rada got it right, that's exactly how it works. It installs a configuration profile with restrictions on when you want to lock the device and a configuration profile without restrictions (an empty restrictions set) when you want to unlock the device.