Activation Lock and Bypassing for iOS and iPadOS devices
Overview
The Activation Lock feature for iPhones, iPads or iPods is designed to prevent anyone else from using a device that he does not own. The process and benefit of this feature is simply explained. As these devices are mostly designed for the consumer market, a user buys a phone and will log into their personal Apple ID. At this point, the activation lock will be enabled (with enabling the Find my option) on the device and if the device gets lost or stolen and factory wiped, the next user will not be able to activate the device, as it is locked to the owner. Now you might have in your organization the same situation, but in a business context. One of your users is receiving his corporate iPhone or iPad, enrolls it to Silverback and as you allow him to add his personal Apple ID on the device, the device will have an activated activation lock. Now the user will leave the company and a new user will receive this device. According to your process, the device gets factory wiped and submitted to your new user. Now the new user will face the following screen when he starts the device:
To bypass this scenario, the following conditions must be met to avoid contacting and involving the previous owner:
- The device must be running on iOS 7.1 or above
- The device must be supervised
Bypassing the activation lock allows you to enter instead of the previous users Apple ID information, a bypass code in the password field. The upcoming chapters will demonstrate how to get and use the bypass code and how you can prevent this scenario in the future and how to review the activation lock status for devices.
Export Bypass Codes
You can export all collected bypass codes for supervised devices in Silverback. Please perform the following steps to export the bypass codes:
- Open your Silverback Management Console
- Login as Administrator
- Navigate to Admin
- Select Logs
- Press Export Codes Next to Activation Lock Bypass Codes
After pressing the Export button, a ActivationBypassCodes-DD-MM-YYYY.csv will be downloaded containing all bypass codes that Silverback has collected. The Bypass Code Export is generated with the following content:
| Header | Example | Description |
|---|---|---|
| Device UDID | e.g. eb0fe2bd19451bb54e0d608847c52be9c87b1d81 | Device UDID to identify the device |
| Last MDM User Name | e.g. maria.miller@imagoverum.com | Last associated username for the device |
| Serial Number | e.g. F9FPT2YRFLMY | Device serial number to identify the device |
| IMEI Number | e.g. 35 877405 911775 2 | Device IMEI number to identify the device |
| Activation Lock Bypass Code | e.g. Q3GL4-T4Y3H-GCQL-J9NK-8D1M-6MV4 | Code to bypass the activation lock |
Locate the device by using either the UDID, Last MDM Username or IMEI Number, and then note down the Activation Lock Bypass Code.
Enter Bypass Code
When the activation locked device will start after a factory wipe, the user will see the iPhone Locked to Owner screen, but first can proceed with selecting the language, region, and Wi-Fi connection. When the device is at the activation point, a new screen will appear that displays that you are required to enter the Apple-ID and password that was used to setup this device.
Instead of entering here the old Apple ID and Password, which would also work, but the employee who left the company is not reachable anymore or want to provide the personal account information, you can enter the Activation Lock Bypass Code (e.g., Q3GL4-T4Y3H-GCQL-J9NK-8D1M-6MV4) without hyphens into the Password field and leave the Apple ID information field empty. By pressing Next, the device should be unlocked now and should be usable by the new user.
Avoid Activation Lock
For non-supervised devices, ensure that the current owner of the device will log out from their personal Apple ID from the device before performing a factory reset. For supervised devices, you can prevent the adding of Apple IDs to devices in general with disabling the Allow Account Modification restriction. Another option is to disable the more dedicated Allow Activation Lock restriction, but take into account that changing the Activation Lock restriction will only take before the Apple ID has been added to the device and that this setting will not change something visible in the user interface and is not listed in the MDM Profile overview. So keep in mind that a change of Allow Activation Lock restriction will probably not influence the behaviour of already managed devices. Please take additionally into account: If Find My is on when you allow Activation Lock, Activation Lock is turned on at that time. If Find My is off when you allow Activation Lock, Activation Lock is turned on the next time the user turns on Find My.
Review Activation Lock Status
To review the Activation Lock Status, open the device overview for your device and locate the Activation Lock Enabled entry.
The Activation Lock Enable information was introduced in Silverback 21.0. Update 3
