Lock

Locking a device forces the user to enter a password to access the device and prevents the user from reversing this restriction. The user is informed of this action via email. If the user has set a password for the device, then that password must be entered.

Procedure 

To remove the lock create a new Security policy that specifies that passwords are optional and assign it to the device. This task enables the user to remove the restriction on their phone. The phone will continue to request a password until the user turns off the restriction on the phone. Also, because only one active policy of the same type can be applied to a phone, you may choose to remove this policy from the phone once the user has successfully turned off the lock. You can do this by applying the previous policy or removing the phone from the policy used to remove the lock. See "Using Labels to Establish Groups" in the Getting Started with Ivanti EPMM for information on working with labels.

For Windows 8.1 Phone and Windows Mobile 10 devices, the device can be unlocked with a new device PIN. The administrator performs a Reset PIN action in the Admin Portal, and provides the new device PIN to the device user.

When a passcode-enabled device running iOS 26.0 or macOS 26.0 is locked, it may not be able to process certain MDM commands and may return a NotNow response. In some cases, if the device acknowledges another command in the same check-in flow, the earlier deferred command might remain pending even after the device is unlocked.

To address this, the server now identifies commands that received a NotNow response and retries them before ending communication with the device. This helps ensure that pending commands are retrieved after the device is unlocked.