Intro to Managed Apple Accounts

Overview

Managed Apple Accounts are specifically designed for, owned, and managed by an organization to help provide the organization’s users with iCloud services they need to work efficiently. Because a Managed Apple Account is created and owned by an organization, the organization manages access to iCloud services for the account. The organization also purchases apps and books and distributes apps and content to users and devices.

An organization can make iCloud services available to users. Some examples include:

• Collaboration with Apple apps (Keynote, Pages, Numbers)

• Notes

• Reminders

• Messages

• FaceTime

• iCloud Keychain

• Apple Wallet

Managed Apple Accounts don’t store Health data, and limit use of the Wallet app.

Find My isn’t available for a Managed Apple Account; instead, an organization uses its device management service to turn on Managed Lost Mode to locate a lost or stolen iPhone or iPad, and Remote Lock to lock a lost or stolen Mac.

Differences between a Managed Apple Account and an unmanaged Apple Account

Understanding differences between a Managed Apple Account and an unmanaged (personal) Apple Account can help you troubleshoot potential issues and determine whether users’ questions relate to their device and its use, or management by the organization’s device management service.

An unmanaged Apple Account gives users full access to iCloud services and lets them purchase apps and books directly. A Managed Apple Account doesn’t include access to all iCloud services, and the organization purchases apps and books on the user’s behalf.

The following table lists some differences between a Managed Apple Account and an unmanaged Apple Account:

For a complete list of services that are available to a Managed Apple Account, see Service access with Managed Apple Accounts in the Apple School Manager User Guide, or Service access with Managed Apple Accounts in the Apple Business User Guide.

Requirements and expected behavior

Apple School Manager and Apple Business make it easy for organizations to create and manage accounts at scale, including password management. In addition to creating accounts manually, Apple School Manager supports importing account data from a Student Information System.

For more information, see Upload Student Information System data to Apple School Manager in the Apple School Manager User Guide.

Because Apple School Manager and Apple Business integrate with your existing environment, you can sync accounts from Google Workspace, Microsoft Entra ID, or your identity provider (IdP) to automatically create Managed Apple Accounts with their organization credentials.

When an organization connects Apple School Manager or Apple Business to an IdP, password changes are handled in the IdP. When the organization creates Managed Apple Accounts manually, password changes are made in Apple School Manager or Apple Business.

A Managed Apple Account is used to enroll a device in an organization’s device management service:

• User Enrollment: Enrolls a user-owned device using account-driven User Enrollment.

• Device Enrollment: Enrolls a previously deployed organization-owned device using account-driven Device Enrollment.

Enrollment with either method begins when the user selects Sign In to Work or School Account on the device, then signs in with their Managed Apple Account. See Account-driven enrollment methods with Apple devices in Apple Platform Deployment.

After enrollment, an organization’s device management service can manage an enrolled device’s app installations, configurations, profiles, security and compliance settings, restrictions, Wi-Fi settings, email accounts, and more.

User Enrollment allows users to access an organization’s resources and data using their own devices, while maintaining the security of enterprise data by cryptographically separating managed data from the user’s data. This provides a balance of security and privacy for user-owned devices. A similar data separation mechanism exists for account-driven Device Enrollment.

Users who enroll personal devices into an organization’s device management service can unenroll at any time by signing out of their Managed Apple Account, or removing the enrollment profile. If a device is unenrolled, organizational configurations, data, and apps are removed.

A user-owned device enrolled using account-driven User Enrollment can be signed in to both an unmanaged Apple Account and a Managed Apple Account. Managed data is stored in a separate, cryptographically protected volume from user data, allowing the organization to manage and control its data. This provides a better balance of security, privacy, and user experience.

If permitted by the organization in its Apple School Manager or Apple Business, users can sign in to an unmanaged Apple Account on an organization-owned device; however, with a device management service, the organization can manage the user’s ability to use services such as Find My, Activation Lock, and iCloud Drive, as well as available features in many services and apps.

In Apple School Manager or Apple Business, an organization can allow Managed Apple Accounts on any device, managed devices only, or supervised devices only.

If permitted by the organization in its Apple School Manager or Apple Business, a user can sign in to a Managed Apple Account on a user-owned device. A device management service can manage a device enrolled using account-driven User Enrollment with app installations, configurations, profiles, security and compliance settings, restrictions, Wi-Fi settings, email accounts, and more. Apps that the organization assigns are integrated with the Managed Apple Account using encryption keys and stored in a separate, cryptographically protected volume. The device management administrator can manage services and apps for the organization, but has no visibility or control over the user’s personal data.

The user can also sign in to an unmanaged Apple Account and has full control over their iCloud services and data, like Safari bookmarks, browsing history, personal data, and Health app data. Users can use features like iCloud Photos, Messages, and Find My for personal content. The organization can’t see or manage a user’s personal data stored with their unmanaged Apple Account.

Should the device be lost or stolen, or the user leave the organization, the device management administrator can delete the organization’s data using the device management service. To learn about Managed Lost Mode, see Locate a lost device. The removal of the organization’s management, data, and apps happens in a similar way to a user unenrolling their device from management. The encryption keys securing the organization’s volume are destroyed and data is rendered cryptographically inaccessible.