Activation Lock for iPhone and iPad: How It Works and How to Remove It

Activation Lock is Apple's anti-theft lock for iPhone and iPad. It turns on with Find My and ties the device to the owner's Apple Account, so after an erase the device cannot be set up again without that account's password or the device passcode. To turn it off before you sell or return a device, sign out of Find My (or out of the Apple Account) and then erase it. To remove it from a device you hold, there are three legitimate routes: the previous owner removes the device from their account, Apple removes it after an Activation Lock support request with proof of purchase, or, for company devices, the organization removes it through its device management service or Apple Business.

If you are holding a locked iPhone right now, jump to the removal routes; if you collect devices from staff, the IT checklist further down keeps them from getting stuck.

TL;DR

• Activation Lock turns on automatically when Find My is on, and it survives a full erase.
• There are two kinds on company devices: user-linked (a person's Apple Account) and organization-linked (set by the organization's device management service).
• The legitimate removal routes are the previous owner, Apple's support request with proof of purchase, and for organization-owned devices the device management service or Apple Business.
• There is no legitimate "bypass tool". Unlock services and tricks either do not work or put the device and its data at risk.
• For IT, prevention is cheap: buy and enroll through Apple Business, supervise devices, and collect devices with the user signed out.

What Is Activation Lock?

Activation Lock is a feature of Find My on iPhone and iPad (and on Macs with Apple silicon or the T2 chip). When it is on, Apple's activation servers record that the device belongs to a specific Apple Account. Anyone who erases the device and tries to set it up again sees the Activation Lock screen, which asks for the Apple Account and password that set up the device, or the device passcode.

That is what makes a stolen iPhone hard to resell: wiping it does not remove the lock. It is also why a work iPhone that a former employee signed into with a personal Apple Account can become a paperweight when nobody planned for it.

How Does Activation Lock Work?

When Find My is turned on, the device is registered to the signed-in Apple Account on Apple's servers. Every time the device is activated (after an erase, a restore from a computer, or a fresh setup), it checks in with Apple. If the record says the device is locked, setup stops at the Activation Lock screen until someone enters the right credentials.

Because the check happens on Apple's servers, local tricks do not change the result. Turning off Find My, signing out of the Apple Account, or erasing the device with the owner's password are the actions that clear the record. A device that cannot reach the internet cannot finish activation at all, so it has to get online to be checked.

Types of Activation Lock

On personal devices there is only one kind: the owner's Apple Account. On organization-owned devices, Apple's deployment guide describes two.

1. User-Linked Activation Lock

User-linked Activation Lock ties the device to a person's Apple Account through Find My. On a company device this happens when an employee signs in with a personal Apple Account and Find My is on. On a supervised device, Apple disallows Activation Lock by default; the device management service has to allow it first, and before it does, it must retrieve and store a bypass code from the device. Apple notes that this code can be retrieved for up to 15 days after the device is first supervised, after which it is gone.

• The lock follows the person's account, not the company.
• Without that person, removal depends on the stored bypass code, Apple Business, or Apple support.
• It is the usual cause of stuck devices after someone leaves.

2. Organization-Linked Activation Lock

Organization-linked Activation Lock is turned on by the organization's device management service for a supervised iPhone or iPad. The service talks to Apple's servers directly, so turning the lock on or off does not depend on any user's Apple Account.

• The lock belongs to the organization.
• The device management service can turn it off. If that fails, Apple says the person who created the service token can enter its username and password on the Activation Lock screen.
• Apple Business or Apple School Manager can also turn it off for devices registered there.

How to turn off Activation Lock before you sell or return a device

Do this before the device leaves your hands. It takes a minute and saves the next owner (or your IT team) a support case.

1. On the iPhone or iPad, open Settings, tap your name, then Find My, and turn off Find My iPhone (or Find My iPad). Enter your Apple Account password.
2. Or sign out of your Apple Account completely: Settings > your name > Sign Out.
3. Erase the device: Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. If Find My was still on, the erase asks for your Apple Account password and turns off the lock.

When the device restarts to the Hello screen and can be set up without asking for your account, the lock is gone. If the device is already out of your hands, sign in at icloud.com/find, select it, and choose Remove This Device.

How to remove Activation Lock

These are the only legitimate routes. Which one you use depends on who owned the device and what you can prove.

Ask the previous owner to remove it

If you bought a used device that shows the Activation Lock screen, contact the seller. They can enter their Apple Account password on the device, or remove it remotely: sign in at icloud.com/find, select the device and choose Remove This Device. Apple's advice for buyers is simple: don't take ownership of a used iPhone or iPad until it has been removed from the previous owner's account.

