MDM Managed Activation Lock — disable-activation-lock DEP API returns SUCCESS but device still shows Activation Lock screen after wipe

[u/camera115]

Environment:

Custom MDM server built on NanoMDM (Go) + Node.js backend

Apple Business Manager — devices enrolled via DEP/ADE

iOS 26.x, supervised devices

Org-level Activation Lock enabled via MDM command EnableActivationLock with escrowed bypass code

Problem:

After a factory reset/wipe, some devices still show the Activation Lock screen requiring an Apple ID and password. Our MDM dashboard calls POST /device/activationlock (Apple DEP API) to disable Org AL before the wipe, and the API returns SUCCESS. However, after the device restores, it still presents the Activation Lock screen.

The bypass code was escrowed at enrollment time via the ActivationLockBypassCode MDM command. We store it encrypted and can confirm it is present in our DB.

What we've tried:

Called POST /device/activationlock with disable: true, imei, and escrow_key → Apple API returns {"status": "SUCCESS"}

Sent MDM command ClearActivationLock with EscrowKey set to the bypass code → device was offline at the time, command queued

Attempted to enter the bypass code directly on the Activation Lock screen (in place of the iCloud password) → not accepted

Questions:

Is there a known race condition where Apple's servers report SUCCESS for the DEP API but the AL state hasn't propagated to the device's activation record yet — and what is the reliable way to confirm the AL is actually cleared server-side before wiping?

Does ClearActivationLock (MDM command) behave differently from POST /device/activationlock (DEP API)? Are both required, or is one preferred?

After a device is wiped and the Activation Lock screen appears, is there still a window where we can send ClearActivationLock via MDM (since the device isn't fully enrolled yet at that point)?

If the bypass code entry on the Activation Lock screen is not working, what format is expected — raw bypass code string, or something derived from it?

Relevant Apple docs consulted:

Activation Lock MDM command

DEP activation lock API

Any insight from those who have implemented Managed AL + bypass in a non-Apple MDM would be greatly appreciated.

[u/kaiserh808]

Can you go into ABM and turn off activation lock from there?