iOS Lost Mode stayed pending while stolen iPhone was offline, then enabled months laterSolved

Hello @matteo !

When Lost Mode is initiated on an iOS device that is offline, the command cannot take effect immediately. It remains pending until the device connects to the internet again.

Once the stolen iPhone comes online through Wi-Fi or cellular data, Hexnode delivers the pending Lost Mode command. After Lost Mode is successfully enabled, the device is locked at the system level and displays the configured Lost Mode message. The user cannot access the Home Screen, Settings, apps, notifications, or corporate data.

The “Scan Device” entries are expected in this situation. Hexnode routinely attempts device scans to update device information. If the device is offline, those scan actions remain pending, and newer scheduled scans can cancel older pending scan attempts. This can result in many cancelled scan entries for a device that has been offline for a long time.

To confirm the Lost Mode timeline, check Reports > Audit Reports > Audit History and set the Created time filter to All. Search for Lost Mode events there. This is usually more useful than scrolling through a long device action history.

Best Regards,
Isabel Lora
Hexnode UEM

I found the audit report after changing the filter from Today to All. It shows Lost Mode was initiated when the phone was stolen, and then it shows Lost Mode enabled months later when the device checked in. So does that mean they didn’t necessarily unlock it? I’m confused because the device still had to connect to the internet somehow.

Yes, that’s correct. They do not need the passcode just to get the phone online in some cases. On iOS, if Control Center access is available from the lock screen, someone may be able to toggle Wi-Fi or cellular options without unlocking the device. Also, if the phone still has an active SIM or cellular plan, it can connect to cellular data in the background after being powered on. That connection is enough for the pending MDM command to reach the device. Once Lost Mode lands successfully, the device is locked down and cannot be used normally.

Best Regards,
Isabel Lora
Hexnode UEM

That makes sense. There was also an “Install Hexnode UEM – Success” entry around the same time. I first thought that meant the phone was factory reset and re-enrolled, but it sounds like the important part is that Lost Mode is now enabled.

Correct. An app installation or policy association entry by itself does not prove that the thief successfully unlocked the phone. It only confirms that the device contacted Hexnode and processed management actions. If the device page and audit report confirm that Lost Mode is enabled, the current state is that the iPhone is locked with the Lost Mode screen. The person holding it cannot get to Settings, apps, or managed data.

One important note: the Lost Mode message and phone number are configured when initiating Lost Mode. After the command has been initiated and enabled, the exact message text may not be viewable or editable from the portal; it can only be seen on the device screen itself.

Best Regards,
Isabel Lora
Hexnode UEM