Do more with Managed Apple IDs

Highlight

Managed Apple ID adds iCloud Keychain, Wallet, and Continuity support on iOS 17, iPadOS 17, and macOS 14, introduces account-driven Device Enrollment and Access Management policies, and opens custom Identity Provider integration.

Core Content

Enterprise IT administrators are constantly balancing two things: giving employees adequate productivity tools while keeping their organization’s data secure. This year’s update to Managed Apple ID makes this multiple-choice question a little easier.

Managed Apple ID is the type of Apple ID designed for business/school. Organizations create and manage these accounts through Apple Business Manager or Apple School Manager. When employees log in to their devices with Managed Apple IDs, the data belongs to the organization and there is no need to expose personal Apple IDs.

More iCloud features

(01:50) This year Managed Apple ID unlocks several features that were previously limited to personal accounts:

iCloud Keychain: Password and Passkey synchronization across devices, Face ID / Touch ID login to apps and websites
Messages, Stocks, News, Siri: data synchronized across devices
Wallet: credit cards, driver’s licenses, bus passes, keys and access cards
Continuity: Handoff, Sidecar, Instant Hotspot, Universal Clipboard, Continuity Camera

After employees log in to their Managed Apple ID in settings, they can see all available services in iCloud settings.

Account-driven Device Enrollment

(04:03) There were two ways to register devices before:

User Enrollment (BYOD): Employees log in to their work accounts on personal devices, and work data and personal data are encrypted and isolated.
Device Enrollment: The organization owns the device and registers it through the installation configuration description file, with higher management rights.

The problem with Device Enrollment is that the process is cumbersome and requires manual downloading and installation of description files. This year’s new account-driven Device Enrollment unifies the login experience:

The user clicks “Sign in to Work or School Account” in the settings
Sign in with your Managed Apple ID
The system displays remote management instructions
Complete the registration, Managed Apple ID and personal Apple ID coexist

Data remains isolated, but organizations gain near full Device Enrollment management capabilities (password policies, remote wipe, locked devices, etc.). After registration on macOS, the device becomes Supervised.

MDM developers only need to change two configurations:

Version of well-known endpoint frommdm-byodChange tomdm-adde- EnrollmentMode of Enrollment Profile fromBYODChange toADDE

Access Management

(10:59) Organizations can now control sign-in policies for Managed Apple IDs:

Any Device: Any device can log in
Managed Devices Only: Only managed devices
Supervised Devices Only: Supervised devices only, highest security level

You can also individually control Messages and FaceTime (only for contacts within your organization or completely disabled), developer tool access (Xcode, Apple Developer website), and individual iCloud services.

(12:51) MDM needs to implement newGetTokenCheck-in requests to support these policies. The device requests a JWT token from MDM when logging in to verify that the device’s management status complies with organizational policies.

Custom Identity Provider

(16:52) Previously federated authentication only supported Microsoft Azure AD and Google Workspace. Support for custom Identity Providers has been opened this year, and any standards-compliant IdP can be integrated.

Three standards need to be supported:

OpenID Connect: Federated Authentication
SCIM: directory synchronization
OpenID Shared Signals Framework: Account security events (such as password changes)

Okta has announced that it will become a supported Identity Provider later this year.

Detailed Content

(07:01) Managed Apple IDs can now be used to sign in to third-party apps that support Sign in with Apple. Use your work account for work apps, and use your personal account for personal apps. If the app uses web view authentication, click “Use a different Apple ID” to enter the Managed Apple ID.

Registration process on macOS

(07:39) macOS Sonoma has added a new “Work or School Account” login portal under System Settings > Privacy & Security > Profiles. The process is consistent with iOS/iPadOS, and returns User Enrollment or Device Enrollment according to the configuration.

GetToken implementation details

(14:53) The MessageType requested by GetToken isGetToken, TokenServiceType is set tocom.apple.maid. The response is a JWT containing the following claims:

Issuer：MDM server UUID
Issued at: token generation timestamp
Jwt identifier: random UUID, ensure one-time use
Service_type:com.apple.maid

The JWT is signed with the private key of the MDM server certificate. After the device validates the token, check whether the device management status complies with the organization’s login policy.

Core Takeaways

What to do: Add “Sign in with Apple at Work and School” support to B2B App
Why it’s worth it: Business users increasingly use Managed Apple IDs. Supporting this login method can make your app adopted by more enterprises
How to get started: Check your existing Sign in with Apple implementation to make sure the web view authentication flow supports “Use a different Apple ID”
What: Test the behavior of the App in the User Enrollment environment
Why it’s worth doing: In BYOD scenario, work data and personal data are isolated on the device. Apps that rely on certain system-level data (such as photo albums and contacts) may behave differently in an isolated environment.
How to start: Create User Enrollment on the test device through Settings > General > VPN & Device Management > Sign in to Work or School Account and verify App functionality
What to do: If you are an MDM developer, support account-driven Device Enrollment as soon as possible
Why it’s worth doing: The configuration change is small (two fields), but it greatly improves the registration experience for enterprise users. Users no longer need to manually install description files
How to start: Modify well-known endpoint returnmdm-adde, Enrollment Profile Let EnrollmentMode beADDE
What to do: Evaluate the impact of Access Management on app functionality
Why it’s worth it: Organizations may disable certain iCloud services (such as iCloud Drive, Reminders). If the app relies on these services, it needs to be gracefully degraded in the disabled state.
How to get started: Check all iCloud service calls in your code, add availability checks, and provide local alternatives if not available

Deploy passkeys at work — Passkey deployment in enterprise environments, related to iCloud Keychain support
Discover account-driven User Enrollment — Account-driven user registration basis introduced by WWDC21
What’s new in device management — Comprehensive update of device management