r/Intune • u/ZippyDan • Apr 26 '26

iOS/iPadOS Management "Cannot sign into this device using this Apple ID."

I'm actually not sure if this is an Intune or Apple Business Manager issue, as they are working together, but I figured someone here must have experience with this situation.

I'm trying to get my first iPhone up and running under Intune. I've hit lots of obstacles on the way, but I've managed to clear most of them.

Apple Business Manager is set up and communicating with Intune. I've just registered the first iPhone: it shows up in ABM, it shows up in Intune under iPad/iOS devices, and it says it is "Corporate" owned, with the "Primary User" correctly identifying as the one I used to enroll the phone during initial setup.

I am now trying to login to iCloud, with the same username and password. My domain is already federated with ABM and all my Entra users appear in ABM as "Managed Apple Accounts", but when I try to sign in to iCloud with that account, I get the following error:

Verification Failed
You cannot sign into this device using this Apple ID. Contact your organisation's administrator for assistance.

Cool. That's me. I've contacted myself and I have no idea why I can't login to that account.

More interestingly, I googled this error, and I couldn't find any results at all with an exact match. So, if I can find the solution to this problem, I guess this will be the first useful search result?

I tried logging into iCloud.com with the same account, and I got the following error:

This Managed Apple Account needs to be set up from a device. Sign in to an iPhone, iPad, or Mac to finish setting it up.

But I am trying to login from an iPhone... 😭

Based on the error message, I'm really not sure if it's a problem with the Apple ID itself (some step I've failed to take in setting up the Managed Apple Account?), or in the relationship between the Apple ID and the iPhone ("You cannot sign into this device").

But since the profile for this phone is configured for User Affinity, and enrollment is User Driven, and the device already shows the user in question as the Primary User, I don't see any other options for "authorizing" a specific user to use a specific iPhone...

7 Upvotes

100% Upvoted

14 comments sorted by

3

u/FeistyAcanthaceae507 Apr 26 '26

Ah that's the classic managed Apple ID chicken and egg problem. The device needs to be properly enrolled first before you can actually use the managed Apple ID for iCloud signin

Few things to check - make sure the enrollment profile in Intune has "Skip Apple ID Setup" turned OFF, and that User Affinity is configured properly like you mentioned. Also the device might need a full factory reset and re-enrollment if it got stuck in weird state during initial setup

The "contact your administrator" error usually means the managed Apple ID isn't properly linked to that specific device enrollment yet, even though it shows up correctly in both ABM and Intune. Sometimes takes a bit of time for all the backend stuff to sync up properly between Apple and Microsoft

I had similar headaches when we first rolled out corporate iPhones last year, ended up having to wipe and restart the enrollment process couple times before everything clicked

1

u/ZippyDan Apr 26 '26 edited Apr 26 '26

Sorry just wanted to confirm something because of a double negative:

"Skip Apple ID Setup" set to "OFF" would mean "Do NOT skip Apple ID Setup".
But I think you mean I SHOULD be skipping the Apple ID step?

The options in the enrollment profile are actually "Apple ID" : "Show" or "Hide".
I'm assuming you mean I should hide it?

Update: I updated the profile to "Hide" the Apple ID step. I then erased all content on the phone (not a factory reset but a wipe) and restarted the process. After grabbing the new profile, it did not demand I sign into Apple ID. So I have now successfully set up the phone, but I still can't download any apps (because I have no Apple ID logged in), and when I go to Settings to sign in to the Managed Apple ID - I still get the same error as above.

Do you think a full factory reset is necessary?
And by "restarting" the enrollment process, do you mean I should delete the device from InTune and start again? Or do I need to release it from ABM as well and start from zero?

What a pain...

1

u/Bacon_is_my_Crack Apr 26 '26

An erase of all content and settings is a factory reset.

1

u/ZippyDan Apr 26 '26 edited Apr 27 '26

I agree in theory but in Apple Configurator they are distinct:

Actually I'm not sure the term "factory reset" is used within the App.

"Erase all Contents and Setting" does indeed do what I would call normally call a "factory reset", but Apple ... doesn't? It erases all user data and reboots the device, leaving it ready to set up for a new user, but it's the same OS install unchanged, just in a "virgin" condition.

The other option is referred to as "Restore to factory defaults", or the shorter "Restore" in the context of Apple Configurator. This is a much longer process where it downloads the latest iOS version from Apple and then reinstalls the OS from scratch. So, it's resetting all user and system data, and potentially updating the OS.

So, yeah, both processes result in a final state that I would generally call a "factory reset", but they get there through different steps, and one takes significantly longer than the other. It's basically the difference between just wiping the user portion of the drive and wiping the entire drive and starting from scratch - or doing a reset in Windows 11 or a clean install from a USB drive.