Start an Activation Lock support request with Apple

If you own the device but cannot sign in, for example the account belonged to someone who is unreachable, Apple lets you start an Activation Lock support request. You need proof of purchase that shows the device, such as an original receipt with the serial number or IMEI. Apple reviews the request and can remove the lock.

For organization-owned devices: device management or Apple Business

For company iPhones and iPads, Apple's deployment guide gives IT two routes:

• The device management service. For organization-linked Activation Lock, the service turns the lock off through Apple's servers. For user-linked Activation Lock on a supervised device, the service uses the bypass code it stored before it allowed the lock.
• Apple Business (formerly Apple Business Manager) or Apple School Manager. A user with the Manage Devices privilege can turn off both organization-linked and user-linked Activation Lock, as long as the device was added to the portal before Activation Lock was turned on and has not been released. The device does not need to be assigned to a device management service.

Business or school users who see the lock on a work device should contact their IT department rather than Apple.

Common Activation Lock Scenarios

Ex-Employee Device Recovery

The most common case: someone leaves and their company iPhone comes back locked to their personal Apple Account. Ask them to remove it from icloud.com/find; it takes them a minute from any browser. If they cannot or will not, use Apple Business if the device is registered there, the stored bypass code if the device was supervised, or Apple's support request with the company's proof of purchase.

Second-Hand Device Purchases

Buying used devices from unknown sellers is the riskiest route for a business. Apple no longer offers a public lookup for a device's Activation Lock status, so the check has to happen in person: ask the seller to sign out and erase the device in front of you, and confirm it starts at the Hello screen without asking for an account. If it shows the Activation Lock screen, do not buy it.

Lost Credential Recovery

Sometimes the account is the company's own, but nobody remembers the password, for example an Apple Account created with a shared mailbox. Recover the account through Apple's account recovery first. For devices you own, the support request with proof of purchase is the fallback. Going forward, use Managed Apple Accounts for work services, so personal and shared accounts stop owning company hardware.

Prevention and Best Practices

Supervised Device Enrollment

Buy devices from Apple or an authorized reseller that adds them to Apple Business, assign them to your device management service, and let Automated Device Enrollment supervise them on first start. Supervised iPhones and iPads have Activation Lock disallowed by default, and devices registered in Apple Business can have the lock turned off from the portal. See Apple Business Manager and Apple supervised mode.

Bypass Code Escrow

If you allow users to turn on Activation Lock on supervised devices, make sure your device management service stores the bypass code first. Apple's guide is clear about the timing: the code can be retrieved for up to 15 days after the device is first supervised. After that it cannot be retrieved.

Chain of Custody Documentation

Keep a simple record for each device: serial number, proof of purchase, Apple Business status, who has it, and how it was returned. Make "signed out of Find My" a line on the offboarding checklist, next to returning the badge. That record is also what Apple asks for in a support request.

An IT checklist for company iPhones and iPads:

• Buy through channels that register devices in Apple Business.
• Enroll with Automated Device Enrollment so devices are supervised.
• Keep Activation Lock disallowed unless you have a reason to allow it.
• Keep proof of purchase with the serial number for every device.
• Collect devices with Find My off and the user signed out, then erase before reassigning.

Troubleshooting Common Issues

Lost Bypass Code Recovery

If the bypass code was never stored and the 15-day window has passed, the code is gone. Check whether the device is in Apple Business and not released; if it is, turn the lock off there. If not, ask the user to remove the device from their account, or use Apple's support request with proof of purchase.

Offline Device Challenges

A device has to reach Apple's activation servers to finish setup, so a device on a network that blocks Apple's services will stall at activation. Connect it to an open network or use cellular data, or prepare it with Apple Configurator on a Mac that is online. Also allow Apple's hosts on your corporate network.

Policy Restriction Conflicts

If the device management service removed the lock but the device still asks for an account, the device may have been locked by a personal Apple Account that the service never allowed or recorded. Check the device record for the Activation Lock status and supervision state, then use Apple Business or the previous owner.

Activation Lock Type Comparison

Managing this across many devices

Most stuck devices come from the handover, not from theft: a device collected without the user signed out, then reset by someone who did not check. trio.so can wipe a managed company iPhone or iPad from the console. The admin types "erase" to confirm before the command goes out, and the console blocks the wipe on personally owned devices. Pair it with the checklist above: confirm the user signed out of Find My, then wipe and reassign. See Apple device management.

Related reading: how to remote wipe an iPhone, how to remote lock an iPhone and USB Restricted Mode.