
Overview
Migrating users and their data to a new iPhone or iPad is a common task in organizations.
This migration often involves considerations about your organization’s device management service, typically linked to Apple School Manager or Apple Business. You can use specific workflows to migrate data from user- or organization-owned devices.
Requirements and expected behavior
Consider your organization’s deployment model when planning how to back up and restore devices. Device ownership, management, enrollment type, and backup restrictions can each affect how fully a device backs up and restores.
Managed Apple Accounts and unmanaged (personal) Apple Accounts also affect this task. Users may be using their unmanaged Apple Account, your organization’s Managed Apple Account, or, in the case of account-driven User Enrollment and account-driven Device Enrollment, possibly both.
An iCloud backup created with a Managed Apple Account may contain different data from an iCloud backup created with an unmanaged Apple Account.
Your organization may restrict iPhone and iPad backups to a Mac, using either the Finder or Apple Configurator for Mac.
Note: For the highest level of security, have users back up organization-owned devices to a Mac.
Restoring a device with iOS 27 and iPadOS 27 or later doesn’t restore its device management information. The enrollment profile, management configuration, and supervision status aren’t carried over.
A device that appears in Apple School Manager or Apple Business enrolls again automatically through Automated Device Enrollment after the restore finishes, and receives its current management state rather than the configuration stored in the backup.
On a device with iOS 26 and iPadOS 26 or earlier, restoring a backup to the same device restores the management configuration and the enrollment profile. The device then checks in with the device management service, and the service can accept or refuse the connection.
A restore to a different device proceeds as though the backup carried no management information.
The do_not_use_profile_from_backup key has no effect on a device with iOS 27 and iPadOS 27 or later. On earlier versions it causes a device to ignore the enrollment profile in the backup and contact Apple School Manager or Apple Business instead.
If a managed app isn’t marked for removal when a device unenrolls, its data is restored. The app itself isn’t part of the backup, so the data is available once a device management service installs the app again.
Declarations are never restored. A device receives the declarations assigned to it from the device management service and applies them when their conditions are met.
After any restore, whether or not the backup was encrypted, the user creates a passcode and can then set up Face ID or Touch ID.
For backup and restore workflows, see Back up managed Apple devices and Restore managed Apple devices in Apple Platform Deployment.
Reported behavior
A user or administrator may report the following after restoring an iPhone or iPad from a backup.
The device is no longer managed, or its configuration profiles are missing.
A device intended to be repurposed is instead supervised and managed.
Apps the device management service installed didn’t come back after the restore, although other apps did.
The device never checks in with the device management service and stays unmanaged.
A backup made with a Managed Apple Account didn’t restore the device fully.
Supervision is gone, and features that depend on it no longer work.
Isolating the issue
Establish the operating system version first, because the expected behavior differs by version. On a device with iOS 27 and iPadOS 27 or later, a restore doesn’t bring back the management configuration or the enrollment profile.
On a device with iOS 26 and iPadOS 26 or earlier, a restore brings both back, so a device that finishes setup unmanaged indicates a fault.
A device that appears in Apple School Manager or Apple Business reenrolls through Automated Device Enrollment after the restore. A device that doesn’t appear there stays unmanaged until someone enrolls it. That difference accounts for most of these reports.
On a device with iOS 26 and iPadOS 26 or earlier, a restore to the same device brings back the management configuration and the enrollment profile, then depends on the service accepting the check-in.
The service can refuse it, and the operating system then removes the enrollment profile, its configurations, and any apps marked for removal on unenrollment.
An expired or invalidated device identity certificate produces the same result, so a device that came back managed and then lost management is a signal to check the certificate rather than the backup.
A profile containing a hardware-bound key issued through the Automated Certificate Management Environment (ACME) protocol can’t be restored. When a device management service authenticates devices with that kind of identity, the enrollment can’t come back from a backup, regardless of version.
Missing apps and missing configuration are different signals. A managed app is never in a backup, so its absence after a restore is expected, and its data becomes available once the service installs the app again.
A missing configuration more likely means the device hasn’t synced yet, since declarations are never restored and arrive from the service instead.
A backup taken with a Managed Apple Account holds only managed app data, so it can’t fully restore a device on its own.
Troubleshooting
If a restored device doesn’t enroll:
Confirm the device appears in Apple School Manager or Apple Business. A device that doesn’t appear there can’t enroll using Automated Device Enrollment.
Confirm the device is assigned to the organization’s device management service.
Confirm the device can access the internet after the restore finishes so it can enroll.
Confirm the device management service accepted the check-in. On a device with iOS 26 and iPadOS 26 or earlier, a service can refuse a restored device, and the operating system then removes the enrollment profile and its configurations.
Erase the device and let it enroll during Setup Assistant. Use this when the enrollment isn’t restored from the backup, including when the service authenticates devices with a hardware-bound key.
If apps the device management service installed aren’t reinstalled:
Confirm the device is enrolled and has checked in with the device management service.
Have the device management service install the managed apps again. A managed app isn’t part of a backup, so it doesn’t return on its own. The restored data is available once the app is installed.
Managed environments
Three restrictions apply to backups:
iCloud Backup: Turns off iCloud Backup on supervised devices.
Force encrypted backups: Forces backups made with the Finder or Apple Configurator to be encrypted.
Backup proprietary in-house books: Keeps books the organization distributes out of a backup.
A device management service can also include or exclude each managed app’s data.
Not every organization uses these restrictions, so confirm with the device management service administrator which ones are in place before treating a restriction as the cause or changing settings on a device.
With profile-based Device Enrollment and Automated Device Enrollment, the device management service can require that managed apps be removed when a device unenrolls. With account-driven enrollments, the service always removes them.