Skip to main content

Glossary

Activation Lock

Activation Lock is the Apple anti-theft feature that ties an iPhone, iPad or Mac to an Apple Account when Find My is enabled. After a wipe, the device refuses to activate until that account's password is entered. On a supervised corporate device, the MDM can clear it with a bypass code.

How it works

Apple added Activation Lock with iOS 7 in 2013 to make stolen iPhones worthless. When a user turns on Find My, the device serial is registered on Apple's activation servers with the user's Apple Account. Wiping the device doesn't help a thief: at the next Setup Assistant, Apple checks the serial and demands the original credentials.

For a personal phone that's the desired behavior. For a company phone it becomes a trap. An employee signs in with a personal Apple Account, enables Find My, leaves the company, and the returned iPhone is a brick unless that former employee cooperates.

Apple built two answers into MDM. On a supervised device, the MDM can retrieve a bypass code at enrollment time and store it. Entering that code at activation unlocks the device without the user's account. And a device in Apple Business Manager can have Activation Lock turned off directly from the portal, whatever account enabled it. Since iOS 13 there's also a device-based Activation Lock that the MDM itself can enable, tied to the organization rather than to a person.

Why it matters for a fleet

Every fleet manager has a drawer of locked devices. Industry estimates put it around 5 to 10 percent of returned units in companies with no MDM policy on the subject, and each one costs a support ticket plus a device that can't be redeployed.

The policy choice is between blocking user Activation Lock entirely on supervised devices (a restriction available since iOS 7.1) and allowing it but capturing the bypass code. Blocking is simpler for shared devices. Allowing it keeps the anti-theft benefit for field workers whose phone might get stolen.

Either way, supervision is the prerequisite. An unsupervised device offers no bypass code.

How Appaloosa handles it

Appaloosa stores the bypass code for every supervised iPhone and iPad it enrolls, and shows it in the device record when you need to reactivate a returned unit. You can also enable the device-based lock from the console so that a wiped corporate device stays tied to the company. Combined with remote wipe and the Apple Business Manager link described on the iOS and iPadOS MDM page, this closes the locked-device drawer for good.

Explore

See the full platform

Enrollment, apps, security, remote support: all in one place.

Explore Appaloosa →

See Appaloosa run on your fleet Book a demo

Frequently asked questions

How do I remove Activation Lock from a former employee's iPhone?
If the device is supervised and enrolled in your MDM, use the bypass code stored at enrollment. If it is in Apple Business Manager, disable the lock from the portal. Without either, only the original Apple Account password or Apple support with proof of purchase can unlock it.
Can the MDM prevent users from enabling Activation Lock?
Yes, on supervised devices. A restriction blocks the user from turning on Find My in a way that engages Activation Lock. Many companies apply it to shared and kiosk devices, and keep it off for personal-use corporate phones where the anti-theft protection is useful.
Does a remote wipe remove Activation Lock?
No. The wipe erases data but the lock lives on Apple's servers, keyed to the serial number. After the wipe the device asks for the Apple Account credentials or the MDM bypass code. Plan your bypass code retrieval before wiping, not after.