Customize user access to apps and services using Apple Business

You can choose what devices users can sign in to with their Managed Apple Account or their unmanaged (personal) Apple Account.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Next to “Allow Managed Apple Account on,” select one of the following:

   Option	Description
   Any device (default)	The user can sign in on any device.
   Managed devices only	The user can sign in on a device that’s managed by a device management service that supports the Get Token endpoint.
   Supervised devices only	The user can sign in on a device that’s supervised (and managed) by a device management service that supports the Get Token endpoint.

You can choose which users can sign in to organization-owned devices. This restricts only new sign-in attempts. Accounts already signed in are unaffected.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Next to “Apple Account on Organization Devices,” select one of the following:

   Option	Description
   Any Apple Account (default)	The user can sign in on any organization-owned device with their unmanaged (personal) Apple Account or their Managed Apple Account.
   Managed Apple Account Only	The user can sign in on any organization-owned device with only their Managed Apple Account.

4. Read the confirmation dialog, then confirm or cancel your selection.

You can customize any of the features below to meet the needs of your organization. By default, most iCloud features are on. Review each setting and remove access to services that fall outside your organization’s security or compliance posture.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Select iCloud, then from the top, choose what devices users can sign in to with their Managed Apple Account:

   Option	Description
   Off	The user can’t store their data in iCloud.
   Any device (default)	The user can access their iCloud data on any device.
   Managed devices only	The user can sign in on a device that’s managed by a device management service that supports the Get Token endpoint.
   Supervised devices only	The user can sign in on a device that’s supervised (and managed) by a device management service that supports the Get Token endpoint.

4. Select Collaboration, then manage the ability for users to collaborate on files created using Keynote, Pages, and Numbers, and whether to allow those files to be accepted automatically.

   Option	Description
   Anyone (default)	Users can collaborate with any other users using an Apple Account.
   Organization only	Users can collaborate with any other users using an Apple Account from the same Apple Business organization.
   Off	Users can’t share Keynote, Pages, or Numbers documents.
   Auto Accept Files	Users can automatically accept invitations to collaborate on a shared document. Shared by anyone Off (default)

5. Select iCloud from the top, then manage access to the following iCloud features:

   Option	Description
   iCloud Drive (On by default)	Users can store data in iCloud Drive.
   Passwords and Keychain (On by default)	Users can store their passwords and passkeys in iCloud Keychain.
   Access iCloud data on the web (On by default)	Users can sign in to www.icloud.com from a Mac to access their data.
   iCloud Backup (On by default)	Users can use iCloud Backup to back up their devices.

6. Select iCloud from the top, then manage access to the following apps that use iCloud:

   App name or service	Description
   Contacts	Can be shared to other devices signed in with the same Managed Apple Account.
   Freeform	Can be shared to other devices signed in with the same Managed Apple Account.
   iCloud Calendar	Can be shared to other devices signed in with the same Managed Apple Account. (Off by default)
   Image Playground history	Can be shared to other devices signed in with the same Managed Apple Account.
   Messages in iCloud	Can be shared to other devices signed in with the same Managed Apple Account. (Only if turned on.)
   News	Can be shared to other devices signed in with the same Managed Apple Account.
   Notes	Can be shared to other devices signed in with the same Managed Apple Account, but users can’t share to “Anyone with the link.”
   Phone and FaceTime	Users can use the Phone app and FaceTime app.
   Photos	Can be shared to other devices signed in with the same Managed Apple Account.
   Reminders	Can be shared to other devices signed in with the same Managed Apple Account.
   Safari	Can be shared to other devices signed in with the same Managed Apple Account.
   Siri	Siri can be used.
   Stocks	Can be shared to other devices signed in with the same Managed Apple Account.

7. Turn on access to allow storing app data in iCloud for the apps listed in the iCloud services table.

By default, users who sign in with a Managed Apple Account can access iMessage and you can allow iMessage with only other users in your organization, or anyone inside and outside of your organization.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Select Messages. If it’s turned on, select one of the following:

   • Anyone (default)

   • Organization only

By default, users who sign in with a Managed Apple Account can access FaceTime (both audio only and video) and you can allow FaceTime with only other users in your organization, or anyone inside and outside of your organization.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Select FaceTime. If it’s turned on, select one of the following:

   • Anyone (default)

   • Organization only

By default, users who sign in with a Managed Apple Account can’t access Apple Wallet. You can turn on their access so they can add employee badges, if allowed by your organization.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Select Wallet, then manage access to use Apple Wallet.

You can turn on access to allow users to sign up for the Apple Developer Program.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Select Developer, then do any of the following:

   • Turn on access to Apple Developer Program.

   • Turn on access to Xcode Cloud.

   • Turn on access to the MFi portal.

AppleSeed for IT is designed specifically for enterprise and education customers committed to testing each new version of Apple beta software in their organizations. Organizations using Apple Business can designate which account roles in their organization may participate. Participants then use their Managed Apple Account to access the program, and their feedback is associated with their organization.

By default, users who sign in with a Managed Apple Account can’t access AppleSeed for IT. You can modify that access. See Participate in beta features.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Select AppleSeed for IT, then manage user access to the website.

You can turn on access to specific privacy and security features.

1. In Apple Business, sign in with a user whose role has permissions to edit access to Apple services for Managed Apple Accounts.

   To view roles and permissions, see Intro to roles and permissions.

2. In your browser, choose Settings > Access Management > Apple Services.

3. Select Privacy & Security, then manage access to any of the following:

   Option	Description
   Data & Privacy Access (On by default)	Allow users access to request a copy of their data.
   User Account Lookup (On by default)	Allow users the ability to look up other user’s contact information. See User Account Lookup in Apple Business.
   Automatic sign-in on Apple Watch (On by default)	Allow users to pair their Apple Watch with their iPhone without having to enter a password.