Struggling to find out if this is an option, but we as a district want to only lock down AppleIDs on our devices, but the configuration profile option of setting MODIFYING ACCOUNT SETTINGS: RESTRICTED also locks us out of changing email accounts. We want to only lock the AppleID as we discovered students can still bypass it to access the app store.
Please leave feedback with your Apple SE and/or through the Feedback Assistant so hopefully this will gain traction. I have been sending this request to Apple since Managed Apple IDs came out.
In this situation I want to be able to limit iCloud to (our) Managed Apple IDs so there isn't an ability for them to sign into their personal account. We may not need to turn on the accounts restriction that way, but would have to see.
We've been asking for this as well. Currently we work around it with students by restricting account modification and pushing an OWA webclip to the iPads. it's worked so far, but OWA is a little clunky in the mobile browser.