Lost mode

How it works

On Apple hardware, MDM lost mode has existed since iOS 9.3 and requires a supervised device, so in practice one enrolled through Automated Device Enrollment. The server sends EnableLostMode with three strings: a message, a phone number and a footnote. The device locks immediately, shows that text, and refuses to unlock even with the correct passcode. The user cannot turn it off. The admin can then send a location request, and from iOS 10.3 onward make the device play a sound until it is found or the mode is cleared. Only the MDM can release it.

The location part deserves a note: the MDM only gets a position when it asks, and the device has to be powered on with network access. This is not continuous tracking, and that limitation is a feature rather than a gap when your works council asks questions.

Android got a true equivalent more recently. The Android Management API supports lost mode on company-owned fully managed devices running Android 11 and later, with a lost message, phone number, email and street address, plus location reporting. Before that, fleets improvised with a remote lock, a kiosk app showing a return notice, or Samsung Knox Guard, which can lock and display a message on Galaxy devices even after a factory reset. Remote wipe remains the last resort when the data matters more than the hardware.

Then there is Activation Lock. An iPhone wiped while tied to a personal Apple Account can be unusable for the next employee. Devices in Apple Business Manager give you an Activation Lock bypass code, which is the reason to enroll hardware through ABM rather than buying it retail.

Why it matters for a fleet

Most lost devices are not stolen, they are left in a taxi or on a train. A lock screen reading "Property of Acme, call +33 1 23 45 67 89" recovers a meaningful share of them, and the honest finder does not have to guess who to contact.

For the ones that do not come back, the sequence matters more than the tooling: lock first, locate, then wipe once you have accepted the device is gone. Wiping immediately feels decisive and destroys your chance of getting the hardware back.

How Appaloosa handles it

Appaloosa runs these device actions from the console on enrolled iOS, iPadOS and Android fleets: lock, locate on demand, selective wipe of work data, and full remote wipe. Supervised Apple devices enrolled through Apple Business Manager get the full lost mode behavior. Everything sits alongside the compliance policies and app distribution described on the mobile device management page.