Restrict Apple ID on managed devices.

[TomDeBaere]

Hello all,

I know there have been a couple of topics around this already but I can't seem to find a solid solution for this. We are a university and have both user assigned and public apple computers and laptops. I would like todo one of the following:

1. Prevent users from login into their personal apple ID's and lock the devices to only use our ITS apple ID (make sure they can not log out of it).

2. Simply block the ability to sign into any apple ID.

3. Force sign out users already signed into their personal apple ID's.

I have tried to set this up using a configuration profile under Restrictions > Preferences but this does not work (once the profile is applied the section is still visible). I also don't like the restrictions method as this includes many other options I don't want to use (in Applications, Widgets, Media, ect).

We are using Jamf PRO and Apple School Manager.

Thanks!

[AJPinto]

1. Prevent users from login into their personal apple ID's and lock the devices to only use our ITS apple ID (make sure they can not log out of it): You cannot limit the AppleID domain used to login. AppleID's are either totally blocked or you allow anything, this is a limitation on Apples side, and I very strongly recommend that you submit Feedback on this limitation. Product Feedback - Apple
2. Simply block the ability to sign into any apple ID: There is not a direct way to disable AppleID's, but it can be done. Restrict the AppleID Preference Pane and restrict apps that use AppleID's like Mail. This will prevent the user from logging in to an AppleID.
3. Force sign out users already signed into their personal apple ID's: You cannot force sign users out of an AppleID if they have already signed in. Another situation for Product Feedback - Apple

For your concerns with restrictions, you just check the boxes you want to check. If you only want to block Apple ID Preference Pane, then that is all you block.

[jcarr]

I agree with @AJPinto on this one.  Feedback to Apple is your best bet.  Don't assume that this request has already been made by someone else.  Use the FeedBack assistant app while signed in using the Managed Apple ID from your organization.  This tells Apple a couple of things... you are reporting this issue from an institution using Apple devices, and how many devices you have managed by your organization.  This feedback is likely more valuable than a random bug report from an individual.

Apple uses "Supervision" to establish that a device is an institutional owned device and managed by that institution's MDM.  Apple has verified that these devices are owned by the institution and has also required that the institution verifies ownership of any domains used for Managed Apple IDs.  It seems like a reasonable request to limit sign in on a "Supervised" device to Managed Apple IDs using domains verified by the same organization.

Just my $0.02.

[AJPinto]

I could not have said it better myself. I also realized I had not submitted feedback for this, and I thought I had in the past. 

I just drafted together a feedback template for anyone interested and just wants to copy paste with a few mark ups needed. Technically it's not unexpected behavior, but it is really dumb that Apple does not have a control for this already.

TITLE:
Limit domain of AppleID's able to log in to Supervised Apple devices with MDM

WHICH ARE ARE YOU SEEING ISSUES WITH?
Mobile Device Management (MDM)

WHAT TYPE OF ISSUE ARE YOU REPORTING
Inconrrect/Unexpected Behavior

INTRO:
This feedback is about a change in default behavior for macOS Sequoia that prevents our organization from using Managed Apple ID's.
SCOPE OF IMPACT:
* _____ Macs eligible (or likely) to upgrade to Sequoia;
* _____ Macs refreshed annually;
* _____ Macs across the entire organization;
* _____ computers across all operating systems.
PROBLEM: In its current implementation, there is no way to limit what Apple ID's users utilize to log in. Apple has put much effort in recent years to ensure data owned by Managed Apple ID's is manageable and accessible by the organization that manages the Apple ID. However, apple has stopped short of allowing MDM's to limit what domains are allowed when a user logs in with an AppleID or to limit users to only being able to log in with Managed Apple ID's.
 
ISSUES & CONCERNS:
1. Users are able to log in to Managed and Supervised devices with personal Apple ID's.
2. Users are able to sync organizational data to their personal Apple ID's iCloud account, using Apple services to bypass DLP controls if allowed.
3. The only "work around" is to totally prevent a user from logging in to an Apple ID.

