Protect a device with Activation Lock
Overview
Activation Lock makes it difficult for anyone but the owner to use, erase, or reactivate a lost or stolen iPhone, iPad, or Mac. It links device activation to an Apple Account or, for an organization-owned device, to the organization, and reactivation requires the correct credentials even after a remote erase.
Requirements and expected behavior
On an unsupervised iPhone, iPad, or Mac, Activation Lock turns on automatically when a user signs in to an unmanaged (personal) Apple Account and turns on Find My. Apple stores the Apple Account on its activation servers and links it to the device.
With Activation Lock on, turning off Find My or erasing the device requires the unmanaged Apple Account password. On iPhone or iPad, reactivating the device also accepts the previously used device passcode.
Reported behavior
After a restore or erase, an iPhone or iPad protected by Activation Lock displays an “iPhone Locked to Owner” or “iPad Locked to Owner” screen when the device is turned on or wakes. Setup Assistant can’t continue past the activation step without the unmanaged Apple Account credentials.
A Mac starts up to the Activation Lock screen, which displays “This Mac is linked to an Apple Account. Sign in to the account that was previously used with this Mac.” If the user turned on Find My with an unmanaged Apple Account, the screen shows a partially masked email address from that account to indicate which credentials to enter.
Users may report a device they can’t set up after erasing or resetting it, or a device that asks for an Apple Account they don’t recognize.
Isolating the issue
To turn off Activation Lock, first determine how the device is owned. A device that appears in Apple School Manager or Apple Business is organization-owned.
On a user-owned device, Activation Lock links the device to the user’s unmanaged Apple Account. On an organization-owned device, Activation Lock is either organization-linked (tied to the organization) or user-linked (the user locked the device to their own unmanaged Apple Account). Consult the organization’s device management service administrator to confirm which method applies.
Troubleshooting
If the device is user-owned, have the user enter the unmanaged Apple Account password used to turn on Find My. If they’ve forgotten it, guide them to Apple Account recovery at iforgot.apple.com. If they can’t recover the account, have them contact Apple Support with proof of purchase.
If an organization-owned device uses organization-linked Activation Lock, turn it off in Apple School Manager or Apple Business, or use the device management service to remove it.
If an organization-owned device uses user-linked Activation Lock, have the user enter their unmanaged Apple Account credentials, turn it off in Apple School Manager or Apple Business, or enter the device management service’s stored bypass code on the device.
If the device management service can’t clear Activation Lock, confirm that it retrieved and stored the bypass codes. For devices that support dual SIMs, the device management service needs to include both International Mobile Equipment Identity (IMEI) values in its request to clear Activation Lock. If the bypass codes are missing or invalid, on the Activation Lock screen, enter the user name and password of the account that created the device management service token in Apple School Manager or Apple Business. If it still fails, escalate to the device management service developer.
If you can’t clear Activation Lock on an organization-owned Mac and you have physical access, at the Activation Lock screen click Recovery Assistant in the menu bar, choose “Activate with MDM key,” then enter the stored bypass code.
On an organization-owned iPhone or iPad, enter the device management service’s stored bypass code in the Apple Account password field on the Activation Lock screen, and leave the user name blank.
Managed environments
If an organization uses a device management service that supports Activation Lock, the service can manage Activation Lock for the devices the organization owns.
A device management service handles the two types of Activation Lock differently:
Organization-linked: The device management service contacts Apple servers to lock or unlock the device entirely server-side, with no dependency on the user or the device’s state, and creates its own bypass code. It requires Apple School Manager or Apple Business and is generally simpler to manage.
User-linked: The service lets the user lock an organization-owned device to their unmanaged Apple Account after turning on Find My. Because supervised devices disallow Activation Lock by default, the service fetches and stores a device-generated bypass code before the user can turn it on.
Note: Some device management services support both methods. When a service attempts both, the first successful Activation Lock event takes precedence.
Clearing Activation Lock depends on bypass codes, so the device management service administrator should secure them and back them up regularly. The device management service stores two codes, one for each way Activation Lock can be turned on: a device-generated code for user-linked Activation Lock, which the device creates and the service must retrieve from it, and a server-created code for organization-linked Activation Lock, which the service generates itself. Because only the device-generated code has to be retrieved from the device, on iPhone and iPad it’s available for only 15 days after the device is first supervised, or until the service retrieves and clears it. After that, the service can’t recover it. When changing to a different device management service, get a copy of the existing bypass codes, or have the previous service clear Activation Lock for all enrolled devices first.
A user whose role in Apple School Manager or Apple Business has permission to turn off Activation Lock can do so for an organization-owned iPhone, iPad, or Mac. This doesn’t require a bypass code, and the device doesn’t need to be enrolled in a device management service. It works only if the organization added the device to Apple School Manager or Apple Business before Activation Lock was turned on and hasn’t released it.
On a Mac, if Activation Lock was already turned on before the Mac became supervised, the device management service can’t turn it off, and macOS can’t disallow it until the user turns it off.