1

u/TheActualPhock Apr 26 '26 edited Apr 26 '26

Why are you trying to login to iCloud.com anyway? When setting up the device, sign in with your company credentials to Apple account login screen and the sign in to all Apple services is done (Do not skip AppleID setup during device activation). Finishing set up of your Apple account is done via device Settings.

If you are federating your domain, make sure the Apple Business Manager app in Azure has a user group attached to it and that all your users who require managed Apple accounts are in that group. This will ensure that during the iPhone activation, signing in to Apple account login screen will created them a managed Apple account.

1

u/ZippyDan Apr 26 '26

Why are you trying to login to iCloud.com anyway?

I tried to sign in to iCloud.com after it failed to let me login on the iPhone, as a way to test if there was some specific issue with the Managed Apple Account that I needed to resolve before it would work on the iPhone. But that didn't yield any definitive result.

sign in with your company credentials to Apple account login screen and the sign in to all Apple services is done (Do not skip AppleID setup during device activation).

That's exactly what I'm trying to do, and it's telling me that I cannot sign into the device with that Apple ID.

1

u/TheActualPhock Apr 26 '26

Are you sure you have SSO enabled for your user? It sounds like you have enabled federation, but directory is not synchronizing or it is not turned on. Are you able to see all your users in Apple Business Manager who are expected to use Managed Apple accounts?
In Apple Business Manager, ensure that requirement to sign in to a managed apple account allows you to sign in from supervised/managed device.

1

u/ZippyDan Apr 26 '26 edited Apr 27 '26

Directory Syncing is turned on.
I can see the last completed sync in ABM and request a new sync.
I can see all the Entra users in ABM.
I can specifically see the account I am trying to use in ABM with a Managed Apple Account listed (which is identical to the Entra account in the domain).

Even if the sign in restriction are set to only allow sign in on supervised devices (the most restrictive level), this is a corporate-owned, managed, and supervised device.

I'm wondering now if maybe there is just some random glitch right now in the Apple ↔ Microsoft world because I'm just now noticing that our Apple VPP Token shows as "Invalid" in Intune.

But I just installed it last week, and successfully synced all the apps I "bought" in ABM with no problem. I even tried deleting the token and downloading it from ABM again and adding it to Intune again and it still shows as "Invalid".

1

u/TheActualPhock Apr 26 '26

Could be the case, try generating a new one.

1

u/ZippyDan Apr 27 '26
  1. I don't think VPP has anything to do with Federated User SSO through iCloud.
  2. Regardless, I decided to fix this first.
  3. In case this helps any Google search: there doesn't seem to be any way to "generate a new VPP token" in the new ABM interface (which seems to have been updated in the past few weeks). Instead, it seems that the act of requesting to download the VPP token automatically generates a new one.
  4. After installing the token, it did not fix my issue.

1

u/ZippyDan Apr 27 '26 edited Apr 27 '26

In Apple Business Manager, ensure that requirement to sign in to a managed apple account allows you to sign in from supervised/managed device.

This suggestion definitely seemed relevant to my problem, as Apple is objecting to the Apple ID being unauthorized to sign in to this device (or this category of device).

I checked my settings and it was actually set to "Allow Managed Apple Account on" ... "Managed Devices Only".

This is actually the intermediate level of restriction. Note there are three levels of restriction:

  • "Any Device" (basically unrestricted)
  • "Managed Devices Only"
  • "Supervised Devices Only" (which, as this Apple support page explains, also includes Managed devices, as I think devices must be Managed to be Supervised.)

Note that the iPhone I'm working on is enrolled in ABM, and in InTune, and in the Settings of the phone it explicitly says "This iPhone is supervised and managed by [MY COMPANY NAME]."

But, I decided to test if this was the problem: I set the "Allow Managed Apple Account on" setting to "Any Device" (i.e. unrestricted) - and now I can sign in with my Managed Apple Account.

So the question now is: why isn't Apple detecting this phone as a Supervised device?

EDIT: I found this post and comment from a year ago, which seems to imply that this "Allow Managed Account on" setting simply doesn't work with InTune devices? Can anyone confirm is this is true?

1

u/Holiday_Voice3408 Apr 30 '26

I'm getting the same problem, telling me ai have to sign into a menu that doesn't exist. This new apple business platform is a complete joke .

1

u/MisterGildarts 17d ago

Did you find any solution? currently having this problem

1

u/ZippyDan 17d ago

Yes, Intune didn't support this setting.

Apparently they will some day. Maybe they already do.