---
title: "Recovery Lock and Firmware Password Management"
slug: "recovery-lock-and-firmware-password-management"
updated: 2026-02-20T07:18:05Z
published: 2026-02-20T07:18:05Z
canonical: "help.scalefusion.com/recovery-lock-and-firmware-password-management"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Recovery Lock and Firmware Password Management

Startup Security on macOS devices helps prevent unauthorized users from accessing Recovery Mode or modifying startup settings. Apple provides two different mechanisms based on device architecture: **Recovery Lock** for Apple Silicon Macs and **Firmware Password** for Intel-based Macs. Recovery Lock protects access to macOS Recovery on Apple Silicon devices, while Firmware Password restricts booting from external drives or entering Recovery Mode on Intel Macs without proper authorization.

This guide explains how to configure, monitor, and manage Recovery Lock and Firmware Password using the Scalefusion Dashboard. By managing these settings centrally, administrators can strengthen device security, maintain password validation status, automate compliance workflows, track clear operations, and maintain a complete audit trail ensuring secure startup protection across all managed macOS devices.

## Pre-requisites

1. macOS Device Profile should be created on Scalefusion Dashboard
2. You must be subscribed to the **Business 2025 plan or higher**, or have the **Recovery Lock Management** and **Firmware Password Management** features enabled for your account.
3. If [Maker–Checker](/v1/docs/maker-checker-in-scalefusion) approval is configured:
  1. Clear actions must be approved before execution.

## Understanding Startup Security Types

| Device Type | Security Feature |
| --- | --- |
| Apple Silicon Macs | Recovery Lock |
| Intel-based Macs | Firmware Password |

## Configuring Recovery Lock for Apple Silicon Macs

1. On Scalefusion Dashboard, navigate to **Device Profiles and Policies > Device Profiles**
2. Go to **macOS Device Profile**
3. Navigate to **Security & Privacy** and click on **Recovery Lock** tab
4. Enable **Configure Recovery Lock Settings for Apple Silicon Macs**
  1. Turn on **Enable Recovery Lock**

- If enabled → Recovery Lock is applied to devices.
- If disabled → Existing Recovery Lock is cleared.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-NQQ493F8.png)

## Configuring Firmware Password for Intel Macs

1. On Scalefusion Dashboard, navigate to **Device Profiles and Policies > Device Profiles**
2. Go to **macOS Device Profile**
3. Navigate to **Security & Privacy** and click on **Firmware Password** tab
4. Enable **Configure Firmware Password Settings for Intel Macs**

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-98GFOUWD.png)
  1. Turn on **Enable Firmware Password**
  2. **Allow Option ROM (OROM) during Startup**
    1. Allows loading external firmware at boot
    2. Recommended OFF for better security
  3. **Existing Firmware Password on Device**
    1. Enable if devices already have a password set
    2. **Current Firmware Password**: Enter the existing firmware password for the device. This is required to enable, disable, or change the firmware password without errors.

## Viewing Startup Security Information

1. On Scalefusion Dashboard, navigate to **Devices** section and click on a particular device which takes you to **Device Details** page
2. Click on the gear icon and select **Full Device Information**

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-IEDKO5UM.png)
3. All information is displayed under **Startup Security** tab

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-4VAIB458.png)
  1. **Startup Security Type:** Based on the device type, it will show one of the following:
    1. Recovery Lock (Apple Silicon)
    2. Firmware Password (Intel)
  2. **Startup Security Enabled:** Yes / No
  3. Startup Security Password
    1. View Password (if available)
    2. N/A (if not available)

> [!NOTE]
> Viewing password requires admin authentication.
  4. Password Status
    - Valid
    - Invalid
    - Missing
  5. Change Pending: Yes / No
  6. Option ROM Allowed: Yes / No

## Viewing Password History

Password History is available under **Startup Security → Clock Icon.** Following information is displayed:

- Set Success / Failure
- Clear Success / Failure
- Timestamp
- Additional details
- Failure reasons (if any)

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-GOHCJXW1.png)

## Clearing Recovery Lock or Firmware Password

1. Navigate to **Devices** section and click on a particular device which takes you to **Device Details** page
2. Click on the gear icon and select the option.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-VJRADN2I.png)
  1. **Clear Recovery Lock (**For Apple Silicon Macs**)**
  2. **Clear Firmware Password (**For Intel Macs**)**
3. If Password Exists & Is Valid, you will see confirmation popup. Click **OK** to proceed.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-SDQ1KGFE.png)
4. If Password Is Missing or Invalid, you must enter the current password.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-3XUXPSZI.png)

## Additional Actions from Dashboard

### Track Recovery Lock and Firmware Password Actions

This can be done from:

1. [Account Activity Report](/v1/docs/user-reports)

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1ELRJ1GZ.png)
2. [Policies & Actions Status Report](/v1/docs/policy-actions-status-report): Under this, you can track:

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-BS7K3TTC.png)
  - Clear Recovery Lock / Clear Firmware Password (under Activity)
  - Status (Pending / Success / Failure)

### View Startup Security Details in the Device List

On the **Device List** page, you can choose the following columns to display in the device list:

- Startup Security Type
- Startup Security Enabled
- Startup Security Password Status

These fields are also included in downloaded reports.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-GLM8V73E.png)

### Startup Security Fields in Device Inventory Reports

In The Device Inventory Report, you can select the following fields for the report:

- Startup Security Type
- Startup Security Enabled
- Password Status
- Password (if available)
- Change Pending
- Option ROM Allowed

For unsupported devices, the value will display as **N/A**.

### Automate Compliance Using Startup Security Settings

Under [**Group Automation → Compliance**](/v1/docs/dynamic-groups), you can create rules based on:

- Startup Security Type
- Startup Security Enabled
- Password Status (Valid / Missing / Invalid)
- Change Pending
- Option ROM Allowed

### Access Startup Security Details via API

The following APIs include Startup Security details:

- `/api/v2/devices.json`
- `/api/v2/devices/{id}.json`
- `/api/v3/devices.json`
- `/api/v3/devices/{id}.json`

They include a new object: `startup_security_details`

### Security Information in Device Deletion or Factory Reset Emails

When deleting or factory resetting a Mac device, the notification email includes:

- Firmware Password
- Mac PIN
- Device-generated bypass code
- Managed Admin details

If a value does not exist, it will be displayed as **N/A**. If the Admin is unavailable, it will display **Not Available.**

### FAQ

#### When does the status in Firmware Password History show **Clear Firmware Password as Failed**?

The **Clear Firmware Password** action may fail in the following scenarios:

1. A firmware password change is already pending. The device must be rebooted before any additional change requests can be processed.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-T17QTS3B.png)
2. The **Startup Security → Change Pending** status in *Full Device Information* is set to **Yes**.

In these cases, complete the pending change (typically by rebooting the device) before attempting the clear action again.