Managed Apple Accounts: company accounts instead of personal Apple IDs

What is a Managed Apple Account?

A Managed Apple Account is an Apple account that your organisation creates and owns in Apple Business. Apple renamed the former Managed Apple IDs in 2024. Because you own the account, you decide which services it can use and which devices it can sign in to.

Employees use it for iCloud Drive, Notes, Keychain and other Apple services at work. When they leave, you deactivate it and the data stays with the company.

Why personal Apple IDs on company devices are a problem

• Company data ends up in a personal iCloud the company cannot access.
• Activation Lock is tied to a personal account, so the device can hardly be reissued without that person’s help.
• Purchased apps belong to the person, not the company.
• There is no clean way to end access and secure data when someone leaves.

Connecting Microsoft Entra ID or Google Workspace

You can create Managed Apple Accounts manually, but connecting your identity provider is more practical. According to Apple, Apple Business supports Google Workspace, Microsoft Entra ID or another identity provider, one at a time.

• Created automatically: accounts appear for your users without IT entering them one by one.
• Familiar sign-in: employees sign in with their company email and their usual password.
• Synced: account details come from the identity provider and are read-only in Apple Business.
• Maintain the connection: if it expires, sign-in and sync stop until you reconnect.

Verifying, locking and capturing your domain

Before creating Managed Apple Accounts on your domain, you verify it with a DNS record. After that, nobody else can use it for Managed Apple Accounts.

• Lock the domain: new personal Apple Accounts on your company address are no longer possible. Existing ones remain for now.
• Capture the domain: people with existing personal accounts on your domain are asked to change their email address, which frees it up for the company account.

Bring your own device (BYOD) with a company account

For personal iPhones or Macs, use account-driven User Enrollment. The employee signs in with their company account in Settings, and the device creates a separate work area. The company manages only that area and cannot see personal photos, messages or apps.

For company devices, account-driven Device Enrollment offers more control, but automated device enrollment through Apple Business remains the better route for most company-owned devices.

Offboarding: what happens when someone leaves

1. You deactivate the account in your identity provider; sync carries it over to Apple Business.
2. The person can no longer sign in with the Managed Apple Account.
3. Company devices are erased remotely; on personal devices you remove only the work area.
4. App licences from Apple Business return to the pool and can be reassigned.