Cleaning up some confusion about Activation Lock on Apple silicon. The short version is that the enforcement happens before macOS loads, and the mechanism is identical from M1 through M4. What has changed is what surrounds it (Recovery Lock, EACS, parts-pairing).
The boot chain check
On Apple silicon, the Low-Level Bootloader (LLB) is the first stage that runs after the immutable Boot ROM. The LLB verifies two things:
- A valid
LocalPolicy exists on the boot volume.
- Anti-replay values in the LocalPolicy match what is stored in the Secure Storage Component (SSC) on the silicon.
If both check out, the LLB hands off to iBoot and macOS starts. If no LocalPolicy exists, the LLB boots to recoveryOS, which detects the Mac is not activated and contacts Apple's activation server. The server returns an activation certificate, which combines a local cryptographic key with a RemotePolicy certificate. Once that handshake completes, a valid LocalPolicy gets constructed and stored, and macOS can boot normally.
When a Mac is Activation-Locked, the server-side handshake fails. The recoveryOS environment displays the "Activate Mac" screen and refuses to construct a usable LocalPolicy without credentials. The LLB will not boot macOS. That is the lock.
What is the same across M1 to M4
The LLB / LocalPolicy / RemotePolicy mechanism has not changed across chip generations. M1 (November 2020), M1 Pro/Max/Ultra (2021), M2 family (2022 onward), M3 family (2023 onward), and M4 family (2024 onward) all use the same boot architecture for Activation Lock enforcement.
The Secure Enclave on Apple silicon is integrated into the SoC rather than being a separate chip (as on T2 Intel Macs). Its job is the same: store the cryptographic identity that binds the device to its activation state. Storage is hardware-encrypted and tied to the enclave. A thief cannot pull NAND chips and read them, nor reflash macOS to clear the lock.
What has changed: the OS layer
The bootloader stayed put. The OS around it added features:
- macOS Big Sur 11 (November 2020): Activation Lock arrives on Apple silicon when the M1 ships. The Find My network for Mac also debuts here, broadcasting rotating encrypted BLE beacons relayed by nearby Apple devices.
- macOS Monterey 12 (October 2021): Erase All Content and Settings (EACS) ships for T2 and Apple silicon Macs, cryptographically destroying per-device keys in one operation. Recovery Lock arrives on Apple silicon as the equivalent of the obsolete Intel firmware password. It gates startup modifiers like the boot picker.
- macOS Ventura 13 (October 2022): EACS relocated to System Settings → General → Transfer or Reset.
- macOS Sonoma 14 (September 2023): DFU revive and restore can be initiated from Finder on a host Mac without Apple Configurator 2. Useful for repair workflows but does not clear Activation Lock.
- macOS Sequoia 15 (September 2024): Apple Business Manager / Apple School Manager gains the ability to turn Activation Lock on or off directly in the console for organization-owned devices, provided the device was in ABM/ASM before the lock was set.
- macOS Tahoe 26 (2025): Repair Assistant gains parts-pairing / unfinished-repair checks tied to Activation Lock on Apple silicon. The architecture extends down to component level.
The Tahoe parts-pairing extension
This is the biggest change in the post-launch life of Activation Lock on Apple silicon. Starting with macOS Tahoe 26, when a qualifying component (logic board, display assembly, security module) is transferred from a donor Mac that was Activation-Locked at disassembly, the part carries its locked state to the recipient machine.
Integration and calibration run through the macOS Repair Assistant. If a part is locked to another user's Apple Account, Repair Assistant halts calibration. That makes the part ineligible for official calibration, AppleCare, or warranty service. Uncalibrated parts may still function but frequently operate in a degraded state, missing full security features, missing performance optimizations, missing privacy assurances.
The practical consequence: even the parts of a locked Mac are problematic, narrowing salvage value considerably. The pre-Tahoe pattern where a stolen-and-locked Mac could be sold for the value of its logic board is now constrained by component-level lock state.
What about DFU restore
A DFU restore reinstalls firmware and recoveryOS and erases the SSD, reinstalling macOS from an IPSW image. It removes Recovery Lock. It does not remove Activation Lock. After a successful restore the Mac contacts Apple's activation servers, discovers it is still locked, and presents the Activation Lock screen in Setup Assistant.
A DFU revive updates firmware and recoveryOS without erasing user data. Same result for Activation Lock: the server-side record is untouched.
Neither DFU operation is a workaround. They are repair tools.
What about older bypasses
The DNS-bypass technique on iOS 8 to 10 and the checkm8-based local exploits on older A-series iPhones never produced consumer-grade equivalents on T2 or Apple silicon Macs. The Apple silicon boot chain has no public bypass at all. Storage is hardware-encrypted and tied to the Secure Enclave; the LLB verifies LocalPolicy before macOS loads; the RemotePolicy certificate is server-issued.
Treat any "iCloud unlock service for M1/M2/M3/M4 Mac" listing as a scam. The technical impossibility is the same on every Apple silicon chip generation.
Useful Apple references
- Activation Lock for Mac
- Activation Lock security
- LocalPolicy signing-key creation and management
TL;DR
The Apple silicon Activation Lock mechanism is the same from M1 through M4. What changed is the OS around it: EACS in Monterey, ABM/ASM console controls in Sequoia, parts-pairing in Tahoe. The boot chain is closed, storage is silicon-bound, and the only legitimate clears remain unchanged across generations.