The iPhone came back from the employee who left. It is locked to their Apple Account and nobody can use it.
Activation Lock makes a device difficult for anybody else to use or sell. That protection works exactly as well against your own IT team when a device is reclaimed and the previous owner account is still on it.
- Two typesOrganisation linked and user linked
- Two codesBypass codes a management service must keep
- Before, not afterAdd the device before enabling the lock
- IrreversibleTurning it off cannot be undone
Nobody plans for Activation Lock. Everybody eventually meets it.
The pattern is consistent enough that we can usually predict the conversation before it happens.
- A device comes back from somebody who has left, or is found after being lost, or is being reissued to a new starter. It is locked to an Apple Account that is not yours, and the person who could unlock it is no longer contactable.
- At that point the available options are set by decisions taken months earlier: whether the device was added to Apple Business and never released, whether bypass codes were retained, and whether the account on it was managed or personal.
- If those decisions went the right way, clearing the lock is a short task. If they did not, the honest answer is sometimes that the hardware is not recoverable, which is an expensive sentence to have to say about a recent purchase.
- The preventative work costs almost nothing. Registering devices at procurement, not releasing them, retaining bypass codes and putting Managed Apple Accounts on corporate hardware removes essentially the whole problem before it can arise.
Eight things to establish before a device comes back locked.
It is designed to defeat reuse
Apple describes it plainly: when a user turns on Activation Lock, it is difficult for someone else to use or sell an iPhone, iPad, Mac or Apple Watch if it is ever lost or stolen. The protection does not distinguish between a thief and your own IT team.
Organisation linked is the manageable version
Organisation linked Activation Lock requires Apple School Manager or Apple Business and is generally simpler to manage for organisations. That single sentence is the argument for registering hardware and managing the lock deliberately rather than leaving it to users.
User linked depends on a personal account
User linked Activation Lock requires the user to have a personal Apple Account, not a Managed Apple Account, and for them to turn on Find My. That is the version that arrives unannounced on corporate hardware and creates the reclamation problem.
Two bypass codes, both of which matter
A device management service must maintain the device generated bypass code and the bypass code the server creates when initiating Activation Lock. Apple states these are crucial to your ability to clear Activation Lock, which makes their custody an operational obligation.
The code clears the lock remotely or locally
You can use the bypass code to turn off Activation Lock remotely with a device management service, or directly on the device. Having the code is what turns a bricked reclaimed device into a five minute task rather than an escalation.
The ordering requirement is absolute
You need to add the device to Apple School Manager or Apple Business before enabling Activation Lock. Doing it the other way round removes the organisational route to clearing it, and no amount of subsequent registration recovers that position.
Mac has a hardware requirement
Mac computers require Apple silicon or the Apple T2 Security Chip to be eligible to use Activation Lock. Older Intel Macs without T2 are outside the feature entirely, which is worth knowing when auditing what is and is not protected across a mixed estate.
Turning it off cannot be undone
The Apple Business flow requires you to confirm that you understand this cannot be undone before it will proceed. That is a deliberate design choice, and it means the decision to clear a lock is a considered one rather than a routine click.
Four conditions, and if all four are true the device is very hard to recover.
Every locked reclaimed device we see is the same story told slightly differently.
- The device was never added to Apple Business, or was added but then released. The published prerequisite is that you add the device and do not release it before enabling Activation Lock, and without that the organisational route to clearing the lock is not available.
- The user signed in with a personal Apple Account rather than a Managed Apple Account, and turned on Find My. That is exactly the condition user linked Activation Lock requires, and it happens by default when nobody has designed the account model.
- No device management service was holding bypass codes. Apple states the two codes are crucial to your ability to clear Activation Lock, so an estate where nobody knows whether those codes exist has no reliable clearing path at all.
- The person has left, is uncontactable, or declines to help. Where Activation Lock was already turned on you cannot turn it off in Apple Business unless the user first turns it off, so the last resort depends on the cooperation of somebody who no longer works for you.
Four things that keep hardware recoverable.
We get devices registered before the lock exists
Apple states you need to add the device to Apple School Manager or Apple Business before enabling Activation Lock. Building that into procurement means the organisational clearing route is always available, and it costs nothing at the point of purchase.
We treat bypass codes as controlled credentials
The device generated code and the code the server creates when initiating Activation Lock are both crucial to clearing it. Codes that exist but nobody can find are functionally the same as codes that were never retained.
We put Managed Apple Accounts on corporate hardware
User linked Activation Lock requires a personal Apple Account rather than a Managed Apple Account. Getting the account model right at deployment removes the mechanism by which a personal lock ends up on hardware the business owns.
We test clearing before it is urgent
Clearing Activation Lock in Apple Business requires confirming that the action cannot be undone. Rehearsing it once on a test device, calmly, is a much better way to learn the flow than discovering it on the day a director laptop comes back locked.
Three phases across roughly two to four weeks.
- 01Week 1
Establish the current position
Which devices are in Apple Business and have not been released, which are locked and by which type of lock, whether any bypass codes are held, and which Macs are even eligible given the Apple silicon or T2 requirement.
- Device inventory reconciled against Apple Business
- Released devices identified as an exposure
- Bypass code custody established or confirmed absent
- Currently locked devices listed with lock type
- 02Week 2
Fix the ordering and the account model
Devices added to Apple Business before Activation Lock is enabled, and an account model that puts Managed Apple Accounts rather than personal ones on corporate hardware. Those two changes remove most of the future exposure.
- Registration process corrected at procurement
- Managed Apple Account model applied to corporate devices
- Release process reviewed so devices are not released in error
- Bypass code retention configured in the management service
- 03Weeks 3 to 4
Build the reclamation runbook
A documented sequence for a returning device covering how the lock state is checked, how a bypass code is used remotely or on the device, and what the escalation is where a user linked lock exists and the person has already gone.
