## TL;DR
Check your MDM for an escrowed Activation Lock bypass code first; that unlocks the Mac in minutes. If no code was escrowed, release the device in Apple Business Manager by serial number. With neither option, Apple support can remove the lock once you provide the original proof of purchase. Always recover the code before wiping, since a wipe just returns you to the same lock screen.

## Steps
1. Check for a bypass code: in Jamf Pro open the device record and look under Management for the Activation Lock bypass code; in Intune open the device / Overview for the escrowed code. Expected: a code is listed. At the Activation Lock screen, leave the Apple ID field blank and enter the bypass code as the password.
2. If no code is escrowed, open Apple Business Manager / Devices, find the serial number, and release the Activation Lock. Expected: the lock clears the next time the Mac checks in.
3. If the Mac was never in Apple Business Manager and no code exists, contact Apple support with the original proof of purchase for that serial number. Expected: Apple removes the lock within a few business days.
4. After the lock clears, erase the Mac (remote wipe from MDM or macOS Recovery) and confirm it enrolls cleanly for the new user. Expected: Setup Assistant runs with no Activation Lock prompt.
5. Add bypass-code escrow verification and an Activation Lock removal step to your offboarding checklist so the next exit does not repeat this. Expected: future offboards never hit this screen.

## Use this when
- A reassigned company MacBook shows the Activation Lock screen for a departed employee
- A wipe left a Mac asking for an Apple ID nobody has
- You need the documented recovery order: MDM code, then Apple Business Manager, then Apple support

## Not for this skill when
- The Mac is a personal or BYOD device (help the owner sign out themselves; you cannot bypass it)
- The device was never enrolled in your MDM and never in Apple Business Manager (go straight to the Apple proof-of-purchase route)
- You only need to erase a Mac whose lock is already cleared (standard wipe flow applies)

## Compatibility
- Macs with Apple silicon or the T2 chip; bypass-code escrow requires supervised MDM enrollment
- Jamf Pro or Intune for code escrow; Apple Business Manager for remote release

## Variants
### Bypass code exists but is rejected
A firmware password set on the Mac blocks the bypass flow. Clear the firmware password first, then enter the bypass code.
### Personal Apple ID on a company Mac
If the departed user signed in with a personal Apple ID and Find My was on, only their sign-out or the Apple support route clears it. Treat personal IDs on company Macs as a policy gap and prohibit them going forward.

## Why it happens
Activation Lock ties the Mac to an Apple ID at the hardware level, independent of your MDM. MDM enrollment escrows a bypass code precisely for this moment, but only if the Mac was supervised before the user left. Without escrow, only Apple can break the tie, and only with proof the organization owns the hardware.

## Edge cases
- Wiping before recovering the code wastes a cycle: the Mac returns to the same lock screen after the erase.
- Devices bought secondhand or off-lease without an ownership transfer in Apple Business Manager cannot be released by you; route those to procurement.
- Keep the departed user's mailbox disabled but do not delete their Apple ID; you may still need them to sign out if the bypass code is missing.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_j8l1h5ap98SOF7sF_-OfPQ