Managed Apple ID Pre-work: Determining Impacted Users

[dan-snelson]

Background 

Like most organizations, we want the best — most secure — experience for our users. So, naturally, we’ve investigated leveraging Managed Apple IDs. 

While Managed Apple IDs come with some significant limitations, my personal favorite has to be: 

Allows browsing but not purchasing, paid or free in: App Store 

However, the promise of a Shared iPad is quite alluring. 

The Rub 

I also suspect “the rub” for most organizations who wish to federate their domain is Apple’s unwillingness to inform the enterprise which of the enterprise’s users will be impacted before federation is enabled: 

… but you can’t see their actual personal Apple ID. 

Get notified about federated authentication user name conflicts, Item No. 7 

Script 

The following Domain Apple IDs Jamf Pro Computer Extension Attribute will inspect the current (or previous) logged-in user’s MobileMeAccounts.plist for Apple IDs associated with domains included in the domainsToCheck array and return a semicolon-delimited list. 

Note: The presumption is that your Mac users have configured an organizationally associated Apple ID on a managed Mac; organizationally associated Apple IDs in-use on iOS / iPadOS devices won’t be caught by this net. 

[JoannaB]

Check out further articles from @dan-snelson via his Blog  

[mattjerome]

As always, great content Dan!

[GregBobbett]

Nice. Unfortunately all we have are iPads...and I'm in Jamf School. If only there was a way to capture those Apple Account names. There's no way to check if a device associated with a Jamf user is actually signed on to that same users Apple Account. Most of our student accounts are locked right after initial setup, but faculty isn't and a couple high schools chose not to lock down the accounts.

[dan-snelson]

Original Post: https://snelson.us/2023/05/managed-apple-id-pre-work-determining-impacted-users/