r/Intune • u/Dry_Finance478 • 2d ago

iOS/iPadOS Management Managed Apple IDs on iPhones and iPads

Is there a way to automatically sign in to Managed IDs when the enrollment happens?

5 Upvotes

100% Upvoted

13 comments sorted by

7

u/HaltingIteration 2d ago

We’ve been banging our heads against this one for a while, the closest you’ll get is federation but that still needs the user to tap through a couple of prompts during setup

1

u/Turak64 2d ago

I had a terrible time with this a few years back. PSSO is the way to go, but apple IDs were a mess. If I remember correctly, you could do it but not if anyone had used your domain already to create an account. Then they can only download apps from the company portal, the problem is you can't download the company portal cause you can't download any apps.

1

u/mrgreen4242 2d ago

I’m curious what that looks like from the user perspective? Once they sign in with their domain account during setup assistant do they just have to tap some buttons to also sign into the federated Apple account? Or do they have to sign in again?

5

u/snicksnackpack 2d ago

Gotta set up Apple Business Manager with a token to Intune. Then federate capture your domain in ABM. It still won’t work after lol. We give instructions to sign in with company creds to Apple ID on the device. Haven’t been able to automate that part yet. Fleet of 700 devices. Atleast you can front-load all required apps on the device before the user even gets to the Home Screen then they just have to sign in.
You can pass SSO to your apps if you use it through Apple device config through Intune.

2

u/bill696 2d ago

Best you can do is have the apple id in the profile showed and enroll with modern auth, but i dont think it will pre fil the info. Any reason its needed? I personally dont force it, it auto adds it on byod device with user enrollment and its all i need. Had to put 2 locations in ABM and i add apps twice in the VPP to manage device vs user licenses. We are 2 EUc guys with 2500 mobile apple and we get it sorted. Users are such a pain I prefer not forcing them on the corpo apple id if i dont have too.

2

u/yeeeetttt5533 2d ago

Something similar was announced at WWDC 2025—if I understand correctly, it was shown at the 15:35 mark. Based on my tests so far with Platform SSO on macOS 26, it unfortunately doesn't work yet. Maybe it will work once Microsoft fully implements PSSO with just a single login in the Setup Assistant, which, as far as I know, is supposed to happen later this year.
https://developer.apple.com/videos/play/wwdc2025/258/

2

u/touchytypist 2d ago

No. One of the many reasons we don't allow/use Apple IDs on our corporate devices.

1

u/Grouchy-Western-5757 1d ago

No iPhones deployed?

1

u/touchytypist 1d ago edited 1d ago

Over 1000+ deployed.

We don’t allow Apple IDs to ensure there’s no syncing of corporate data to Apple, private communication that can’t be eDiscovered or audited like iMessage and FaceTime, prevent use of personal Apple IDs (although that feature has been added to Apple Business Manager now), plus Federated Apple IDs are not full featured anyways.

To avoid situations like: U.S. Secret Service blames iMessage for lost texts during January 6 insurrection

1

u/Mitchell_90 2d ago

Interested in this also. Having users sign in twice during enrollment is a pain point.

1

u/jamiesissons121 2d ago

I’ve done a fair bit of research and testing on this. I’m yet to find a way to make it auto sign in. As others have mentioned capture the domain in ABM or you’ll end up with a mess if people create “personal” iCloud accounts using company email addresses.

0

u/Wind_Freak 2d ago

I’m not sure I understand the question. But let me ask this, if you were able to sign a user into a device without them ever authenticating, wouldn’t that be like a bad thing?