How to restrict to only signing in with Managed Apple ID - Catalina

hunter990
New Contributor III

Maybe I missed it, but doing a bunch of digging, and not sure how you limit to only signing in with a Managed Apple ID to iCloud in Catalina. I have even looked at the beta version and didn't see how to restrict it. Just digging into this to see if it a viable option. I don't see Catalina only allowing me to sign in with a managed Apple ID with a system that is managed by Jamf. If this is the case, it seems like a security issue.

5 REPLIES 5

nelsoni
Contributor II

You cannot limit MacOS to only allow logins from Managed Apple IDs. This is not an option on iOS either.

hunter990
New Contributor III

And that's what's disappointing. For good security it should be able to limit this on a managed system via MDM. I'll put in a feature request with Apple but at this time i don't see Notes or the other options being available for us here. I will test handoff to see if that allows sidecar for those that do have the devices.

FYI, to make this clear. I don't want this for logging into the system. I only want this for logging into iCloud. If the system is managed that should be able to be limited via MDM.

GabeShack
Valued Contributor II

I'm also looking for a way to lock them into their Managed apple ID's once they are signed in.
When we handed out 1-2-1 devices we had each student sign into their managed apple ID, and I wish it would then lock them into not being able to switch their iCloud account to a personal one since we are using apple classroom on Macs. It looks like this is a feature in restrictions in iOS but not on the mac.

Gabe Shackney
Princeton Public Schools

Gabe Shackney
Princeton Public Schools

sdagley
Honored Contributor II

I think the only current option would be to have an EA that looks up the AppleID in use and a Smart Group to check it against your MAID domain. Membership in that group can either trigger an email when a Mac isn't in compliance or a Policy that puts up a really annoying compliance reminder on every check-in until corrected (or both).

GabeShack
Valued Contributor II

@sdagley EA attached in case anyone needs it also in this thread:

#!/bin/sh
## Get logged in user
loggedInUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}')
icloudaccount=$( defaults read /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist Accounts | grep AccountID | cut -d '"' -f 2)

if [ -z "$icloudaccount" ] 
then
    echo "<result>Null</result>"
else
    echo "<result>$icloudaccount</result>"
fi

Now to find a solution for the annoying compliance reminder. I figure something using an open /System/Library/PreferencePanes/AppleIDPrefPane.prefPane/ at each checkin until they sign into their account.
Gabe Shackney
Princeton Public Schools

Gabe Shackney
Princeton Public Schools