When using Single-App Mode (kiosk mode) or Managed Lost Mode, if the device restarts it may become permanently locked.
This happens because iOS will not connect to Wi-Fi after reboot until the user enters their passcode. But if the device is in Single-App Mode or Managed Lost Mode when it restarts, it's impossible to enter the device's passcode, thus the device does not connect to Wi-Fi and Vexluna cannot contact it to remove the restriction.
Devices with no passcode set are not affected by this issue. We recommend that wherever practical, you do not set passcodes on devices and instead use policies to disable risky features and apps.
For example, on a kiosk-type device, you could hide all apps except your kiosk app which would allow you to safely set no passcode on the device.
The only way to gracefully recover from this situation is to use a USB-C or Lightning Ethernet adapter and connect the device to a wired network connection. However, this is only possible if you configured the Allow connecting to USB devices when locked policy. If this policy was not previously configured, then the device will not connect to a wired network while locked and in this case, the device is permanently locked out.
Recovering a Permanently Locked Device
If a device is permanently locked, then the only way to recover it is to wipe it and restore its software through DFU mode (also known as recovery mode).