Secure the Apple Activation Lock bypass before wiping a returned device

Source facts

Intune can disable Activation Lock without the former user’s Apple credentials, or provide the stored bypass code. Microsoft warns that resetting before copying the code removes it from Intune. Launching Find My after the disable action re-enables the lock, so Microsoft directs administrators to take physical possession first. The action covers supervised iOS/iPadOS through ADE and ADE-enrolled macOS. Microsoft Learn.

Applicability

Confirm the device’s enrollment and Activation Lock configuration, the operator’s permissions, and the approved reassignment request. Do not assume every personally enrolled Apple device supports this managed recovery route.

DSE recommendation

Add a bypass-code custody checkpoint before any approved wipe. Have the receiving technician verify the physical device against the managed record and place the code in an approved secret store, not the ordinary return ticket. Coordinate the lock-removal and reset window so the device remains under organizational control. Keep user-data preservation approval separate from authorization to clear the lock.

Verification

Before erasure, verify that the intended device’s bypass material was actually retrieved and is accessible to the authorized technician. Use a designated test device to rehearse the documented platform-specific activation path. After the approved reset, confirm the device can proceed through activation for its next assignment. Record the result without recording the bypass value or asking the former user to disclose an Apple password.

Official references

Microsoft Learn: Device Action: Disable Activation Lock.