Disabling or bypassing iCloud Activation Lock

If the devices are in Apple Business Manager then you can disable Activation Lock for organizational devices, whether the lock was placed via MDM or the user: https://support.apple.com/guide/apple-business-manager/turn-off-activation-lock-axm812df1dd8/web

Otherwise you would need to disable using Apple ID's all together on devices. Apple is not too keen on preventing Activation Lock for Apple ID's, even on organizational devices, so it's basically an "All or Nothing" approach. You could use Managed Apple ID's but that also has it's own host of other issues related to the restrictions placed on those Apple ID's. 

Hey Mike,

Just to further clarify, if the machine didn't come directly from Apple or an authorized retailer (e.g. with supervision out of the box) then I would need to disable iCloud entirely because those don't show in Apple Business Manager.

Is is possible to entirely disable all of iCloud in Jamf Now, or is that a Pro only feature? I don't see how to just turn it off entirely, just specific iCloud features.

Hey @ItManagerDude 

I am also trying to do the same , however after rebooting into recovery mode and erasing mac i dont see the option to activate with MDM recovery key , my machines go into infinite loop internet recovery mode after erasing and never land in activating screen , 
Apologies to distract from your issue here, but i am desperately looking for solution as there are quite few laptops with personal icloud accounts and activation lock enabled that are sitting on shelf and i  want to try this option before opening a support case with apple. 

Thanks in advance

Hey @ItManagerDude 

I am also trying to do the same , however after rebooting into recovery mode and erasing mac i dont see the option to activate with MDM recovery key , my machines go into infinite loop internet recovery mode after erasing and never land in activating screen , 
Apologies to distract from your issue here, but i am desperately looking for solution as there are quite few laptops with personal icloud accounts and activation lock enabled that are sitting on shelf and i  want to try this option before opening a support case with apple. 

Thanks in advance

You can retroactively add devices into Apple Business Manager with Apple Configurator (using either an iPhone or another Computer) which would be recommended, but this does also wipe the device so it might not be feasible to establish fleetwide for current devices: https://learn.jamf.com/en-US/bundle/jamf-now-documentation/page/Device_Preparation_for_Automated_Device_Enrollment_with_Apple_Configurator.html 

Otherwise in Jamf Now inside the Blueprint you would go to Restrictions > Privacy and Security > and check off "Prevent Changes to Accounts." That will prevent them from signing into an Apple ID, and if you partner that by skipping the Apple ID during enrollment (for Automated Device Enrollment) then they would never be prompted to sign in. If your devices are enrolling via Open Enrollment then this won't work, as devices won't be supervised, and that restriction does require supervision.  

Hey Mike,

Just to further clarify, if the machine didn't come directly from Apple or an authorized retailer (e.g. with supervision out of the box) then I would need to disable iCloud entirely because those don't show in Apple Business Manager.

Is is possible to entirely disable all of iCloud in Jamf Now, or is that a Pro only feature? I don't see how to just turn it off entirely, just specific iCloud features.

Exactly the info I needed, thanks for explaining. Jamf just earned a new customer.

If the Mac is not in Apple Business Manager, then it is not supervised by Jamf Now or Pro, and they will not have the Activation Lock Bypass codes. You will need to contact Apple, and provide proof of purchase, and they will provide you with the Activation Lock Bypass code. Many things in Apples MDM framework are locked behind device supervision, Activation Lock is one of them.

iOS 7.1 adds support for bypassing Activation Lock. This allows organizations to remove the Activation Lock from supervised devices prior to device activation without knowing the userʼs personal Apple ID and password. Use this command to retrieve the device’s bypass code.

---

Get the Bypass Code for Activation Lock | Apple Developer Documentation

• This documentation covers device enrollment, and the different enrollment status and how to active them. 
  • Understanding Device Enrollment — Deployment and Management Tutorials | Documentation (apple.com)
• This is a list of some of the functions that need a device to be supervised to use.
  • MDM restrictions for supervised Apple devices - Apple Support
  • MDM restrictions for iPhone and iPad devices - Apple Support

not tested as we disable as part of pre-stage, but this is new in ABM.. worth a go..