Activation Lock on company Macs: prevention and recovery

The scene repeats in Indian businesses every month: an employee leaves, their MacBook is wiped for the next hire, and setup halts at a screen asking for the previous owner's Apple ID password. The Mac is Activation Locked to a personal account belonging to someone who no longer answers the office WhatsApp group. The machine is not broken and not recoverable by cleverness; it is doing exactly what Activation Lock is designed to do, just for the wrong owner. This guide covers how the lock works, your realistic recovery options, and the two settings that prevent the situation permanently.

What Activation Lock is

Activation Lock is Apple's anti-theft binding between a device and an Apple Account. It engages automatically when Find My is enabled, on Macs with Apple silicon or the T2 chip as well as on iPhones and iPads. From then on, erasing or reactivating the device requires that account's credentials. Apple's servers enforce it during activation, which is why no amount of local reinstallation gets around it, and why stolen Apple hardware has poor resale value. As theft protection it is excellent. The trouble begins when the binding account is an employee's personal Apple ID on a device the company owns.

How company Macs end up personally locked

Nobody does it maliciously. A new Mac is set up by hand, the employee signs in with their personal Apple ID for iMessage or iCloud, macOS suggests enabling Find My, and they sensibly agree. The lock now exists, invisible, costing nothing, until the day the device changes hands. Unmanaged fleets accumulate these silent locks for years, then discover them all during a refresh cycle or an office move. On managed fleets the same click cannot create an unrecoverable situation, which is the entire argument of this article.

Recovery: your realistic options

Option one, the cooperative leaver. The former employee removes the device from their Apple Account, either from another of their devices or through Apple's web tools. This takes them two minutes, requires no visit, and resolves everything. Ask politely and early; most people oblige. The success rate drops with every month since exit, which is a reason to check devices at offboarding rather than at reuse.

Option two, Apple. Organisations can request Activation Lock removal from Apple with proof of purchase. This works, and it is slower than option one and entirely dependent on your paperwork: the invoice must tie the specific serial number to your business. Devices bought informally, on personal cards, or second-hand often fail this test, which is worth knowing before you rely on it.

Option three does not exist. There is no legitimate bypass. Services advertising Activation Lock removal are somewhere between scams and worse, and a business handing company hardware to them is taking risks with its money and its name.

Prevention: two settings end this problem

Enrol devices through Apple Business Manager. Devices owned in ABM and enrolled through automated enrolment are supervised, and on supervised devices your MDM can allow or disallow user-based Activation Lock and, critically, can retrieve a bypass code that clears the lock without anyone's personal password. The company can always recover its own hardware, regardless of who signed in during the device's life.

Decide your Find My policy deliberately. Some businesses block personal Activation Lock entirely on company devices, relying on MDM lost mode and managed lock instead; others allow Find My for its genuine anti-theft value and rely on the MDM bypass code as the safety net. Both are defensible on a supervised fleet. What is not defensible is the default drift of unmanaged devices, where the policy is whatever each employee clicked in their first week. Our Activation Lock management service implements either policy and audits the existing fleet for locks you do not know about yet.

Offboarding: the checklist line that saves a laptop

Add one step to every exit: before the last day, confirm the device carries no personal Activation Lock, and have the leaver remove it if it does, while they are still at a desk and still answering messages. It takes two minutes with a cooperative colleague and can take months with an unreachable ex-employee. The asymmetry could not be larger, and the checklist line costs nothing. On managed Macs the same check is a console query rather than a physical inspection.

iPhones and iPads: the same lock, the same fixes

Everything above applies to the rest of the fleet. Activation Lock on iPhones and iPads engages the same way, through Find My on a signed-in personal Apple Account, and company handsets accumulate the same silent bindings when they are set up by hand. The prevention is identical: supervised devices enrolled through ABM give the MDM control of the lock and a bypass route the organisation holds. Recovery options are also the same, with one practical difference: phones change hands inside companies far more often than laptops, passed from a leaver to a new joiner in the same week, so unmanaged estates hit the locked-device wall more frequently and usually at the least convenient moment, mid-onboarding.

Managed devices also get lost mode, which is worth knowing as the complement to Activation Lock: a lost supervised device can be locked remotely with a contact message on screen and its location tracked while it stays managed. The pairing covers both directions of the problem, the device you want back and the device you need to make worthless.

The one-hour audit worth doing this week

Pull your asset list, and for each company Apple device answer two questions: is it enrolled in management, and is Find My signed in with a personal account? The overlap of unmanaged plus personally signed-in is your locked-device risk, sitting quietly until the next reassignment. On managed fleets the query takes minutes; on unmanaged fleets the difficulty of answering is itself the finding.

Frequently asked questions

Can we just reinstall macOS to get past Activation Lock?

No. The lock is enforced by Apple's activation servers, not by the operating system installation on disk. Erasing, reinstalling or replacing storage does not remove it. That resistance is deliberate; the same property that frustrates you is what makes stealing Macs unattractive.

Does Activation Lock apply to all our Macs?

It applies on Macs with Apple silicon or the T2 security chip, which in 2026 means effectively every Mac an Indian business is likely to be running or buying. Older Intel Macs without the T2 chip do not support it, and those machines have larger problems, namely the end of their useful and supported life.

Is Activation Lock the same as FileVault or a firmware password?

No, they answer different threats. FileVault encrypts data so a thief cannot read it. Activation Lock prevents the hardware being erased and reused. A properly managed company Mac wants both: FileVault protecting the data, and Activation Lock under organisational control protecting the asset.

We have a drawer of locked Macs from former staff. Are they scrap?

Not necessarily. Work the options in order: contact the former owners, then approach Apple with purchase records for the rest. Businesses recover more of these than they expect once someone actually runs the process, and the exercise usually motivates the ABM enrolment that prevents the next drawer.