Microsoft has released an update for the Lync Phone Edition phones, “August 2014 Cumulative Update for Lync Phone Edition for Polycom CX500, Polycom CX600, and Polycom CX3000 (KB2988181)”: http://support.microsoft.com/kb/2988181. Aastra, HP, CX700/8540 updates are also available.
This will also change the lock behaviour on phones, as per “The lock feature does not prevent users from making calls on a Lync Phone Edition telephone”: http://support.microsoft.com/kb/2988196. Deploying the update results in a now properly locked phone with only the option to dial emergency numbers. Dialing a non-emergency number on a locked phone results in “Call unsuccessful. Cannot complete the call due to restrictions on your account.”
Locking the phone like this is not the default behavior of Lync. For this to work you need to have a client policy in place with “-DisableHandsetOnLockedMachine $True”. Emergency numbers are excempt from the lock, but they have to be defined in the location policy as E911 dial number or E911 dial mask. So even if you do not deploy E911, it still makes sense to define these numbers. You do not need to enable E911, defining the number(s) is sufficient.