Create Managed Apple IDs in Apple School Manager

Recommended Managed Apple ID structure

A Managed Apple ID should be different from a user’s personal or work email address to help avoid confusion and possible conflicts with an existing Apple ID. Managed Apple IDs also can’t be more than 128 characters.

• A unique user name to the left of the at sign (@).

  You can use information from the user’s Student Information System (SIS) account, such as an email address or other account name, as the unique user name. You can also create a unique user name from their names, initials, or ID numbers. If two users end up with the same user name, Apple School Manager will add a number to differentiate them.

  For example, scottmiller1@ would be the unique user name.

• Text immediately to the right of the @ sign.

  Apple recommends using “appleid.” as the text for all accounts.

  For example, scottmiller1@appleid. would be the beginning of the full Managed Apple ID.

• The domain of your school.

  For example, a fully complete Managed Apple ID would be scottmiller1@appleid.myschool.edu.

  Important: This should be your institution’s registered domain name. Don’t use a domain name you created because this can cause all created Managed Apple IDs to fail.

Be sure you use the same formula for all Managed Apple IDs in your institution.

Create Managed Apple IDs from existing email addresses

Managed Apple IDs don’t have to be the same as user email addresses. If everybody in your institution has an email address and those addresses have never been used for the Device Enrollment Program, Volume Purchase Program, or personal iTunes or iCloud accounts, then you can choose to create Managed Apple IDs using those email addresses.

Managed Apple IDs, roles, and passwords

When you create each account, you assign a role that defines the privileges for that account. If you’re importing from your Student Information System (SIS), the individual doing the import automatically assigns roles.

You can define password policies for each account, and it’s easiest to assign them per role. Student role accounts can have a simpler four- or six-digit passcode. Instructor, Staff, Manager, and Administrator accounts must have strong passwords consisting of at least eight characters.

Managed Apple ID password complexity

When you add users to Apple School Manager, you set a password complexity for that user. That complexity level dictates which Lock screen appears when a user signs in with Shared iPad. A four- or six-digit passcode shows only digits on the screen. A complex password shows the full keyboard. When the user signs in with their Managed Apple ID and their initial password, they are prompted to change their password using the level of complexity you initially set in Apple School Manager.

If you add Profile Manager as one of your mobile device management (MDM) servers to Apple School Manager, you have the option of merging any users in Apple School Manager to Profile Manager. When you do this, those users appear in the Profile Manager users list. After they appear, you can view their Managed Apple ID password type in the About tab. See Merge Apple School Manager accounts in the macOS Server User Guide.

Inspect Managed Apple IDs

Institutions can comply with legal and privacy regulations by using Managed Apple ID inspection. Administrator, manager, and instructor accounts can be granted inspection privileges for specific accounts. Inspectors can monitor only accounts that are below them in the school’s hierarchy. For example, instructors can monitor students, and administrators can inspect managers, instructors, and students.

To inspect an account, an authorized user must create special inspection credentials within Apple School Manager for a specific Managed Apple ID. These credentials can be used only to access that Managed Apple ID, and they expire after 7 days. During that period, the inspector can access the user’s content stored in iCloud Drive or in CloudKit-enabled apps. Every request for access is logged in Apple School Manager. Logs show the inspector’s name, the Managed Apple ID in question, the time of the request, and whether or not the inspection was performed. All users with inspection privileges can search these logs, which discourages misuse of inspections.

See: Inspect a user account in Apple School Manager.