Bypass Activation Lock Fails on DEP-Enrolled Devices

Issue

The Bypass Activation Lock device command fails on iOS 11 and 12 devices that are enrolled at the time of device activation using Apple’s Device Enrollment Program (DEP).  In the Deployment Server log files, the following error is seen:

Apple Device Activation Service failed to request activation lock bypass because either the device '<Device ID>' cannot be not found or the code is invalid.

Affects

Issue

The Bypass Activation Lock device command fails on iOS 11 and 12 devices that are enrolled at the time of device activation using Apple’s Device Enrollment Program (DEP).  In the Deployment Server log files, the following error is seen:

Apple Device Activation Service failed to request activation lock bypass because either the device '<Device ID>' cannot be not found or the code is invalid.

Affects

• iOS version greater than 11.0 and less than 12.1.2

Cause

A known iOS issue that prevents Mobile Device Management (MDM) solutions from removing the Activation Lock on iOS 11 and 12 supervised devices that are enrolled at the time of device activation using Apple’s Device Enrollment Program (DEP).

Resolution

Apple resolved this issue on iOS 12.1.2, so all customers are asked to update their iOS devices to this version or higher.

Prior to this resolution, the only workaround was to enroll affected supervised devices after the device was activated by completing all the steps below:

1. Ensuring the “Require Enrollment during Setup Assistant” option was unchecked in the “Apple Device Enrollment Program (DEP)” tab of all your iOS Add Device Rules.

2. When a device was turned on for the first time or after factory resetting an existing device, the Remote Management screen in the Setup Assistant would need to be skipped.

3. After the device was activated, the device would be enrolled using the Enrollment URL found in your iOS Add Device Rule.