Organization-linked Activation Lock & Bypass

To quote our friends over at Iru (formerly Kandji):

Activation Lock is a theft-deterrent feature found in iOS and iPadOS devices and modern Mac computers (with the Apple T2 Security chip and Apple silicon).

NanoMDM and NanoDEP now have direct support for organization-linked Activation Lock, the flavor of Activation Lock that is not tied to a user’s Apple Account (i.e. not “Find My”). NanoDEP (as of v0.7.0) can lock a device to your organization using the Apple DEP API, and NanoMDM (as of v0.9.0) can unlock a device using Apple’s Escrow Key Unlock endpoint. Both sides revolve around the humble Activation Lock Bypass Code. Below we’ll walk through both, step by step.