Forum Discussion

ShadyKhorshed's avatar
ShadyKhorshed
Iron Contributor
Jul 12, 2023

[New Blog Post] Managed Apple ID: Federated authentication with Apple Business Manager

Federated authentication with Apple Business Manager

 

Short Introduction:

This introduction will touch on a definition from Microsoft realm and Apple realm

Microsoft Realm: Federated authentication is used to link Apple Business Manager to an instance of Microsoft Azure Active Directory (Azure AD). As a result, users can leverage their Azure AD usernames (User Principal Name) and passwords as Managed Apple IDs. They can then use their Azure AD credentials to sign into their assigned iPad or Mac and even to iCloud on the web.

 

Apple Realm: Managed Apple IDs were specifically created to enable IT administrators to manage employee accounts within their organization. These accounts empower IT Admins to establish password policies and efficiently manage app licensing. They serve as an ideal solution, striking a balance between providing valuable and productive tools for your team while ensuring compliance with your organization’s security standards. Fortunately, Apple has streamlined this process, eliminating the need for any additional applications. Account management is conveniently conducted through the Apple portal known as Apple Business Manager (ABM). This platform allows you to effortlessly monitor all the accounts within your organization, providing the capability to manage existing accounts or generate new ones directly from your web browser.

Pros of Managed Apple ID:

  • Creates a single sign-on: Syncing Apple Business Manager with your Azure tenant, federated authentication allows Managed Apple IDs to use the corresponding Azure Active Directory username and password. This provides your employees with a single sign-on for their corporate identity, whether it is Apple or Microsoft

  • Device management simplicity: Unifying identities across Apple Business Manager and Azure Active Directory, e.g. If you deactivate an employee’s account in Active Directory, their Managed Apple ID will also be deactivated, preventing employees who no longer require access to your system from logging in.

  • BYOD devices: Managed Apple ID also enables the new User Enrollment process for BYOD devices. When a user signs in on a personal device with their Managed Apple ID, the enrollment process is automatically initiated. This ensures that all devices are synced under corporate credentials while allowing employees to maintain control over their personal data

  • Shared iPad: Another Pro for Managed Apple ID for business is Shared iPad, where this works that a user’s data is stored in the cloud until they log in on an iPad. Once they log in, that information is downloaded and cached on the device until they log out. After logging out, the data becomes inaccessible to anyone else until the user signs back in.

 

 

 

Cons of Managed Apple ID:

The following features are by default disabled:  

  • iMessage (Possibility for admin to enable it)
  • FaceTime (Possibility for admin to enable it)
  • iCloud Mail and Keychain
  • Find My
  • Apple Pay
  • Purchasing on the App Store and iBook Store


How to set up a Managed Apple ID

Prerequisites:

  • Azure Global Admin Account
  • ABM Admin Account

    • Login with Global admin account

     

    • Consent to preform the federation.

     

    • After few minutes, ‘Federate’ will show up on the domain

     

    • Sign in one more time with the Global Admin.

    With this it’s going to check that the usernames within the Tenant do not already have Apple-ID, because this step will manage all the usernames.

     

     

     

    (This process might take long time, depending on how many accounts in tenant)

     

     

     

     

     

    Incase of username Conflict:-

    • Click on the ‘User Name Conflict’

     

    • Click continue

     

    • Here we can notify the Users that they will have to relinquish their ownership and change the Apple ID within 60 days.

     

    • Click on ‘Ok’

     

     

     

     

    • Enable federation.

     

     

     

     

     

    • From the user side:- the user has the possibility to follow the instruction in the email and get the Apple ID changed.

     

    User has to go through the security questions

     

     

     

     

  • ravindersin650's avatar
    ravindersin650
    Copper Contributor
    I have a one apple managed ID which we are using for login in ABM and for admin task with full admin access. that dummy id is in Azure also. What will happen when we enable federation, what will be the impact on that?
    Second question is that do we need to do some thing in azure also for the ABM ?
    DEP is in place but we are not using managed apple ID.
    • ShadyKhorshed's avatar
      ShadyKhorshed
      Iron Contributor

      Hello ravindersin650 , 

      regarding 1st question, I would assume that your managed Apple ID is using the same Azure domain name, if that’s the case then once the federation established between ABM and AAD, your managed Apple ID will be required to change/create apple ID. (As shown in the blog) 

       

      2nd question: if you would like to manage supervised Apple devices and you have a specific use case for that, then federation is the answer. But no work will done from Azure. 

      if you found my answer helpful, please make it as best. 

      regards

      Shady Khorshed

       

    • ShadyKhorshed's avatar
      ShadyKhorshed
      Iron Contributor

      ecasillas 

      Hi there, 
      This is an interesting question. I cant confirm this, but if you look into the ABM, you'll see that fedration is established via Azure AD. 

Resources