I'm going to try to address many historical and current questions on this topic below...
If a device is in a company's ABM/ASM (DEP) account that means it was purchased and assigned to an institutional (company) account at Apple. If you have a device that is popping up a message like this, then it was a registered as an institutional purchase.
Apple will not remove a device from a companies account as they do not know if it was stolen. This is the responsibility of the original owner of the device. This is just like Activation Lock or signing into iCloud on an iPhone (to prevent its use if it's been stolen).
So the first thought is a device was stolen if you are getting this pop up. If it's not, you should contact the company that sold it. (Maybe it was an oversight as one person mentioned.) Companies that have ABM/ASM accounts are Legally Obligated to release device from their ABM/ASM accounts that they no longer own, per the terms and conditions of the program. I do know my own organization fails to properly address devices like this and I strive to educate our techs on this, but unfortunately, most do not understand the impact or even the stress of using Automated Device Enrollment (DEP) in the first place. Also, just because a device is new in box, does not mean the device is not stolen.
For the suggestion to pay for a service to re-program the Serial Number, this is an illegal service not condoned or supported by Apple. (If the device was under warranty, it would likely be voided.) The suppliers of this type of service are supporting the theft of devices, whether directly or indirectly, as that is the only reason to re-program a serial number. When another serial number is programmed in, you now have the serial number of another device some where in the word, which could cause issues in and of itself. Going forward with new hardware release (as announced at WWDC 2020) this type of service (re-programming serial numbers) will be much harder as the serial number will be completely unique and no longer be able to identify the device. So you won't be able to simply change a single value and it be valid.
Yes, there are ways to "remove" the notification from a Mac itself, but those are likely temporary. The next time the Mac connects to Apple's activation servers, it will pop up again. You can never remove it from ABM/ASM, only the institution can do that.
Yes, you can not connect to the internet during the setup of the device, but again, this is likely only temporary. The device will eventually check-in with Apple's activation server, and the message will pop up.
If you cannot find enough suitable information after reviewing the MDM Profile that the notification wants to install, you can run the command, which should give information on the organization that the device is registered too:
sudo profiles show -type enrollment
For the comments that mention that the device was removed (released) from the ABM/ASM (DEP) account, but the device is popping up the notification, this is normal/expect at this time. When the device checks in to Apple's activation servers, it downloads its activation record and saves it to disk (see above command -- this is the same content save to disk). The device doesn't check-in again to see if the record is "gone" -- that's not an expected scenario that Apple would bother programming for. You have two options: wipe and reinstall (strong and dumb approach) or delete the files that store this information. The files are stored in a SIP protected directory in modern versions of macOS, but you can reboot into the Recovery Volume and delete the files. This command will work from recovery to delete the related files:
rm /Volumes/Macintosh HD/var/db/ConfigurationProfiles/Settings/.cloudConfig*
For those that have legit purchases... Seeing this message/notification does not mean the device is enrolled and no, the organization cannot access your files/device. But if it has been enrolled, then yes, they can take over, view, and lock your device as well as apply configurations, restrictions, requirements, etc.
For the instructions above about removing profiles, etc. That is not possible once the MDM Profile is installed if the organizations required the MDM Profile to be installed (in other words, configured the Profile to not allow un-enrollment), which is a requirement (no longer an option to configure) going forward with macOS Catalina 10.15 and newer.
Finally, @aalamerican, we've seen similar scenarios with our primary vendor or even phone carrier stores. Staff will say they're an employee with our organization to receive a discount and the vendor will incorrectly add the device to our company's ABM/ASM account. Then the device will attempt to enroll. You should be able to go back to that store, explain the situation, provide your paid receipt, and they should be able to remove it. (Besides the "purchasing institution" only the originally selling vendor can/will remove a device from ADE/DEP.) My recommendation, if what you're telling the normal Joe/Jane you speak with in the store is flying over their head, ask to speak with someone from the business team in the store. The business team should understand ADE/DEP to some degree and at least be able to discuss the topic (where a normal employee likely only ever deals with consumer sales which this will never touch).
Hope this information helps someone.
