Recovery Lock Passcode is greyed out when selected and no password appears

Question

Recovery Lock Passcode is greyed out when selected and no password appears

Craig Garghan 0

So I have a user who is trying to test Apple deployment on their mac and can not reset their device since we have Recovery lock passcode enabled, but when I go to get them the code. The selection turns from blue to grey but does not show a code. I also select rotate password and am greeted with rotate passcode pending or not supported when it fails. How do I get them this passcode without disabling the Configuration policy for others who it does work for.

Ohekpeje 0 Reputation points

2026-06-17T20:10:00.1433333+00:00

You don’t need to disable the configuration policy for everyone. Instead, confirm the device is checking in, verify Recovery Lock status, and try retrieving the existing passcode. If rotation fails, it’s likely due to macOS version limitations. In that case, temporarily exclude the test device from the Recovery Lock policy or use Apple Configurator for reset, while keeping the policy active for others.
Craig Garghan 0 Reputation points

2026-06-18T12:18:25.3533333+00:00

I am able to confirm the device is checking in through company portal. It checks the status and comes back with in compliance. The Mac in question is running the Tahoe 26 version. I do not at this stage want to remove this device from that recovery lock policy as it is tied to other configurations. But the apple configurator what is involved with that, is that through Intune as well.

Your answer

Ohekpeje 0 Reputation points

2026-06-17T20:10:00.1433333+00:00

You don’t need to disable the configuration policy for everyone. Instead, confirm the device is checking in, verify Recovery Lock status, and try retrieving the existing passcode. If rotation fails, it’s likely due to macOS version limitations. In that case, temporarily exclude the test device from the Recovery Lock policy or use Apple Configurator for reset, while keeping the policy active for others.
Craig Garghan 0 Reputation points

2026-06-18T12:18:25.3533333+00:00

I am able to confirm the device is checking in through company portal. It checks the status and comes back with in compliance. The Mac in question is running the Tahoe 26 version. I do not at this stage want to remove this device from that recovery lock policy as it is tied to other configurations. But the apple configurator what is involved with that, is that through Intune as well.