Activation Lock is a feature that prevents unauthorized use of an Apple device after it has been erased. It is enabled automatically when a user turns on Find My on their device. However, for devices that are owned or managed by an organization, there are two types of Activation Lock available: device-linked and user-linked.
Device-linked Activation Lock requires Apple School Manager, Apple Business Manager, or Apple Business Essentials and an MDM solution. It allows the MDM solution to control turning Activation Lock on and off through server-side interactions, without depending on the user's Apple ID or Find My settings. The MDM solution creates and sends a bypass code to Apple servers when it needs to lock or unlock the device.
User-linked Activation Lock requires the user to have a personal Apple ID (not a Managed Apple ID) and to turn on Find My on their device. This method allows the user to lock an organization-linked device to their personal Apple ID if the MDM solution has allowed Activation Lock. The MDM solution should request and store a bypass code from the device before allowing the user to turn on Activation Lock. This bypass code can be used to turn off Activation Lock remotely with MDM, or directly on the device, if the user is unable to authenticate with their Apple ID. References:
* Activation Lock on Apple devices - Apple Support
* Activation Lock: How Apple Admins Can Manage It - Kandji
* Disable Activation Lock on Apple devices with Intune