Stolen Device Protection is an iPhone feature that makes risky changes harder when the phone is away from familiar places. Even if a thief knows the passcode, some actions need Face ID or Touch ID, and critical account changes wait an hour. It must be turned on before the phone is lost.
The problem it addresses
A passcode is often watched over a shoulder in a bar or on a train. A thief who has the phone and the passcode can change the Apple Account password, lock the owner out and reach saved passwords. Apple built this feature to break that chain.
What it does, from Apple's page
- A biometric requirement. Certain actions need Face ID or Touch ID with no passcode fallback. Apple lists using saved passwords in Keychain, using saved payment methods in Safari, erasing all content, and turning off Lost Mode.
- A Security Delay. Critical changes need an hour long wait plus another biometric check. Examples are changing the Apple Account password, signing out of the account, changing the passcode, and turning off the feature itself.
- An always on option. You can require these measures even in familiar locations.
What you need first
Apple lists the requirements: two factor authentication for the Apple Account, a passcode with Face ID or Touch ID, Significant Locations turned on, Find My turned on, and iOS 17.3 or later. The page notes it may already be on by default.
To switch it on, go to Settings, tap Face ID and Passcode, enter the passcode, then tap Stolen Device Protection.
Why it matters at work
A work iPhone often holds a password manager, an authenticator, email and chat, and sign in sessions for source control and cloud consoles. A thief who takes over the phone's Apple Account gains a very strong foothold. The one hour delay gives the owner time to mark the phone lost, revoke sessions and change passwords from another device.
That makes it a good item in a lost phone plan. See the lost phone playbook for engineers for the steps to run in that first hour.
Where it falls short
- It does not help if the phone is unlocked when snatched.
- It is not a replacement for revoking access. Your team still has to kill sessions and tokens.
- It depends on settings the user controls, so a policy only helps if people check it.
- Location based rules can surprise people at a new home or a new office.
A short policy line
Ask every iPhone user with work access to turn it on and to keep Find My enabled. Add it to your onboarding checklist and re-check it when someone gets a new phone.
Safeguard's iOS app is for reviewing findings and approvals, so a stolen phone is one more reason to keep approvals gated and to be able to revoke access quickly from your identity provider.
Quick check
Does it stop a thief who knows my passcode?
It blocks several sensitive actions, and delays the most critical ones by an hour, when the phone is away from familiar locations. It does not stop every misuse of an unlocked phone.
Can I enable it after the phone is stolen?
No. Apple says to turn it on before the device is lost or stolen.
Sources
Last reviewed: 19 October 2026.
