> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/device/security/enable-or-disable-lost-mode.md).
# Enable Or Disable Lost Mode
Enable or disable Lost Mode on this supervised iOS or iPadOS device
### Description
Locks this supervised iPhone or iPad with Apple Lost Mode, showing a message and callback number on the lock screen, or lifts Lost Mode once the device is back. Optionally the device is asked for its position after it is locked. Only supervised iOS and iPadOS devices are accepted. The command reaches the device with its next check-in; if it is offline, it is locked as soon as it connects again.
### Prerequisites
Lost Mode is an Apple feature for **supervised** iOS and iPadOS devices. A device is supervised when it was enrolled through Apple Business Manager or Apple School Manager (Automated Device Enrollment) or prepared with Apple Configurator. Devices enrolled by the user themselves, personal devices and devices managed by app protection only are not supervised and cannot be locked this way.
Before anything is changed, the runbook checks that the device is enrolled in Intune, runs iOS or iPadOS and is reported as supervised. If one of these checks fails, the run stops with a message that names the reason instead of the raw Intune error.
### What the finder sees
While Lost Mode is active the device is locked and shows the lock screen message, the callback phone number and the footer. The phone number can be called from the lock screen without unlocking the device. Nothing else on the device is usable. The texts are visible to anyone who holds the device, so they should name a contact but no internal details.
At least one of the message and the phone number has to be filled in. A device locked without either gives the finder no way to return it, so the runbook refuses that combination.
Enabling Lost Mode again on a device that is already locked updates the lock screen texts.
### Lifting Lost Mode
Choose *Disable Lost Mode* once the device is back. The device unlocks with its usual passcode after the command has arrived. The request is sent even when Intune already reports Lost Mode as disabled, because the reported state can lag behind the device. If Intune then rejects it because Lost Mode is not active, the run ends without a change.
### Locating the device
With *Locate the device after locking?* set to yes, the runbook asks the device for its position right after Lost Mode was requested. The device answers with its next check-in. The runbook waits for about a minute and shows latitude, longitude, the horizontal accuracy in meters and a map link when the position arrives in time. A device that is offline reports its position later; it is then shown in the Intune admin center on the device's page under **Hardware** and in the device action results.
The location request needs the optional permission listed for the *Locate device* feature. Without it Lost Mode is still enabled and the runbook only warns that the position could not be requested.
### Delays and offline devices
Lost Mode and the location request are device actions that Intune queues. A device that is online receives them within seconds; a device that is switched off or has no network receives them as soon as it connects again. The **Current Lost Mode state** shown at the start of the run and the state in the Intune admin center can lag behind by a few minutes.
### Preset the lock screen texts
To give the helpdesk a tenant-wide default, preset the message and the footer in the runbook customization. The phone number is best left to the person running the runbook, unless one central number is used.
```json
"rjgit-device_security_enable-or-disable-lost-mode": {
"parameters": {
"Message": {
"Default": "This device belongs to Contoso and has been reported lost. Please call the number below to return it."
},
"Footer": {
"Default": "Thank you for your help."
}
}
}
```
To always request the position after locking, add `"LocateDevice": { "Default": true, "Hide": true }` to the same block.
### Related runbooks
* **Enable Or Disable Device** (Device/Security) blocks sign-ins with the device in Entra ID. For a lost or stolen device, run it in addition to Lost Mode so tokens on the device cannot be used any more.
* **Reset Mobile Device Pin** (Device/Security) resets the passcode of a corporate iOS device.
* **Wipe Managed App Data** (Device/General) removes company data from devices that are managed by app protection only and cannot be locked with Lost Mode.
* **Wipe Device** (Device/General) is the last resort when the device is not expected to come back.
### Android
Intune also offers a lost mode for Android Enterprise devices that are corporate-owned and fully managed or dedicated. This runbook does not cover Android; the operating system check stops the run for Android devices. Support can be added later without changing the parameters.
### Location
Device → Security → Enable Or Disable Lost Mode
**Full Runbook name**
rjgit-device\_security\_enable-or-disable-lost-mode
### Details
| Property | Value |
| ---------------- | ---------------------------------------------------------------------------------------- |
| Version | 1.0.0 |
| Required modules | RealmJoin.RunbookHelper (>= 0.8.10)
Microsoft.Graph.Authentication (>= 2.41.2)
|
| Schedulable | no |
### Permissions
#### Application permissions
* **Type**: Microsoft Graph
* DeviceManagementManagedDevices.PrivilegedOperations.All
* *Runs the enableLostMode and disableLostMode device actions*
* DeviceManagementManagedDevices.Read.All
* *Looks up the Intune device by its Entra device ID and reads its operating system, supervision and Lost Mode state; also reads the location result after a locate request*
* DeviceManagementManagedDevices.ReadWrite.All *(optional — feature: Locate device)*
* *Runs the locateDevice action when the position is requested after locking*
### Parameters
#### DeviceId
Entra ID device ID of the device the runbook acts on. Set by the portal from the selected device.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | true |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### LostModeAction
Enable Lost Mode locks the device and shows the lock screen texts. Disable Lost Mode lifts the lock again so the device can be used as usual.
| Property | Value |
| ------------------- | ------ |
| Required | false |
| Default Value | Enable |
| Type | String |
| Portal display name | Action |
**Portal options**
| Portal option | Value |
| ----------------- | ------- |
| Enable Lost Mode | Enable |
| Disable Lost Mode | Disable |
#### Message
Text shown on the lock screen while the device is locked, for example who the device belongs to. Anyone who finds the device can read it. At least one of "Lock screen message" and "Callback phone number" is needed.
| Property | Value |
| ------------------- | ------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Portal display name | Lock screen message |
#### PhoneNumber
Phone number shown on the lock screen. The finder can call it from the locked device without unlocking it. Leave empty to show the message only.
| Property | Value |
| ------------------- | --------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Portal display name | Callback phone number |
#### Footer
Additional line at the bottom of the lock screen, for example an asset tag or a reward note. Leave empty for no footer.
| Property | Value |
| ------------------- | ------------------ |
| Required | false |
| Default Value | |
| Type | String |
| Portal display name | Lock screen footer |
#### LocateDevice
Also asks the locked device for its current position and shows the coordinates when they arrive within a minute. A device that is offline answers later; its position is then shown in the Intune admin center.
| Property | Value |
| ------------------- | -------------------------------- |
| Required | false |
| Default Value | False |
| Type | Boolean |
| Portal display name | Locate the device after locking? |
**Portal options**
| Portal option | Value |
| --------------------------------- | ----- |
| Yes, request the current position | true |
| No | false |
[Back to Runbook Reference overview](/automation/runbooks/runbook-references.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.realmjoin.com/automation/runbooks/runbook-references/device/security/enable-or-disable-lost-mode.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.