Activation Lock

​

What is Activation Lock?

Activation Lock is a security feature developed by Apple to help prevent unauthorized use of Apple devices if they are lost or stolen. This feature is part of the “Find My” service and is designed to deter theft by making it difficult for anyone other than the owner to use or sell the device.

​

How Activation Lock Works

Activation Lock is automatically enabled when a user sets up the “Find My” feature on their device. Here’s how it functions: For corporate-owned devices, Iru Endpoint can be used to manage Activation Lock. Upon enrollment, a bypass code can be generated to unlock devices without the Apple Account and password, which is useful when reassigning devices to new users. In addition, for devices listed in Apple Business or Apple School Manager, Activation Lock can be disabled remotely by administrators with the Device Manager role in that portal.

​

User-based Activation Lock

User-based Activation Lock is activated when a device user signs in with their personal Apple Account and enables Find My Device. This feature is also known as iCloud Activation Lock.

​

How to Prevent User-based Activation Lock

By default, user-based Activation Lock is not allowed on supervised devices. When iOS, iPadOS, visionOS or macOS devices are enrolled into Iru Endpoint via Automated Device Enrollment, the Activation Lock Allowed While Supervised MDM option is set to false. However, you can modify the Automated Device Enrollment configuration before enrolling the device if you wish to allow user-based Activation Lock.

​

Special Considerations for Mac Computers

For Mac computers that are already set up and enrolled in Iru Endpoint, there are a few things to consider:

• Pre-enrollment Activation Lock: If a user enabled user-based Activation Lock before enrollment, it will remain enabled.
• Bypass Code Generation: If the Mac was not previously supervised by an MDM, Iru Endpoint will generate and retrieve a bypass code. However, this code cannot retroactively disable an existing user-based Activation Lock. For the bypass code to be effective, the user must turn off Find My Mac and then turn it back on.
• Migration from Another MDM: If a Mac is migrating from one MDM to Iru Endpoint, the existing Activation Lock bypass code may have expired, and Iru Endpoint will not be able to retrieve it. Bypass codes can only be retrieved within 30 days after the device is supervised. Therefore, it is recommended to retrieve these codes from the previous MDM before migration.

​

User-based Activation Lock Bypass Code

If you allow user-based Activation Lock and need to clear it (for example, when reassigning a device), first retrieve the bypass code from the device record in Iru Endpoint. Then enter that code on the device. The place you enter it depends on the platform: Setup Assistant on iPhone, iPad, and Apple Vision Pro; Finder on iPhone and iPad; or macOS Recovery on Mac. Bypass codes are available for supervised iOS, iPadOS, visionOS, and macOS devices (Mac computers with T2 or Apple silicon). Activation Lock status fields also appear on the device record Details tab. See Device Record Details. Viewing bypass codes requires a role that can read Activation Lock secrets (for example, Secrets Auditor). See Team Member Role Permissions.

Retrieve the bypass code

Setup Assistant

On iPhone, iPad, or Apple Vision Pro, when the Activation Lock screen appears during Setup Assistant (for example, after an erase), leave the Apple Account field blank and enter the user-based bypass code in the password field.

Finder

On iPhone or iPad, connect the device to a Mac with a cable. In Finder, when you are prompted for Activation Lock credentials, leave the Apple Account field blank and enter the user-based bypass code in the password field.

macOS Recovery

On a Mac at the Activation Lock screen, open Recovery Assistant in the menu bar and select Activate with MDM Key…. Enter the user-based bypass code when prompted.

​

Device-based Activation Lock

Device-based Activation Lock is enabled by an MDM solution submitting an API request to Apple’s Device Assignment Service API. This feature is sometimes referred to as MDM or organization-based Activation Lock and is currently supported only on iOS, iPadOS, and visionOS devices.

​

How to Enable Device-based Activation Lock

To enable device-based Activation Lock, you need to modify the Automated Device Enrollment configuration before enrolling the device. Ensure you enable this setting separately for the iPhone, iPad and Vision sections within the Automated Device Enrollment configuration.

​

Device-based Activation Lock Bypass Code

If you enable device-based Activation Lock and need to clear it, retrieve the device-based bypass code from the device record using the same Device Action Menu path described in Retrieve the bypass code, then enter that code on the device with the Setup Assistant or Finder methods above. You can also clear Activation Lock by signing in with the Managed Apple Account of the Apple Business or Apple School Manager user who created the Automated Device Enrollment token. To turn Activation Lock off from those portals instead, see Removing Activation Lock using Apple Business or Apple School Manager.

​

Removing Activation Lock using Apple Business or Apple School Manager

In Apple Business or Apple School Manager, you can disable Activation Lock for devices owned by your organization. The device must be listed in the same portal; it does not need to be associated with an MDM server. For step-by-step instructions, see the following Apple Support articles:

• Turn off Activation Lock in Apple Business
• Turn off Activation Lock in Apple School Manager

If the Activation Lock bypass code is unavailable and Activation Lock cannot be removed using Apple Business or Apple School Manager, you can contact AppleCare Enterprise Support for further assistance.

​

Related Articles