Managed Apple ID: What businesses need to know
Know everything about Managed Apple ID
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
Jun 28, 2019
8 min read
Apple’s big mid-year software event, the annual Worldwide Developers Conference typically unveils the first details on upcoming products, new operating systems and sets the stage for major hardware and software announcements. And WWDC 2019 held at the McEnery Convention Center in San Jose, was not an exception.
All the consumer features announced at WWDC 2019 were quite interesting especially the dark mode for iOS 13 and the new app store for Apple Watch. The most noteworthy features, however, aren’t just limited to consumers. The event had plenty of news for the enterprise IT too.
Apple debuted its new OS versions iOS 13, macOS 10.15 Catalina, tvOS 13, watchOS 6 along with the new iPadOS 13, the dedicated operating system for iPads now separated from iOS!
Without talking much about the consumer features, let’s dive into the enterprise features discussed in the ‘What’s new in managing Apple devices’ session of WWDC 2019.
One of the most exciting announcements during the ‘What’s new in managing Apple devices’ session of WWDC 2019 was the introduction of a new enrollment method called user enrollment built specifically for BYOD devices. Until then, Apple offered only two ways for IT to manage their devices, either the basic Device enrollment or the Automated device enrollment via Apple DEP. This new enrollment option is meant to meet the organization’s requirements to secure sensitive corporate data without compromising employee privacy.
User enrollment has three main features:
The user authenticates with the Managed Apple ID during the enrollment process after which the corporate apps and accounts will use the Managed Apple IDs iCloud account. A managed APFS volume will be created at the time of enrollment to separate work data from personal. This volume uses separate cryptographic keys which will be destroyed along with the volume once the devices are disenrolled.
Here is the list of what IT can and can’t do on a device that’s enrolled via User Enrollment.
This new enrollment mode is a step towards a better balance of concerns, maintaining user privacy while keeping corporate data protected.
Businesses can create Apple IDs for their employees giving them access to services like iCloud drive and iCloud notes. The option was previously available with Apple School Manager where the schools can create Apple IDs for their students to give them access to iCloud services. Now, Apple has extended this option for enterprises too. The Managed Apple IDs have more relevance with the advent of the user enrollment method. In user enrollment, the Managed Apple ID for business is the user’s work identity which is created by the admin from Apple Business Manager/Apple School Manager. Another important part is that the businesses can federate with Microsoft Azure Active Directory to create Managed Apple IDs in Apple Business Manager/Apple School Manager.
The custom apps feature which was formerly known as B2B apps were available only with Apple Business Manager. This allowed organizations to distribute apps to their own employees as well as in other companies. The custom apps feature is now supported in Apple School Manager as well.
Apple had already announced last year that they are making supervision and management mandatory with DEP enrollment, but it’s actually going to be enforced this time. If you are using automated device enrollment, those devices will be supervised, and MDM enrollment will be mandatory.
The single sign-on extension allows users to seamlessly log in to apps and websites using the security of Face ID and Touch ID. This will improve the user experience of authentication. The user doesn’t have to sign in repeatedly on those apps and websites that the organization wants to access frequently. Some users may not be using passwords, and so they can use single sign-on for authentication.
Apple will provide a device management documentation including a great way to highlight the changes introduced in particular OS releases and all the different platforms a particular payload is supported on. And with the same Apple ID you’ve used to sign in for ABM/ASM, you can sign in to Apple seed for IT to get all the new software releases, documentation and test plans.
Apple has depreciated some restrictions and announced support for some new payloads and restrictions. They added support for WPA3 security type for Wi-Fi payload on iOS, macOS, and tvOS including both personal and enterprise authentication. A token-based authentication for APNs was also introduced. Major updates under each of the platforms include:
There are so many other updates which are difficult to be conveyed through a single blog.
With each new update of Apple’s OS platforms, new and exciting enhancements provide improved experiences for both personal and professional use. All the announcements made in WWDC 2019 offer much-needed management capabilities and are sure to take Apple device management to the next level.