In light of concerns regarding Activation Lock on Macs, we advise all users to turn off 'Find My' by removing their UCSF-issued Mac from their iCloud accounts before returning their computers back to their UCSF department via one of the following methods:

Method 1: Turn off 'Find My' via your iCloud on the web

This is the method to use if you're asked to remove Activation Lock on a Mac that is either offline or no longer in your possession.

IMPORTANT: The target device must be OFFLINE in order for the "Remove from Account" option to be available on your iCloud account.

1. Go to https://www.icloud.com/find/.
2. Sign in with your Apple ID and password.

3. At the top, click All Devices and select the Mac to remove from your iCloud account. 

   

   NOTE: If you're asked by UCSF IT to remove this, you will be provided with the correct hostname to remove.

4. Click Remove from Account

   

   NOTE: If the "Remove from Account" is not available, such as in the example shown below, it means the target device is not turned off.  Make sure the person in possession of the target device has it turned off, then wait for a few minutes before repeating these steps.

   

5. Confirm the removal by clicking Remove 

   

6. Type in your Apple ID's password and click Remove 

   

7. At the top, click All Devices again to verify that the removed Mac is no longer listed. 

   

Method 2: Sign out of iCloud completely

This is the preferred method for Macs still in your possession and you can get it online.

1. Choose Apple menu > System Preferences.
2. Click Apple ID, then click Overview.  If you're using macOS High Sierra or earlier, click iCloud.

3. Click Sign Out. 

   
4. Follow the prompts on the computer to ensure that all iCloud data are deleted from your Mac by clicking Remove from Mac.

What Is Happening:

It has become aware that many users have signed in to iCloud accounts on UCSF Macs with 'Find My' feature enabled.  In macOS Catalina (10.15) and newer versions, this automatically enables a built-in security feature called Activation Lock, which requires your Apple ID password or a custom passcode before anyone, including UCSF IT, can reactivate and re-use the computer.

Erasing a Mac will not disable Activation Lock automatically.  If the Mac is still associated with the iCloud account of its previous user and re-assigned to another user without erasing and re-installing macOS first, then the previous user of that computer can still lock or erase the computer remotely using his or her personal iCloud account on the Internet at any time, which is beyond UCSF IT's control.

Macs at UCSF that are impacted by this problem include all Macs with Apple's T2 security chip (models introduced after 2017) running macOS Catalina (10.15) or newer, and Apple silicon Macs.  This includes all ITFS-supported Macs that were manually enrolled into ITFS Jamf Pro, which are considered unsupervised and no MDM solutions can control Activation Lock on unsupervised devices.

UCSF Macs that are automatically enrolled into ITFS Jamf Pro through Apple School Manager should not be impacted by this problem as we have a supported policy setting that prevents users from enabling Activation Lock. 

If you have any additional questions pertaining to Apple's Activation Lock, please click here to open a UCSF IT request and submit your questions to be answered.

Related vendor documentation:

• How to remove Activation Lock
• Activation Lock and Find My on Mac
• Sign out of iCloud on your iPhone, iPad, iPod touch, Apple TV, or Mac
• Turn off Activation Lock
  • Includes a link to instructions on opening a request to Apple to remove Activation Lock remotely for your Apple device (iPad, iPhone, iPod, Apple TV or Mac).

Related articles:

• macOS Adventures: A Guide to Disabling & Preventing iCloud Activation Lock

_{Last updated: 2/15/2023}