- Leaver process including Activation Lock check
- Reclamation runbook with the bypass code path
- Escalation route for user linked locks
- Currently stuck devices worked through individually
Six situations that turn into stuck hardware.
An employee leaves and returns their iPhone
The most common case by far. If the person signed in with a personal Apple Account and enabled Find My, the device carries a user linked lock, and clearing it depends on either a retained bypass code or the cooperation of somebody who has already gone.
A firm reissuing devices between staff
Devices that circulate between people need a reliable reclamation path, otherwise each handover risks a device that cannot be reissued. A registered device with retained bypass codes turns that from a risk into a routine step.
A retail estate refreshing hardware
Trade in and resale value depends on the device being usable by the next owner. A locked device has effectively no resale value, so the registration and code retention discipline directly protects the residual value of the estate.
A school reclaiming devices at year end
Large numbers of devices returning at once, many of them signed into personal accounts. Organisation linked Activation Lock through Apple School Manager is described by Apple as generally simpler for organisations to manage, and at this scale that difference is decisive.
An organisation with Apple Vision Pro
Apple Vision Pro is covered by the Apple Business turn off flow alongside iPhone, iPad and Mac. Given the value of the hardware, the registration and clearing position is worth confirming before the device goes to a user rather than after.
A mixed Mac estate with older hardware
Mac computers require Apple silicon or the Apple T2 Security Chip to be eligible for Activation Lock. An audit of which Macs are eligible tells you which parts of the estate carry this exposure and which do not, which shapes where the effort goes.
How UAE organisations end up when a device comes back.
| Feature | Registered with codes retained | Registered but no codes held | Unregistered, personal accounts |
|---|---|---|---|
Device in Apple Business | Yes | Yes | No |
Bypass codes retained | Both codes | None | None |
Clear remotely through management | Yes | No | No |
Clear through Apple Business | Yes | Usually | No |
Depends on the leaver cooperating | No | Sometimes | Yes |
Time to reissue a returned device | Minutes | Hours to days | Often never |
Resale or trade in value preserved | Yes | Usually | No |
Auditable position on device ownership | Yes | Partial | No |
Effort to reach this position | Small, at procurement | Small | None |
Cost when it goes wrong | None | Support time | Hardware written off |
Organisation linked against user linked.
| Property | Organisation linked | User linked | |
|---|---|---|---|
| Requires Apple School Manager or Apple Business | Yes | No | |
| Requires a personal Apple Account | No | Yes, not a Managed Apple Account | |
| Requires the user to turn on Find My | No | Yes | |
| Simpler for organisations to manage | Yes, per Apple | No | |
| Cleared with a bypass code | Yes | Yes, if the code was retained | |
| Depends on the individual cooperating | No | Often | |
| Device must be added before enabling | Yes | Yes for the Apple Business route | |
| Suitable for corporate hardware | Yes | No, it arrives by accident |
Five steps, and the first two prevent the problem entirely.
- 1
Audit registration and release state
Which devices are in Apple Business or Apple School Manager, which have been released, and which are eligible at all. The prerequisite is that the device is added and not released before Activation Lock is enabled, so this audit defines your available options.
- 2
Establish bypass code custody
Whether the management service retains the device generated bypass code and the code the server creates when initiating Activation Lock, where those codes live, and who is authorised to use them. Apple describes both as crucial to clearing the lock.
- 3
Correct the account model
User linked Activation Lock requires a personal Apple Account and Find My turned on. Moving corporate devices to Managed Apple Accounts removes the mechanism that puts a personal lock on business hardware in the first place.
- 4
Build the reclamation runbook
A leaver process that checks lock state before the person goes, a documented path for using a bypass code remotely or on the device, and an escalation for the case where the lock is user linked and the individual is already uncontactable.
- 5
Work through the devices already stuck
Case by case, since the options depend on registration state, lock type and whether codes exist. Some are a few minutes of work through Apple Business and some genuinely require the previous user, and we tell you which is which honestly.
What organisations ask about Activation Lock.
Twelve questions that tell you whether you are exposed.
Registration
- Are all corporate devices in Apple Business?The prerequisite for clearing.
- Has any device been released?That removes the route.
- Are devices added at procurement?Before the lock, not after.
- Which Macs are eligible?Apple silicon or T2 only.
Bypass codes
- Does the management service retain both codes?Device and server generated.
- Do we know where they are stored?Custody is the point.
- Have we tested clearing a lock?Before you need to.
- Who is authorised to use them?The action is irreversible.
People and process
- Do users sign in with personal accounts?That creates user linked locks.
- Does the leaver process check the lock?Before the person goes.
- Do we have stuck devices already?Deal with them separately.
- Is there an escalation path?For uncontactable leavers.
Ask whoever runs your device management whether bypass codes are retained.
And where they are kept. If nobody can answer that question, you already know your position on the next device that comes back locked.
Related Services
Explore more solutions that work great with this service
Apple Vision Pro management
Enrolment, payloads and reclamation for visionOS hardware.
Managed Apple Accounts
Org owned Apple identity, federation and the published service exclusions.
Zero-Touch Deployment UAE
Sealed box to working device without IT touching it
Apple Return to Service
Automated reset and re-enrolment without touching the device.
Apple Device Management
Mac and iPhone fleets, encryption, patching and the September cycle
iPhone and iPad Management
Remove company data from a phone you do not own
macOS Management Dubai
FileVault, admin rights, updates and the Rosetta deadline
Device Enrolment
Which path, which reset, and what you can enforce after