Activation Lock: when an employee's personal Apple ID bricks a corporate device at reset

A departing user's iCloud Activation Lock survives the wipe, and the bypass code that would have cleared it was deleted along with the Intune device record. Here is the order of operations that keeps returned Apple hardware usable.

The problem

An employee leaves and hands back their corporate iPhone, iPad or Mac. You wipe it from Intune, delete the device record to keep the tenant tidy, and hand the device to the next user. At Setup Assistant it stops dead: "This iPhone is linked to an Apple ID" — and the Apple ID it wants is the former employee's personal iCloud account, complete with their password.

Your recovery path was the Activation Lock bypass code that Intune stores for supervised devices. But it was stored on the device record you just deleted. Microsoft's documentation for the Disable Activation Lock action is blunt about it:

"If you reset the device settings before you copy the code, the code is removed from Intune and is inaccessible. Ensure to copy the bypass code before you wipe the device."
— Microsoft Learn, Device Action: Disable Activation Lock

Who hits this: anyone offboarding iOS/iPadOS or macOS devices — especially teams with automated device clean-up rules that quietly remove stale Intune objects, and teams whose offboarding checklist says "wipe, then delete" with no step in between.

Why it happens

Activation Lock is an anti-theft feature enforced by Apple's activation servers and keyed to the device hardware. It switches on automatically the moment a user signs into Find My, and it is designed to survive a wipe — that is the whole point. No amount of erasing, restoring or DFU-mode reflashing removes it; only the Apple ID password, a valid bypass code, or Apple itself can.

For supervised devices (enrolled through Automated Device Enrollment), Apple generates a device-specific Activation Lock bypass code and escrows it on its activation servers. Intune keeps a copy — but only as a property of the managed-device object. Three details then combine into the trap:

• The code lives on the device record and nowhere else. Wipe the device before copying it, or delete the Intune object, and the code is gone from your side permanently.
• The Disable Activation Lock remote action needs a live, managed target. It only works on supervised devices that are still enrolled. Once the record is deleted there is nothing to issue the action against.
• Graph exports can silently miss it. The activationLockBypassCode property is not returned by a default managedDevices query — it comes back null unless you explicitly $select it. Inventory exports that were supposed to be your backup may contain a column of nulls.

And on unsupervised or BYOD devices, no bypass code ever existed — the lock belongs entirely to the user's Apple ID.

The fix

If the device is still in Intune (do this before anything destructive)

1. Copy the bypass code first. In the Intune admin centre: Devices > All devices > select the device > Hardware, and copy the Activation Lock bypass code. Store it in your offboarding record or password vault against the serial number.
2. Issue Disable Activation Lock while it is still managed. The remote action clears the lock without the user's credentials. Make sure you have physical possession first — if the user opens Find My again afterwards, the lock re-enables.
3. Then wipe. If the lock still challenges you at Setup Assistant, leave the Apple ID field blank and enter the bypass code in the password field (iOS/iPadOS). On macOS, use Recovery Assistant > Activate with MDM key.
4. Only then retire or delete the Intune record. Deletion is the irreversible step; it goes last.

If the record is already gone

• Apple Business Manager / Apple School Manager: for organisation-owned devices that appear in ABM/ASM, an administrator can turn off Activation Lock directly from the portal — no Intune object required. Microsoft's Intune support team highlights this as the recovery path precisely for this scenario.
• Ask the former employee to remove the device from their Apple account (Sign in at iCloud, Find Devices, remove the device) or to enter their password once at Setup Assistant. Awkward, but often the fastest route.
• Apple Support, with proof of purchase: the last resort for organisation-owned hardware locked to an unreachable personal Apple ID.

Prevent the next one

• Write the order of operations into the offboarding runbook: copy code → disable lock → wipe → delete. Never the reverse.
• Export bypass codes proactively, remembering the explicit select: GET /deviceManagement/managedDevices/{id}?$select=id,serialNumber,activationLockBypassCode. Verify the export actually contains codes, not nulls.
• Audit your Intune device clean-up rules — an aggressive stale-device rule can delete records (and codes) for devices sitting in a drawer awaiting reuse.
• Decide your Activation Lock posture deliberately with the supervised-only setting Activation Lock Allowed While Supervised in the settings catalog: allow it where you escrow bypass codes; keep it disallowed where you cannot.

How Decolla handles it

Straight answer: Decolla does not solve this one. Decolla provisions Windows devices over your own Intune and Autopilot tenant — it does not manage Apple devices, so it cannot record a bypass code or clear an Activation Lock. For Apple estates, the runbook above is the fix.

What Decolla does do is guard against exactly this class of failure on the Windows side. The Activation Lock trap is an irreversible action (deleting the device record) executed before the recovery artefact was captured — and irreversibility is the thing Decolla makes explicit before anything runs. Every deployment starts as a written, itemised plan in which each item states its delivery method and its reversibility class: automatically reversible, reversible, or flagged irreversible. Irreversible steps are surfaced for approval up front, not discovered after the fact, and Decolla keeps per-item rollback for the changes it made itself. Decolla is pre-launch; the waitlist is open at decolla.app.

Sources

• Microsoft Learn — Device Action: Disable Activation Lock (Intune)
• Microsoft Tech Community — Support tip: Turn off Activation Lock in Apple Business Manager or Apple School Manager
• Anoop C Nair — Activation Lock on Apple devices with Intune