Support tip: Turn off Activation Lock in Apple Business Manager or Apple School Manager with Intune

Author: Benjamin Flamm – Product Manager 2 | Microsoft Intune

Activation Lock on Apple devices helps keep devices safe in the wrong hands and prevents unauthorized access to data on devices owned by your organization. Intune has the ability to disable Activation Lock, but we wanted to highlight that Apple has also made this feature available in Apple School Manager (ASM) and Apple Business Manager (ABM). Read on to learn more!

Allow Activation Lock using Intune

First, the device must be enrolled via Automatic Device Enrollment, which enables supervision and generates an Activation Lock bypass code that is stored under the hardware blade for the device in the Microsoft Intune admin center.Device > All devices > Select your device > hardware).

Screenshot of the hardware details of a device in the Microsoft Intune admin center with the Activation Lock bypass code highlighted.

Next, you need to configure the “Allow Activation Lock during supervision” setting to allow users to enable Activation Lock on their devices. Allowed In the settings catalog Device Configuration > Settings Catalog > MDM options.

As a final step, the user must sign in to the Find My app on the device, which will lock the device to the user’s Apple account.

A screenshot of the sign-in page for Find My on an Apple device.

When this setting is configured, if the user has already enabled Find My, the device will be in Activation Lock. If the user has not enabled Find My, the device will not be in Activation Lock. To check if Activation Lock is enabled on your iOS or iPadOS device, go to System Settings, select your Apple Account, and then select Find My.

To check if Activation Lock is enabled on your macOS device, go to System Preferences, iCloud, Find My Mac.

On macOS, you can also check your device’s Activation Lock status by selecting the Apple menu in the menu bar, holding down the Option key until you see the System Information option, and then clicking System Information.

When a device is locked to a user’s Apple account, that account and password are required to access the device. This is cumbersome and cannot be achieved if the user has already left the company. Alternatively, an activation lock bypass code can be used, but if the device is deleted or removed from Intune, this code is no longer available. Bypass codes previously had to be manually copied and stored elsewhere.

Disable Activation Lock task using Intune

To address these issues, we have introduced the Disable Activation Lock action in Intune. This action allows you to remotely turn off Activation Lock on supervised iOS/iPadOS and macOS devices without requiring the previous user’s Apple account and password or a bypass code. You can learn more about managing Activation Lock through Intune by reviewing: Disable Activation Lock on Apple Devices Using Intune.

This is helpful, but it doesn’t allow you to remotely view the Activation Lock status of the device or determine if the device is ready for other use.

Activation Lock Management for ABM and ASM

At WWDC24 in June, Apple announced the ability to manage Activation Lock on devices managed by ABM and ASM and enrolled using Automatic Device Enrollment. This new feature not only allows you to ‘unlock activation’, but also view the activation lock status of your device directly from the AMB/ASM console.

To learn more about this feature, see the Apple documentation.

Turn off Activation Lock in Apple Business Manager | Apple Support.

This is a major improvement to Activation Lock management and we are excited to bring this capability to ABM and ASM. While Activation Lock management will continue to be supported in Intune, we recommend using this new method via ABM and ASM to disable Activation Lock on your devices.

If you have any questions, please leave a comment below or contact me at X. @IntuneSoupTeam.