Intro to users in Apple School Manager
Overview
User accounts in Apple School Manager can be created manually. They’re also created after you:
Upload
.csvfiles using the Secure File Transfer Protocol (SFTP)Integrate with your Student Information System (SIS)
Sync with Google Workspace
Sync with Microsoft Entra ID or your identity provider (IdP) using OpenID Connect (OIDC)
Sync with your IdP using System for Cross-domain Identity Management (SCIM)
If you’re integrated with your SIS, each user has read-only information from the source. Additional information, such as the Managed Apple Account and associated password, is added to the user information in Apple School Manager. At no time is data written back to your SIS.
Each user account may have the following information associated with it, which can be viewed in the account list or when an account is selected:
Status with the user’s image, if provided, and source
First, middle, and last name
Managed Apple Account
Roles and Locations
Authentication type
Email address, if provided
Managed Apple Account password policy
Grade level, if provided
Person Number and Person ID
When an account is copied from Google Workspace, Microsoft Entra ID, or your IdP (using SCIM) to Apple School Manager, the following user attributes can be edited:
Roles
Grade level
SIS user name
User status
A user’s status can be one of the following:
New: This user account is new, and the user hasn’t yet signed in.
Active: This user account is active, and the user has signed in at least once.
Deactivated: This user account has been deactivated, and the user is unable to use their Managed Apple Account to sign in to a device.
Locked: This user account has been locked because of too many unsuccessful sign-in attempts.
Depending on how the user account was created, you may be able to perform certain actions on that account.
When the status is “New”
Source | Actions |
|---|---|
SIS | Deactivate |
SFTP | Deactivate |
Manual | Delete |
When the status is “Active”
Source | Actions |
|---|---|
SIS | Deactivate |
SFTP | Deactivate |
Manual | Deactivate Delete |
When the status is “Deactivated”
A deactivated account is signed out of devices and can’t be signed back in. Unless the account is synced again within the next 120 days, it automatically gets removed.
Source | Actions |
|---|---|
SIS | Reactivate Delete |
SFTP | Reactivate Delete |
Manual | Reactivate Delete |
When the status is “Locked”
Source | Actions |
|---|---|
SIS | Reset Password |
SFTP | Reset Password |
Manual | Reset Password |