Activation Lock and Lost Mode in Intune for iPhone and iPad: bypass codes and recovery

Activation Lock protects a lost iPhone from being reused by a thief, and blocks your own IT team just as effectively when an employee leaves without signing out of Find My. Intune can keep the bypass code for supervised devices and lock a missing device in Lost Mode, but only if the groundwork is in place before you need it. In this post I'll set that up, then walk through the lost-device and returned-device workflows.

How it works#

• Activation Lock turns on automatically when a user sets up Find My. From then on, turning off Find My, erasing the device or reactivating it needs that user's Apple Account and password.
• The bypass code is a device-specific code that supervised devices generate and that is stored on Apple's activation server. Intune keeps a copy for supervised devices it manages, so you can either enter the code on the device or have Intune send it to Apple's activation server with the Disable Activation Lock action, without touching the device.
• Lost Mode locks a supervised device and shows your message and phone number on the lock screen. The device stays locked until an administrator turns Lost Mode off, and you can use Locate device to find it in the meantime.

Prerequisites#

• iPhones and iPads in supervised mode through Automated Device Enrollment (ADE). Devices enrolled by users or not supervised aren't supported.
• A settings catalog policy for iOS/iPadOS that allows Activation Lock on supervised devices (step 1).
• Roles. For Disable Activation Lock: Intune Administrator (formerly Intune Service Administrator), or a custom role with Remote tasks/Bypass activation lock plus read access to managed devices. For Lost Mode: Help Desk Operator, School Administrator, or a custom role with Remote tasks/Enable lost mode and Remote tasks/Disable lost mode.

Step-by-step#

1. Allow Activation Lock and capture the code#

Create a settings catalog profile for iOS/iPadOS with this setting and assign it to your supervised device groups:

Users then keep the protection of Find My, and you keep a way back in. Check that Intune holds a code: open the device under Devices › All devices, select Hardware, and look for Activation Lock bypass code under Conditional Access. If you report on this with Microsoft Graph, request the activationLockBypassCode property explicitly for a single device; an unfiltered request returns it as null:

GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}?$select=deviceName,activationLockBypassCode

2. A device is lost or stolen: Lost Mode#

1. In the Microsoft Intune admin center, open the device under Devices › All devices.
2. Select Locate › Lost mode (supervised only), then Enable.
3. Enter a Message to display on lock screen with return instructions, and optionally a Phone number to display. Select OK.
4. While Lost Mode is on, use Locate device to see the device's approximate location on a map, and Play Lost Mode sound if it's likely to be nearby.

The user can't use the device while it's in Lost Mode, although some built-in functions can still work; Siri, for example, may still make calls unless you've turned it off. Lost Mode also isn't a time to push software: app installs fail while it's on, and the related codes are in the Intune app installation error codes reference.

When the device turns up, open it again, select Lost mode (supervised only), choose Disable and OK. If it doesn't turn up, wipe it remotely.

3. A device comes back: clear Activation Lock before reuse#

The order matters here, because the code disappears from Intune when the device is reset.

1. Get the device in your hands first. If someone opens Find My after you disable Activation Lock, it turns itself back on.
2. Copy the bypass code from Hardware › Conditional Access and store it somewhere safe. If you reset the device before copying it, the code is removed from Intune and can't be recovered there.
3. Run Disable Activation Lock. On the device overview, select Secure › Disable Activation Lock.
4. Wipe the device from the same row of actions. See wipe, retire and Fresh Start for what each action removes.
5. If Setup Assistant still asks for an Apple Account, leave the Apple Account field blank and enter the bypass code as the password. That removes the previous account from the device.

Verify#

• Supervised devices in the ADE groups report the Activation Lock profile as applied, and their Hardware page shows an Activation Lock bypass code.
• After enabling Lost Mode, the device shows your message and phone number on its lock screen, and Locate device returns a position.
• After Disable Activation Lock and a wipe, Setup Assistant moves past activation without asking for the previous user's Apple Account, and the device can be enrolled through ADE again.
• Each action's status on the device overview shows it completed; if it stays pending, the device hasn't checked in yet.

Tips & gotchas#

• Check the codes before you need them. Spot-check that supervised devices show a bypass code in Intune; a device without one can't be unlocked through Intune when it comes back.
• Protect the codes. A bypass code is as sensitive as an admin password for that device. Store any copies in your password vault with the serial number, and limit the Bypass activation lock permission to the team that recovers devices.
• Supervision is the dividing line. If Lost Mode or Disable Activation Lock is missing or unavailable for a device, check that it's supervised through ADE; ADE devices missing in Intune covers the enrollment side.
• Write a useful lock-screen message. Include who owns the device and how to return it, but no personal details of the user.
• Macs are similar but not identical. The same profile setting exists for macOS, and a wiped Mac takes the code through Recovery Assistant's Activate with MDM key option.

References#

• Device action: disable Activation Lock
• Device action: Lost Mode
• Device actions in Microsoft Intune