Skip to main content
Question

Question re: Using Federated IDs

  • July 28, 2026
  • 1 reply
  • 7 views
kristinlynch
Forum|alt.badge.img+6

Hello:

I’m looking at this document about setting up Federated IDs in ASM:

https://support.apple.com/guide/apple-school-manager/intro-to-federated-authentication-axmb19317543/web

We have about 300 students in Apple School Manager with their school email addresses and Managed Apple IDs. They look like this:

email: slynch30@students.mpslakers.com
managed: slynch30@appleid.mpslakers.com

We’re trying to set up our new students using Entra so they can use SSO. Students are currently in Entra using their email address as their UPNs.

Is this possible? How, if at all, will this affect our other 300 students in ASM?

Kristin

    1 reply

    Chubs
    Forum|alt.badge.img+26
    • Chubs
    • Jamf Heroes
    • July 28, 2026

    So here’s the issue - IF you want to federate your root domain (mpslakers.com), then you’ll need to use your userShortName@mpslakers.com.  If you want to use the subdomain (students.mpslakers.com), then federate that one - it won’t affect the parent or the other subdomain.  You’ll have options if those domains are showing in your tenant properly (which they should assuming that your forest is setup properly.  Oh, and you can use the appleid. subdomain for “personal” apple accounts at that point.

    Just keep in mind, your users are going to have to remember multiple accounts and, assuming your IdP folks can do password synchronization to the subdomain in the IdP, it may work.  We just dealt with the fallout and federated the root domain since all of our users are there for their email and login (not in a subdomain).  

    It will ONLY lock the domain targeted. FYI here’s what our structure looks like and which domain we federated:

    RootDomain (federated THIS domain)
           → apple.RootDomain.com (no federation)
           → special.RootDomain.com (no federation)
           → cloud.RootDomain.com (no federation)

    Even though we federated our root parent domain, it did NOT affect the subdomains.  So with that logic, if you federate a subdomain, it won’t affect other subdomains - just keep in mind that those accounts and password synchronizations need to be solid before going to production.

    Hopefully this was helpful.

    I find your lack of faith disturbing
    Terms & ConditionsAccessibility statement