Skip to main content

​
Platform compatibility

Intel Macs don’t support recovery lock. Primo skips them, and they show no recoveryOS protection status in compliance.

​
Prerequisites

  • Apple Silicon Macs, enrolled with the appropriate supervision level. An unsupervised Mac can’t be fully protected.
  • Fleet’s Recovery Lock password option turned off, in the Fleet console under Controls > OS settings > Passwords.
Primo manages the recovery lock password. Don’t turn on Fleet’s Recovery Lock password option for the same Macs: the two conflict. While Fleet’s option is on, Fleet blocks Primo’s command on newly enrolled Macs, and the password Fleet shows may not be the one set on the Mac.

​
Set up the control

1

Go to MDM > Controls > Add new control

Select recoveryOS protection.
2

Select targeting

No additional configuration is required. Choose which devices to apply the control to: all macOS devices, specific device groups, or a custom target.

​
How it works

Primo sends the MDM SetRecoveryLock command to each targeted Apple Silicon Mac, with a 12-character password it generates. The Mac then asks for this password before anyone can use recoveryOS. Each device gets its own password. To see it, open the device panel and click Display recoveryOS password. Primo sends its password without the current one. A Mac that already has a recovery lock password, set by another tool or another MDM, refuses Primo’s password and keeps its own. The device’s recoveryOS status then shows Protection failed. Use the password from Display recoveryOS password once the device is protected. In the Fleet console, Show Recovery Lock password only shows a password that Fleet set itself, not the one Primo set. MDM compliance reports the protection status of each targeted Apple Silicon Mac.

​
Modify or remove the control

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement but does not remove existing configurations from devices.

​
Troubleshooting

A Mac shows Protection failed
  • The Mac isn’t supervised. Check its supervision level first: an unsupervised Mac can’t be fully protected.
  • Fleet’s Recovery Lock password option is on. Fleet then refuses Primo’s command and sets its own password on newly enrolled Macs. Turn the option off in the Fleet console, under Controls > OS settings > Passwords.
  • The Mac already has a recovery lock password, set by another tool or another MDM. The Mac refuses Primo’s password while that one is in place. Contact support@getprimo.com to remove the existing lock.