Recovery Lock and Firmware Password Management

Startup Security on macOS devices helps prevent unauthorized users from accessing Recovery Mode or modifying startup settings. Apple provides two different mechanisms based on device architecture: Recovery Lock for Apple Silicon Macs and Firmware Password for Intel-based Macs. Recovery Lock protects access to macOS Recovery on Apple Silicon devices, while Firmware Password restricts booting from external drives or entering Recovery Mode on Intel Macs without proper authorization.

This guide explains how to configure, monitor, and manage Recovery Lock and Firmware Password using the Scalefusion Dashboard. By managing these settings centrally, administrators can strengthen device security, maintain password validation status, automate compliance workflows, track clear operations, and maintain a complete audit trail ensuring secure startup protection across all managed macOS devices.

Pre-requisites

1. macOS Device Profile should be created on Scalefusion Dashboard

2. You must be subscribed to the Business 2025 plan or higher, or have the Recovery Lock Management and Firmware Password Management features enabled for your account.

3. If Maker–Checker approval is configured:

   1. Clear actions must be approved before execution.

Understanding Startup Security Types

Configuring Recovery Lock for Apple Silicon Macs

1. On Scalefusion Dashboard, navigate to Device Profiles and Policies > Device Profiles

2. Go to macOS Device Profile

3. Navigate to Security & Privacy and click on Recovery Lock tab

4. Enable Configure Recovery Lock Settings for Apple Silicon Macs

   1. Turn on Enable Recovery Lock

• If enabled → Recovery Lock is applied to devices.

• If disabled → Existing Recovery Lock is cleared.

Configuring Firmware Password for Intel Macs

1. On Scalefusion Dashboard, navigate to Device Profiles and Policies > Device Profiles

2. Go to macOS Device Profile

3. Navigate to Security & Privacy and click on Firmware Password tab

4. Enable Configure Firmware Password Settings for Intel Macs

   1. Turn on Enable Firmware Password

   2. Allow Option ROM (OROM) during Startup

      1. Allows loading external firmware at boot

      2. Recommended OFF for better security

   3. Existing Firmware Password on Device

      1. Enable if devices already have a password set

      2. Current Firmware Password: Enter the existing firmware password for the device. This is required to enable, disable, or change the firmware password without errors.

   

Viewing Startup Security Information

1. On Scalefusion Dashboard, navigate to Devices section and click on a particular device which takes you to Device Details page

2. Click on the gear icon and select Full Device Information
   

   

3. All information is displayed under Startup Security tab

   1. Startup Security Type: Based on the device type, it will show one of the following:

      1. Recovery Lock (Apple Silicon)

      2. Firmware Password (Intel)

   2. Startup Security Enabled: Yes / No

   3. Startup Security Password

      1. View Password (if available)

      2. N/A (if not available)

         Viewing password requires admin authentication.

   4. Password Status

      • Valid

      • Invalid

      • Missing

   5. Change Pending: Yes / No

   6. Option ROM Allowed: Yes / No

   

Viewing Password History

Password History is available under Startup Security → Clock Icon. Following information is displayed:

• Set Success / Failure

• Clear Success / Failure

• Timestamp

• Additional details

• Failure reasons (if any)

Clearing Recovery Lock or Firmware Password

1. Navigate to Devices section and click on a particular device which takes you to Device Details page

2. Click on the gear icon and select the option.

   5. Clear Recovery Lock (For Apple Silicon Macs)

   6. Clear Firmware Password (For Intel Macs)

   

3. If Password Exists & Is Valid, you will see confirmation popup. Click OK to proceed.
   

   

4. If Password Is Missing or Invalid, you must enter the current password.
   

   

Additional Actions from Dashboard

Track Recovery Lock and Firmware Password Actions

This can be done from:

1. Account Activity Report
   

   

2. Policies & Actions Status Report: Under this, you can track:

   • Clear Recovery Lock / Clear Firmware Password (under Activity)

   • Status (Pending / Success / Failure)

   

View Startup Security Details in the Device List

On the Device List page, you can choose the following columns to display in the device list:

• Startup Security Type

• Startup Security Enabled

• Startup Security Password Status

These fields are also included in downloaded reports.

Startup Security Fields in Device Inventory Reports

In The Device Inventory Report, you can select the following fields for the report:

• Startup Security Type

• Startup Security Enabled

• Password Status

• Password (if available)

• Change Pending

• Option ROM Allowed

For unsupported devices, the value will display as N/A.

Automate Compliance Using Startup Security Settings

Under Group Automation → Compliance, you can create rules based on:

• Startup Security Type

• Startup Security Enabled

• Password Status (Valid / Missing / Invalid)

• Change Pending

• Option ROM Allowed

Access Startup Security Details via API

The following APIs include Startup Security details:

• /api/v2/devices.json

• /api/v2/devices/{id}.json

• /api/v3/devices.json

• /api/v3/devices/{id}.json

They include a new object: startup_security_details

Security Information in Device Deletion or Factory Reset Emails

When deleting or factory resetting a Mac device, the notification email includes:

• Firmware Password

• Mac PIN

• Device-generated bypass code

• Managed Admin details

If a value does not exist, it will be displayed as N/A.
If the Admin is unavailable, it will display Not Available.

FAQ