Populate iCloud account on iOS devices. Lock to domain (managed Apple ID)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-19-2022 03:07 PM
We would like to open up use of iCloud on our iPadOS devices, but only want to allow users to log in with their managed iCloud account. Is there a way in Jamf Pro to either pre populate the domain and/or user and lock the user into only signing in with their managed AppleID?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-19-2022 07:49 PM
@astrugatch There is no mechanism in Apple's current MDM specification that allows you to restrict the domain used for iCloud/AppleID. That would be required before Jamf could add support for it. If your organization has a support account with Apple (guessing that since you're using Managed AppleIDs the odds are good you do) I'd suggest you open a case asking for the ability to restrict iCloud/AppleID to specific domains.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-20-2022 04:43 AM
The way you could get around it is to make sure you have the option "Apple ID and iCloud" unchecked in your PreStage Enrollment. This will prompt the user to enter their credentials when setting up the iPad. Then have a config profile push down to restrict account changes to iCloud accounts.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-21-2022 06:45 AM
Yes, this is exactly how we do it, prompt for Apple ID during setup process, and then as soon as Jamf self-service is installed, there is a profile that prevents account modification.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-21-2022 07:04 AM
How do you ensure they are in the correct account short of watching / trusting them?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-21-2022 07:08 AM
You can't unless you are either watching them or trusting them!
The way we 'report' on this, is that we manage all applications either through forced install or via self-service, but they are all managed. If you create a search or smart group of any device that has 'unmanaged' applications, these will be the users that have signed in with an unmanaged Apple ID.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-21-2022 07:10 AM
Thats rough. I definitely can't trust 6000 school children to follow instructions. I can barely trust the adults... My apple rep just gave me hope that this would be manageable in iOS 16, but i'm not putting all my faith in that...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-21-2022 07:13 AM
Yes I hear you!
We basically create a step by step guide that classroom staff followed in order to provision devices, i.e which wifi to connect to, log in here, log in there with your school credentials, and then reported on anyone that didn't do it properly. But the most important thing we stated was that deployment is not an IT responsibility, it is the school responsibility, so here are the instructions!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-21-2022 07:16 AM
Deployment is definitely on them, but when kids have stuff their not supposed to they DO come calling. (Though we are armed to put it back on them). We deployed quickly offsite during the height of the pandemic BEFORE we were able to get managed IDs and Federation set up, so this wasn't even part of the workflow at the time. We skipped aIDs entirely until now. Now I'm in the rough spot of opening the doors, but only allowing them in with an "approved" account.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 07-10-2024 08:04 AM
That is indeed the option to allow but there's something weird now which I've not seen before. If you uncheck this, during setup you are prompted. But now you NEED to enter iCloud credentials. You can't skip this during setup and enter your account later. I thought this was how it used to be....