Activation Lock stops anyone from using an Apple device after a factory reset unless they have the right Apple ID. On company-owned devices enrolled in device management, Factorial IT stores the bypass code for you, so you can unlock a wiped device without the employee's Apple ID.

Feature/Functionality

Overview

On a Mac, Activation Lock only exists on Apple silicon models and Intel models with the Apple T2 Security Chip. Older Intel Macs without a T2 chip are not affected (Apple Deployment Guide).

The two kinds of Activation Lock

Apple has two ways of switching Activation Lock on for a device your organisation owns (Apple Deployment Guide):

• Organisation-linked. The device must be in Apple Business or Apple School Manager. Device management talks to Apple directly to lock and unlock it, with a bypass code generated by the server. It does not depend on the employee, on Find My or on the device's state.
• User-linked. The employee ties the device to their personal Apple Account by turning on Find My. The escrow rules and scenarios below are about this kind.

If both are tried on the same device, whichever turns the feature on first wins.

Key terms

• Supervision. Apple describes it as the device being owned by the organisation, which gives extra control over its configuration and restrictions (Apple). Devices enrolled through Automated Device Enrollment (ADE), zero-touch deployment or Apple Business are supervised. On macOS 11 and later, Macs enrolled through account-driven or profile-based Device Enrollment are supervised too. Standard user enrolment does not give supervision.
• Activation Lock. Apple's protection that binds a device to an Apple ID after a wipe. It switches on when the employee turns on Find My.
• Bypass code. A code tied to the device that removes Activation Lock without the employee's Apple ID. It only exists if Factorial IT escrowed it.
• Escrow. Device management saves the bypass code at the moment Activation Lock switches on. It does not work backwards.

When a bypass code can be escrowed

Four conditions:

1. The device should be supervised. Escrow is only dependable on supervised devices.
2. Enrol the device before Activation Lock is on. If the employee turns on Find My before enrolment, Factorial IT cannot get the code.
3. The device must be company-owned. Personal (BYOD) devices are not eligible.
4. The MDM profile must install at system level. User-approved enrolment without Apple Business does not escrow codes reliably.

If the device is enrolled after the employee has already signed in with an Apple ID and turned on Find My, there is no bypass code. Only the employee's Apple ID can unlock it.

The three scenarios

Whether the code works depends on supervision and on the order in which management and Activation Lock were switched on. The same iCloud Lock field in the console can be right in one case and a false positive in another.

On macOS 11 and later, most enrolled Macs are supervised (scenario 1) even without zero-touch. Scenarios 2 and 3 cover devices that stay unsupervised, such as older macOS versions or plain user enrolment.

Scenario 1: supervised. Activation Lock is no obstacle. Device management sends an ActivationLockBypassCodeCommand straight to the device, whenever the employee turned on Find My. The code works.

Scenario 2: unsupervised, enrolled before Find My. You enrolled the device by hand, so it is not supervised, but management was already there when the employee turned on Find My. The code was escrowed at that point and you can use it.

Scenario 3: unsupervised, Find My before enrolment. Activation Lock was already on when the device enrolled, so no code could be escrowed. Any code the console shows is a false positive: typing it on the Activation Lock screen returns Your Apple Account or password is incorrect. Only the employee's Apple ID can unlock it.

Apple gives no way to check whether an escrowed code is a valid device code. On unsupervised devices, employees can also switch Find My off and on again without a new code being escrowed. Treat the iCloud Lock value on unsupervised devices as unconfirmed until you know how the device was enrolled.

How to use 

Check whether a bypass code exists

1. Go to Devices > All Devices.
2. Open the device.
3. Scroll to the Compliance section.
4. Look at iCloud Lock:
   • ✅ Enabled: a bypass code is escrowed and available.
   • ❌ Missing bypass code: no code was saved; you need the original Apple ID.

Enter the bypass code

macOS. Copy the code from the device record. Start the Mac and wait for the Activation Lock screen. In the menu bar, click Recovery Assistant, choose Activate with MDM key and enter the code (Apple Deployment Guide).

iPhone and iPad. Copy the code from the device record. During setup after the wipe, on the Activation Lock screen, leave the username empty and type the code into the password field (Apple Deployment Guide).

On both, the code is case-sensitive and works once per device.

On iPhone and iPad, the code generated by the device can only be fetched in the 15 days after the device is first supervised, or until an MDM fetches and clears it. If it was not escrowed in that window, it is lost for good.

Recover a Mac stuck on the Activate Mac screen

A Mac wiped with Activation Lock still on and no valid code (scenario 3) stays on the Activate Mac screen. Stop retrying the code: it will keep returning Your Apple Account or password is incorrect, because it was never escrowed.

Try these options in order.

Option 1: switch off Activation Lock in Apple Business. If the Mac was in Apple Business before Activation Lock came on, and has not been released from your organisation, a user with device management rights can turn Activation Lock off from Apple Business. This works for organisation-linked and user-linked locks, and the Mac does not need to be assigned to an MDM server (Apple Deployment Guide).

For an organisation-linked lock that device management cannot clear, there is one more fallback: on the Activation Lock screen, sign in with the Apple Business account that created the MDM server token linking Factorial IT to Apple Business.

Option 2: ask the former employee. If you can reach them, they can remove the lock themselves:

• by signing in with their Apple ID on the Activation Lock screen, or
• by removing the device from their account at icloud.com/find: select the device and choose Remove This Device (Apple Support). They can also do it from any other Apple device they own.

This is normally the quickest route, so try it before going to Apple.

Option 3: Apple Support with proof of ownership. If you cannot reach the former employee, Apple can remove the lock once your organisation proves it owns the device. Have these ready:

• the original purchase invoice in the company's name, with the serial number on it
• the serial number (on the Activation Lock screen or the chassis)
• company details and the identity of the person making the request

Send the request through Apple's Activation Lock support page, or through AppleCare for Business or Enterprise if you have it (Apple Support: How to remove Activation Lock). Checks usually take several days. Apple turns down requests with an incomplete invoice or no serial number.

Troubleshooting and FAQ

Troubleshooting

• The code returns "Your Apple Account or password is incorrect". The device is in scenario 3: the code shown is a false positive. Use the recovery options for a stuck Mac, or the employee's Apple ID.
• iCloud Lock shows Missing bypass code. No code was escrowed. You need the original Apple ID, or one of the recovery options.
• The code does not work on the second try. Codes are single-use per device and case-sensitive. Check the capitals.
• There is no Activation Lock on an older Mac. Intel Macs without a T2 chip do not support Activation Lock.

FAQ

1. Can I get a bypass code for a personal (BYOD) device?
   No. Only company-owned devices are eligible.
    
2. The employee turned on Find My before enrolment. Can I still get a code?
   Not on an unsupervised device. Escrow only happens when Activation Lock switches on while the device is already managed.
    
3. Where do I find the code?
   In Devices > All Devices, open the device and go to the Compliance section, field iCloud Lock.
    
4. How do I enter the code on an iPhone?
   On the Activation Lock screen, leave the username empty and type the code in the password field.
    
5. What do I need to ask Apple to remove the lock?
   The purchase invoice in the company's name with the serial number, the serial number itself, company details and the requester's identity.