Key Points
- Targeted Cyberthreat Protection: Lockdown Mode is designed specifically for individuals at risk of targeted attacks by highly skilled attackers and mercenary spyware.
- Reduced Attack Surface: It aggressively disables or restricts high-risk device features, closing potential entry points for exploits.
- Security Over Usability: Functionality is intentionally sacrificed to maximize device protection and system hardening.
- Personal Control, Not Enterprise Strategy: Lockdown Mode is toggled per user and IT teams can’t turn it on, turn it off, or enforce it across devices through MDM. MDM still manages the device itself.
- Risk of Fleet-Wide Deployment: Enforcing Lockdown Mode across standard managed devices disrupts workflows without adding meaningful security benefits.
Apple Lockdown Mode is an optional security setting for iPhone, iPad, and Mac that blocks or limits features attackers often exploit. Apple designed it for a small number of people at risk of highly targeted attacks, so most users and most managed fleets do not need it. Because each user turns it on for their own device, IT teams cannot enforce it, and it works alongside MDM and endpoint management without replacing them.
In this guide, we’ll discuss how Apple’s Lockdown Mode works and debunk some of the most common misconceptions that cause IT teams to ignore this powerful security feature. Keep reading to learn more about the benefits and limitations of Lockdown Mode.
What Apple Lockdown Mode is: A quick overview
Lockdown Mode is an extreme security setting Apple created to protect high-profile individuals from targeted, highly sophisticated attacks. Apple announced Lockdown Mode in July 2022 and released it later that year as part of the iOS 16, iPadOS 16, and macOS Ventura.
Apple designed Lockdown Mode specifically for scenarios where standard protections are insufficient, and attackers are likely highly skilled. In these scenarios, aggressively reducing a device’s functionality is better than hardening every possible entry point.
Once enabled, the following apps and features will start behaving differently:
- Messages: Most attachment types, except for specific photos, videos, and audios, will be prohibited. Sending links and link previews will also be banned once Lockdown Mode is on.
- Web browsing: Some complex web technologies will be blocked, which can cause some websites to load slowly or not work properly. Certain web fonts and images may also be replaced by a missing image icon.
- FaceTime: Incoming FaceTime calls will be automatically blocked unless the user has previously contacted the person within the past 30 days. SharePlay and Live Photos will also be disabled.
- Apple services: Incoming invitations for Apple services will be limited unless the user has already invited the person.
- Wired connections: An iPhone or iPad must be unlocked for it to connect to an accessory or another computer. MacOS devices must also be unlocked with explicit permissions to connect to Apple silicon.
- Configuration profiles: A device cannot enroll in Mobile Device Management (MDM) or have users install configuration profiles while Lockdown Mode is on. MDM profiles installed before the user enabled LockDown mode remain on the device.
These tradeoffs are intentional and central to the setting’s design. It specifically limits these features so that mercenary hackers will have less surface to exploit.
That said, Lockdown Mode isn’t intended for average users. Apple has explicitly mentioned in its official documentation that the security feature is only for a small number of users.
Lockdown Mode vs enterprise security controls
At a glance, Apple’s Lockdown Mode looks just like another security control, but how it operates is very different from the traditional security features. Its biggest distinction from standard settings is who’s in control.
The Lockdown Mode is enabled and managed by the individual user; IT teams can’t enforce this setting at scale.
Another key difference is flexibility. Most enterprise security tools are built around granular policies and exceptions, meaning IT teams can tailor controls based on role, device state, and business need.
Lockdown Mode’s restrictions, on the other hand, are fixed. There’s very little room for exceptions with this setting, which is why Apple only recommends it to those who need it.
There’s also a big difference in terms of intent. Enabling Lockdown Mode involves making the conscious decision to reduce a device’s functionality in exchange for stronger protections. It assumes that the user knows the risk they’re facing and is willing to accept the limitations that come with the Lockdown Mode.
Meanwhile, enterprise security centers around organizational governance. It focuses on creating a secure and functional environment for everyone, not just one user.
This contrast in goals is one of the reasons why experts don’t consider Apple’s Lockdown Mode as a replacement for enterprise security control. It’s a specialized tool meant to combat a specific threat model.
Common misconceptions about Lockdown Mode
Lockdown Mode is often misunderstood in IT-managed environments because it looks like a high-security feature that should naturally fit into existing enterprise security strategies. When in reality, Apple created it for a very different purpose.
Below, we’ve debunked some of the most common misconceptions about Lockdown Mode and how it works.
Lockdown Mode is “more secure” for everyone
Lockdown Mode is only safer for people who may be targeted by highly advanced, targeted attacks. For most users, the built-in platform protections on Apple devices and enterprise security controls provide enough protection against common risks, like ransomware and phishing scams.
Lockdown Mode can replace enterprise device management
Lockdown Mode can’t help you monitor devices. It doesn’t give you visibility into device health and compliance enforcement, nor does it offer recovery options when something goes wrong. You still need a Mobile Device Management (MDM) solution, such as NinjaOne MDM, and an endpoint management platform to manage Apple devices.
Lockdown Mode should be enforced by IT
Apple designed Lockdown Mode specifically to be controlled by the user. Enabling it means accepting the fact that certain apps and features will be blocked.
When to use Apple’s Lockdown Mode
Turn on Lockdown Mode only when all of the following apply:
- The user has concrete reasons to believe that your device is being deliberately targeted by hackers and other malicious actors.
- The user understands the tradeoffs that come with enabling Lockdown Mode.
- The user is the only person who uses the device.
IT Admin Note: If a user must enable Lockdown Mode but relies on specific corporate web apps that break under its strict web protections, iOS and macOS allow users to explicitly exclude trusted websites or specific apps from Lockdown Mode restrictions via Safari and System Settings.
Remember, Lockdown Mode cannot replace an organizational security strategy. To keep your entire fleet of endpoints secure, you’ll have to use a combination of enterprise security tools and strategies.
Understanding the most appropriate time to use Apple Lockdown Mode
While it’s true that Lockdown Mode is a powerful security feature, it’s only meant for a narrow, high-risk set of threat scenarios where aggressively reducing the attack surface is the best solution.
The challenge here is less about determining whether Lockdown Mode is good or bad, but more about knowing when to use it.
By taking the time to understand what it does and doesn’t do, you and your team will be able to provide an extra layer of protection to users who actually need it.
Related topics:
