Activation Lock: why you cannot wipe a Mac after someone leaves

Key facts

• Activation Lock switches on automatically when Find My is enabled, which is the default on a personal Apple ID.
• A device enrolled through Automated Device Enrolment is supervised automatically, and supervised devices can have Activation Lock cleared by the organisation.
• A device that was never supervised, locked to a personal Apple ID, cannot be cleared by the business at all.
• Apple will not remove Activation Lock on request from an employer without proof of purchase, and even then the process is slow and not guaranteed.
• This is a problem you prevent rather than solve, and prevention costs nothing.
• The prevention step is enrolling devices properly at purchase, which is the same step that gives you zero-touch setup.

Why businesses hit this

The sequence is always the same. A company buys a Mac. The new employee sets it up and signs in with their own Apple ID, because that is what the setup screen asks for and nobody told them otherwise. Find My switches on by default, and with it Activation Lock. Eighteen months later the person leaves, perhaps not on great terms, and the device sitting in the cupboard cannot be erased and reissued without their password.

At that point you are asking a former employee for a favour, and the answer depends entirely on goodwill you may no longer have. It is a very common way for a business to lose the use of hardware it paid for.

Activation Lock and supervision

What is Activation Lock?

Activation Lock is an anti-theft measure. When Find My is enabled on a device, the device is tied to that Apple ID, and it cannot be erased, reactivated or set up again without the account password. It does exactly what it is designed to do, which is make a stolen device worthless to the thief.

The complication for businesses is that it does not distinguish between a stolen device and a company device signed in with a staff member’s personal account. The lock behaves identically in both cases.

Why can we not wipe a Mac after an employee left?

Because the device is locked to their Apple ID and your business is not that Apple ID. Erasing it does not help, since Activation Lock survives an erase, and the device asks for the original account credentials on the way back up. Reinstalling the operating system does not help either.

If the device was never supervised, the realistic options are to ask the person to remove it from their account, which they can do in a minute from their own devices or the iCloud website, or to approach Apple with proof of purchase, which is slow and not guaranteed. Asking politely and early, ideally as part of the offboarding conversation rather than three months later, has by far the best success rate.

What is device supervision and how do you get it?

Supervision is a higher level of management on an Apple device. A supervised device accepts controls that an unsupervised one refuses, and the organisation can clear Activation Lock on it.

You get supervision automatically when a device enrols through Automated Device Enrolment, which means it was bought through a supplier linked to your Apple Business Manager account and enrolled itself on first startup. That is the whole trick, and it is covered on the zero-touch enrolment page. Supervision is not something you can bolt on later to a device already in use without erasing it.

How do you clear Activation Lock on a supervised device?

Through Apple Business Manager and your management platform, using the device record rather than the employee’s account. Because the organisation owns the enrolment, it can release the lock without the person who was signed in.

Keep the device record intact until you have finished. Removing a device from Apple Business Manager before clearing the lock takes away the mechanism you need, which is an easy mistake to make when tidying up after somebody leaves. Clear the lock first, then wipe, then reassign, then remove the record if the device is being disposed of.

How do you prevent this happening again?

Three things, in order of value. Buy Apple hardware through a supplier linked to your Apple Business Manager account so every new device is supervised from first boot. Issue Managed Apple IDs so staff have a work Apple account and are not signing in with personal ones. And add a line to your offboarding checklist requiring Find My to be switched off and the device removed from the person’s Apple ID before their last day, while the relationship is still cordial.

The third one costs nothing and works even on devices you never got around to supervising. It is the single highest-value line item you can add to an offboarding checklist for an Apple fleet.

If you are already stuck

Work out first whether each affected device is supervised, because that determines whether this is a five minute job or a conversation. For unsupervised devices, contact the former employee promptly and politely with a clear explanation of what you need them to do, since it takes them about a minute. Leave proof-of-purchase approaches to Apple as the last resort they are.

If you have Apple devices you own but cannot use, 4iT works out which are recoverable, clears the ones that are, and sets up enrolment so it stops happening. Request a callback or get in touch.