Bypass Activation Lock on Apple devices with Microsoft Intune

Platforms

iOSiPadOSmacOS

Products

IntuneApple Business

Result

A wiped device with Activation Lock is unlocked with the bypass code and enrolls for the next user

Overview

Allow Activation Lock on supervised iPhones, iPads and Macs, and clear it with the bypass code that Microsoft Intune stores, so returned devices can be reused.

Activation Lock is part of Find My on iPhone, iPad and Mac. When a user turns on Find My, the device is linked to their Apple Account on Apple's activation servers. After that, nobody can turn off Find My, erase the device or activate it again without that Apple Account password, which makes a lost or stolen device useless to anyone else.

For organizations this creates a common problem: an employee turns on Activation Lock with a personal Apple Account, leaves the company and hands the device back. Without their password, IT can't reuse the device. Managed Apple Accounts (formerly Managed Apple IDs) have Find My turned off, so the problem comes from personal accounts.

Microsoft Intune solves this for supervised devices. Apple generates a device-specific Activation Lock bypass code, Intune stores it, and you can use it to clear Activation Lock when the device is wiped and handed to the next user. Users keep the security of Find My, and IT keeps control of the device lifecycle.

Prerequisites

Before you start, check that you have the following.

Configuration

Allow Activation Lock by policy first; the bypass code is only available after that.

Allow Activation Lock on supervised devices

Intune only gets a bypass code when Activation Lock is allowed by policy. Today Microsoft documents this in the settings catalog: in the Intune admin center (intune.microsoft.com) go to Devices > Manage devices > Configuration > Create > New policy, choose iOS/iPadOS (or macOS) and Settings catalog, and set Managed Setting > MDM Options > Activation Lock Allowed While Supervised to Allowed. Assign the policy to the device group.

In 2021 I used a Device restrictions template profile, which still works for iOS/iPadOS:

In the profile, set Allow activation lock to Yes:

Disable Activation Lock for a device

When a device comes back, open it under Devices > All devices and select Secure > Disable Activation Lock (in 2021 it was a button in the top bar). Confirm with Yes, and Intune requests the bypass code from Apple:

Copy the code from the device's Hardware page, under Conditional access > Activation lock bypass code, before you wipe the device. A wipe removes the code from Intune. Then run Wipe.

Note: the code is valid for 15 days, so copy it shortly before the wipe (see Troubleshooting device actions). It isn't case sensitive and the dashes are optional. If Find My is opened again after the action, Activation Lock turns back on.

User Experience

After the wipe, the device connects to the network and starts activation. The Activation Lock screen asks for the Apple Account and password of the previous user:

Leave the Apple ID field empty, enter the bypass code from Intune in the Password field and tap Next:

On a Mac, choose Recovery Assistant > Activate with MDM key in the menu bar and enter the code there.

If the code is accepted, the Remote Management screen appears and enrollment continues as normal, so the next user can sign in:

You can also turn off Activation Lock for an organization-owned device directly in Apple Business (see Turn off Activation Lock).