WHY THIS MATTERS:
{some blurb about your company}. In addition to our duty to ensure organizational data is handled correctly and stored in secure locations we also have many federal regulations involving data management. As there is no way to allow Apple ID's and prevent the use of personal Apple ID's we cannot allow Apple ID's at all which limits many Apple services to our end users and offers them a diminished "Apple experience".
### Further details on why this matters###
 
Dependent Applications
1. MacOS System Settings
2. Apple Internet Accounts
3. iWork (Numbers, Pages, Keynote)
4. Messages
5. Freeform
6. BetaSeed (with macOS 13 and macOS 14)
7. Feedback.app
8. Etc.
 
REQUESTS &/OR SUGGESTIONS:
Provide a new MDM payload that facilitates management & control of Apple ID's:

- The ability to limit Personal Apple ID's from logging in to Supervised Macs.
- The ability to limit the domain of a Managed Apple ID on what is allowed to be used (ie only allowing @MyCompany.com in addition to being a Managed AppleID for the organizations that have not federated their emails yet)
- A single setting that can be configured to disable Apple ID's globally (currently you have to disable system settings > Apple ID and then restrict all the apps a user can use to log in with in addition).
-Offer MDM functionality to log an Apple ID out of one is somehow logged in.

[PaulHazelden]

I use a script to disable the Apple ID sign in pane. There are one or two ways round this where they sign in using Safari and can then get the Mac to remember the ID details, but in general it stops them from signing in. I have only had two or three students who managed to get round it, and they could not remember how they did it.
It also prevents them from signing out.

defaults write /Library/Preferences/com.apple.systempreferences.plist DisabledPreferencePanes -array-add "com.apple.preferences.AppleIDPrefPane"

it is very much a big hammer to crack a nut, but so far for me it has worked for 99% of the time. I think it covers option 2 of your list, and if you have signed in to your ID before you run the script it will also cover option 1.

[TomDeBaere]

@AJPinto Thanks for this, I have tried the point 2 Restrict the AppleID Preference Pane. This does not seem to work, the profile says the setting is applied but the panel is still there.

@PaulHazelden Thanks for this, I have tried creating a policy to apply this as a script but this does not do anything. Runnig the command natively on a machine also does not make it dissapear.

@jcarr I will indeed proceed with sending feedback to Apple.
@AJPinto Thanks for this, I will make sure to use this when sending feedback to Apple.

Would there be a way to simply lock the ability to sign out of an Apple ID (except for a administrator) if we sign in with our own institution ITS apple id?

[AJPinto]

Make sure you close and reopen system preferences, the changes don't apply until after the app closes. If it's still being slow run a sudo Jamf manage to kick jamfs framework. 

You cannot prevent someone's ability to log out of an AppleID. You either block the pane all together or not at all. You could make a smart group looking for devices with AppleID's logged in, and if one is use that as a target for a configuration profile disable the AppleID pane. Its a bit around the world but would be the closest thing I could think of to accomplish that.

[TomDeBaere]

@AJPinto No luck there. What about making sure every laptop is signed into our ITS apple ID (no matter what user logs in) and can not be tampered with? We are using Apple School manager too so.

[cdenesha]

Hello,

On the iPad side, we use a configuration profile. "Restrict Modifying account settings". This grays out the location to sign in and out of an Apple ID. It also grays out other login locations like Mail.. we are K-12 so we set the up with the students and then send out this profile.

I've not tried this on the Mac.

According to the Configuration Profile reference, this is key allowAccountModification:

If false, the system disables modification of accounts such as Apple IDs and Internet-based accounts such as Mail, Contacts, and Calendar. Available in iOS 7 and later, macOS 14 and later, and watchOS 10 and later. Requires a supervised device in iOS and watchOS.
Default: true

I hope this helps someone!

chris

[ecschul]

Devices: Look at setting: Configuration profile > restrictions > functionality > Modifying account settings.  This greys out the "sign in to your device" setting.  it can be done for computers too.  Thers is a short walkthrough video for both on youtube "How to Restrict Sign In with an Apple ID in Jamf Pro"