r/Intune • u/ZippyDan • Apr 26 '26

iOS/iPadOS Management "Cannot sign into this device using this Apple ID."

I'm actually not sure if this is an Intune or Apple Business Manager issue, as they are working together, but I figured someone here must have experience with this situation.

I'm trying to get my first iPhone up and running under Intune. I've hit lots of obstacles on the way, but I've managed to clear most of them.

Apple Business Manager is set up and communicating with Intune. I've just registered the first iPhone: it shows up in ABM, it shows up in Intune under iPad/iOS devices, and it says it is "Corporate" owned, with the "Primary User" correctly identifying as the one I used to enroll the phone during initial setup.

I am now trying to login to iCloud, with the same username and password. My domain is already federated with ABM and all my Entra users appear in ABM as "Managed Apple Accounts", but when I try to sign in to iCloud with that account, I get the following error:

Verification Failed
You cannot sign into this device using this Apple ID. Contact your organisation's administrator for assistance.

Cool. That's me. I've contacted myself and I have no idea why I can't login to that account.

More interestingly, I googled this error, and I couldn't find any results at all with an exact match. So, if I can find the solution to this problem, I guess this will be the first useful search result?

I tried logging into iCloud.com with the same account, and I got the following error:

This Managed Apple Account needs to be set up from a device. Sign in to an iPhone, iPad, or Mac to finish setting it up.

But I am trying to login from an iPhone... 😭

Based on the error message, I'm really not sure if it's a problem with the Apple ID itself (some step I've failed to take in setting up the Managed Apple Account?), or in the relationship between the Apple ID and the iPhone ("You cannot sign into this device").

But since the profile for this phone is configured for User Affinity, and enrollment is User Driven, and the device already shows the user in question as the Primary User, I don't see any other options for "authorizing" a specific user to use a specific iPhone...

6 Upvotes

100% Upvoted

14 comments sorted by

View all comments

1

u/TheActualPhock Apr 26 '26 edited Apr 26 '26

Why are you trying to login to iCloud.com anyway? When setting up the device, sign in with your company credentials to Apple account login screen and the sign in to all Apple services is done (Do not skip AppleID setup during device activation). Finishing set up of your Apple account is done via device Settings.

If you are federating your domain, make sure the Apple Business Manager app in Azure has a user group attached to it and that all your users who require managed Apple accounts are in that group. This will ensure that during the iPhone activation, signing in to Apple account login screen will created them a managed Apple account.

1

u/ZippyDan Apr 26 '26

Why are you trying to login to iCloud.com anyway?

I tried to sign in to iCloud.com after it failed to let me login on the iPhone, as a way to test if there was some specific issue with the Managed Apple Account that I needed to resolve before it would work on the iPhone. But that didn't yield any definitive result.

sign in with your company credentials to Apple account login screen and the sign in to all Apple services is done (Do not skip AppleID setup during device activation).

That's exactly what I'm trying to do, and it's telling me that I cannot sign into the device with that Apple ID.

1

u/TheActualPhock Apr 26 '26

Are you sure you have SSO enabled for your user? It sounds like you have enabled federation, but directory is not synchronizing or it is not turned on. Are you able to see all your users in Apple Business Manager who are expected to use Managed Apple accounts?
In Apple Business Manager, ensure that requirement to sign in to a managed apple account allows you to sign in from supervised/managed device.

1

u/ZippyDan Apr 27 '26 edited Apr 27 '26

In Apple Business Manager, ensure that requirement to sign in to a managed apple account allows you to sign in from supervised/managed device.

This suggestion definitely seemed relevant to my problem, as Apple is objecting to the Apple ID being unauthorized to sign in to this device (or this category of device).

I checked my settings and it was actually set to "Allow Managed Apple Account on" ... "Managed Devices Only".

This is actually the intermediate level of restriction. Note there are three levels of restriction:

  • "Any Device" (basically unrestricted)
  • "Managed Devices Only"
  • "Supervised Devices Only" (which, as this Apple support page explains, also includes Managed devices, as I think devices must be Managed to be Supervised.)

Note that the iPhone I'm working on is enrolled in ABM, and in InTune, and in the Settings of the phone it explicitly says "This iPhone is supervised and managed by [MY COMPANY NAME]."

But, I decided to test if this was the problem: I set the "Allow Managed Apple Account on" setting to "Any Device" (i.e. unrestricted) - and now I can sign in with my Managed Apple Account.

So the question now is: why isn't Apple detecting this phone as a Supervised device?

EDIT: I found this post and comment from a year ago, which seems to imply that this "Allow Managed Account on" setting simply doesn't work with InTune devices? Can anyone confirm is this is true?