Auto-Lock Enforcement Bypass in Mobile Device Management

This technical report discusses the Auto-Lock Enforcement Bypass issue in Airwatch/Workspace ONE Mobile Device Management (MDM) for iOS devices, particularly focusing on iOS version 26.2. The report outlines how the intended auto-lock policies can be undermined by active browser sessions that keep the display awake, preventing devices from locking as expected. It details the observed behavior on an iPhone 11, where the auto-lock timer fails to trigger due to the browser's influence, thus increasing the risk of unauthorized access if the device is left unattended. The report emphasizes that this issue does not constitute a security breach but highlights a gap between administrator expectations and actual device behavior. It provides recommendations for mitigation strategies, including the need for continuous physical supervision during extended unlocked periods and the importance of documenting exceptions. The report also calls for coordinated disclosure to Apple and MDM vendors to address the identified vulnerabilities and improve compliance with security policies.