Managed Apple IDs, Now Managed Apple Accounts: A Guide for IT Admins

A Managed Apple Account, called a Managed Apple ID until Apple renamed it, is an Apple account that your organization creates and owns, rather than the employee or student. It uses your company's own email domain, is created in Apple Business or Apple School Manager, and gives people access to work services such as iCloud for work files, Shared iPad and account-based enrollment on personal devices. Because the organization owns it, IT can reset its password, change its role and remove it when someone leaves, and some consumer services such as App Store purchases are switched off.

If you are setting up iPhones, iPads and Macs for a company or school and need to know what these accounts are, how to create them in bulk and what they cannot do, this guide covers each of those in turn.

What Is a Managed Apple Account?

A Managed Apple Account is an organization-owned account, separate from the personal Apple Account an employee uses at home. Apple describes it as a way to keep work data apart from personal data. A few points set it apart from a personal account:

• It uses a domain your organization owns and has verified in Apple Business or Apple School Manager, such as [email protected].
• Your organization creates it, assigns it a role and can reset or delete it. The user cannot move it to another organization.
• It is meant for work: Apple turns off store purchases, Family Sharing and some iCloud and media services for these accounts.

Apple now calls these accounts Managed Apple Accounts, in line with its rename of Apple IDs to Apple Accounts. Older material, including Apple's own earlier guides, says Managed Apple IDs, and many MDM consoles and support articles still do. They mean the same thing.

How Managed Apple Accounts Enhance Device Management

Managed Apple Accounts give each person a work identity on Apple devices that IT controls. That matters in three places:

• Shared iPad. Several people can use one supervised iPad, each signing in with their own Managed Apple Account and seeing their own apps and files. This is common in schools and on shift-based teams.
• Personal devices. On an employee's own iPhone or iPad, account-driven user enrollment uses the person's Managed Apple Account to enroll the device in your MDM. The user signs in with a work account instead of installing a profile by hand.
• Work services. Managed Apple Accounts can use iCloud for work documents and collaborate in Apple's own apps, with the account owned by the company rather than the employee.

For company-owned devices, enrollment itself does not depend on Managed Apple Accounts. Those devices enroll through Automated Device Enrollment in Apple Business or Apple School Manager. See Apple DEP for how that works.

How to Create Managed Apple Accounts

Apple Business and Apple School Manager support several ways to create the accounts. Pick the one that matches how you already manage users:

Before any of these, verify your email domain in Apple Business or Apple School Manager. Each subdomain is added separately, so if you use accounts.example.com as well as example.com, verify both. Federation and sync save the most work, because new hires get an account and leavers lose theirs as the directory changes. See user provisioning for the wider process.

The Role of MDM Solutions in Apple Account Management

Apple Business or Apple School Manager creates the accounts. The MDM uses them. In practice, the MDM:

• Sets up Shared iPad on supervised iPads, so users can sign in with their Managed Apple Accounts.
• Supports account-driven user enrollment, so employees can enroll personal iPhones and iPads by signing in with their Managed Apple Account.
• Assigns apps bought in volume to devices or users, including users identified by their Managed Apple Account.
• Applies the settings, restrictions and apps that make a device ready for work.

Your MDM does not create Managed Apple Accounts. Keep the account work in Apple Business or Apple School Manager, ideally fed by your directory, and let the MDM handle devices. On a personal device enrolled this way, the MDM manages the work account and the apps IT installs. It cannot see personal photos, messages or browsing.

Understanding Managed Apple ID Limitations and Restrictions

Because the organization owns these accounts, Apple switches off some services that only make sense for a personal account. The main limits to know about:

• No store purchases. Users can browse the App Store, iTunes Store and Apple Books, but cannot buy paid or free apps and content. Apps and books reach users through Managed Distribution, with licences your organization buys in Apple Business or Apple School Manager.
• No Family Sharing or iCloud+ extras. iCloud Family Sharing, Private Relay, Hide My Email and custom email domains are not available.
• No iCloud Mail. Use your company's own email service instead.
• Find My does not work. The app appears but cannot be used. Locating a company device is done through your MDM.
• No media subscriptions. Apple Music, Apple TV+, Apple Arcade, Apple News+, Apple Fitness+ and Apple One are not available.
• Home and Siri are limited. HomeKit devices cannot be added, and Siri and Health data are not shared across devices signed in with the same account.
• Some features need newer software. Apple notes that some features need iOS 17, iPadOS 17, macOS 14 or later.
• Your domain only. The account must use a domain your organization has verified. A user cannot turn a personal Apple Account into a Managed Apple Account.

These limits are by design. If someone needs a consumer service for work, decide whether it belongs on a company device at all, or should stay on their personal account.

Managed Apple IDs for Business

For a company, the usual setup is simple: verify your domain in Apple Business, federate or sync with Entra ID or Google Workspace, and let accounts appear as people join. Give admins and managers roles in Apple Business that match their jobs, and keep at least two administrators so the account is never locked to one person. Use Managed Apple Accounts for Shared iPad and for personal devices that need work access. Company iPhones, iPads and Macs enroll through Automated Device Enrollment, which does not need a Managed Apple Account on the device. For the portal itself, see Apple Business Manager, now Apple Business, and for schools, Apple School Manager.

Managing this across many devices

trio.so connects to Apple Business and Apple School Manager, so company iPhones, iPads and Macs enroll themselves on first start-up with your settings and apps. Choosing Apple School Manager in trio.so's Apple setup brings in Managed Apple Accounts, classes and Shared iPad sign-in. Users and groups can sync into trio.so from Microsoft Entra ID, Google Workspace and Okta. On personal iPhones and iPads, IT cannot erase, lock or locate the device and sees only the work apps it installed. Plans start at $5 per device.

In trio.so's Apple setup, choosing Apple School Manager brings in Managed Apple Accounts, classes and Shared iPad.

Frequently Asked Questions

What is a Managed Apple Account?

An Apple account that an organization creates and owns for an employee or student, using the organization's own email domain. It is created in Apple Business or Apple School Manager and is used for work services, Shared iPad and account-based enrollment.

Is a Managed Apple Account the same as a Managed Apple ID?

Yes. Apple now uses the name Managed Apple Accounts, in line with its rename of Apple IDs to Apple Accounts. The accounts work the same way.

How do I create Managed Apple Accounts?

Verify your domain in Apple Business or Apple School Manager, then create accounts manually, use federated sign-in with Microsoft Entra ID or Google Workspace, or sync them from your identity provider. Schools can also import them from a student information system.

What are the limitations of Managed Apple Accounts?

They cannot buy from Apple's stores, use Family Sharing, iCloud Mail, Find My or Apple's media subscriptions, and some iCloud features are off. They must use a domain your organization has verified.

Do I need Apple Business to use Managed Apple Accounts?

Yes. Companies create them in Apple Business and schools in Apple School Manager. Both are free.

Related reading: Apple Business, Apple School Manager, Apple DEP and iPad management software.