iPhone device lock bypassed by FaceID

[aneamy]

When going in to a iPhone and utilizing the lock device button in the management tab, device lock seems to be bypassed if the user has a pin or FaceID setup. Does anyone know of a way to get around this so a phone can truely be locked and could only be unlocked by a admin or is this some sort of limitation by Jamf/Apple?

Any thoughts on this would be greatly appreciated. I was not able to come up with anything when searching the boards or documentation but could have missed it somewhere

[bfrench]

Are you just looking for a temporary lock? What about lost mode? We often use it to "lock" iPads.

[talkingmoose]

Apple didn't design the Lock command for iPads to keep end users out. Lock simply forces the end user to have to unlock the device before using it again. FaceID and PIN are the two ways to unlock the device. (Think of a scenario where an iPad has gone missing and the administrator needs to ensure no one else can access it other than the owner.)

What I have seen that'll accomplish what you're needing is to create a configuration profile forcing the iPad into Single App Mode with Safari as the app. The profile also opens a webpage that alerts whoever picks up the device that it should be returned to the organization.

[agungsujiwo]

Hi @aneamy ,

Based on Jamf Documentation "Lock or Unlock a Device " as follows :
You can remotely lock an iPad, iPhone, or Mac, and remotely unlock an iPad or iPhone from your Jamf Now Devices page. If you want to remotely lock a mobile device to prevent an unauthorized user from accessing the device, you can also use Lost Mode. For more information, see Enabling Lost Mode.
https://learn.jamf.com/en-US/bundle/jamf-now-documentation/page/Remote_Lock_for_Apple_Devices.html
https://learn.jamf.com/en-US/bundle/jamf-now-documentation/page/Lost_Mode_Management.html#task-8563

If you want to lock the device so users cannot access any menus,I agree with @talkingmoose 
you can enable Single App Mode for the web page you created. This page can inform users that the device is locked by the IT team.

Here is a reference link for Single App Mode:
https://learn.jamf.com/en-US/bundle/jamf-school-documentation/page/Single_App_Mode.html