Find My, Siri and iCloud Mail are not available on a Managed Apple Account. Plan for that before rollout.
Apple publishes the full service list, and several of the exclusions surprise people. A Managed Apple Account is owned by the organisation and reaches a deliberately narrower set of Apple services than a personal account does.
- 9 rolesDetermining what each user can access
- 4 usersMaximum with the Administrator role
- Browse onlyApp Store, iTunes Store and Apple Books
- Org ownedThe account belongs to you, not the person
Four questions that decide how much work this is.
The answers tend to come back quickly, and together they tell you whether this is a fortnight of work or a quarter.
- Do your users already have Managed Apple Accounts, or are they signing into corporate devices with personal Apple Accounts? The second answer is the common one, and it is the reason most of the difficulty in Apple estates traces back to identity rather than to devices.
- Is your identity provider already linked? Where Apple Business and Microsoft Entra ID or Google Workspace are connected, Managed Apple Accounts are created automatically for users, which removes provisioning entirely. Where it is not, that link is the first piece of work.
- How many domains and subdomains do you actually use? Domains must be individually managed and subdomains are treated as separate entities requiring distinct setup, so an organisation with several mail domains has more configuration ahead of it than one with a single domain.
- Which Apple services do people believe they will have? Find My, Siri, Home, Health, Journal, iCloud Mail and the media services are all excluded, and purchasing is browse only. Every unchecked assumption in that list is a redesign waiting to happen.
Eight things to establish before you create the first one.
The organisation owns the account
Apple describes these as accounts organisations design, own and manage specifically to increase the productivity of employees, instructors and students. That ownership is the point: the account survives the person leaving, and the organisation controls what it can reach.
Roles determine access, and one is capped
Roles determine what each user can access, across nine of them ranging from Administrator with the most privileges down to Student. The Administrator role is limited to four users, which is a hard cap and needs planning rather than discovering during onboarding.
Four ways accounts get created
Manually, through federated authentication with Google Workspace or Microsoft Entra ID, by syncing with OpenID Connect or SCIM, and in Apple School Manager by importing from a student information system or uploading CSV files. Federation is the route most organisations should be aiming for.
Federation creates accounts automatically
When Apple Business and Google Workspace, Microsoft Entra ID or your identity provider are linked, Managed Apple Accounts are created automatically for users. That removes account provisioning as a separate task and keeps the Apple identity aligned with the directory one.
What these accounts cannot reach
Health, Siri, Home, Find My, Journal and iCloud Family Sharing are not accessible. Neither are the iCloud Plus services of Private Relay, Hide My Email and Custom Email Domain, nor iCloud Mail. Media services including Apple Music, Apple TV Plus, Apple Arcade and Apple Fitness Plus are excluded too.
What works, including some people assume does not
iCloud services and Continuity across devices including Calendar, Contacts, iCloud Drive, Photos, Notes and Safari. AirDrop, Handoff, Universal Clipboard, Sidecar and iPhone Mirroring. Apple Developer Program, App Store Connect, Xcode Cloud and TestFlight. iMessage and FaceTime are on by default.
Browse, but not purchase
In the App Store, iTunes Store and Apple Books, users can browse but not purchase. Application distribution therefore has to come through your management platform and volume purchasing rather than from users buying what they need, which is a process change as much as a technical one.
Administrators decide which services are on
Administrators can modify access requirements and configure which services are available, so the default service set is a starting point rather than a fixed position. Deciding that deliberately is part of the deployment rather than something to revisit later.
No Find My, no Siri, no iCloud Mail on a Managed Apple Account.
Apple publishes the list plainly, and three of these regularly reshape a deployment once somebody reads them.
- Find My is not accessible with a Managed Apple Account. Organisations planning to rely on it for locating lost devices need their management platform lost mode instead, which is a different capability with different prerequisites and needs designing rather than assuming.
- Siri is not accessible either. In deployments where voice interaction was part of the case for the devices, particularly in accessibility or hands-free scenarios, that is a material constraint that belongs in the decision rather than in a footnote.
- iCloud Mail is not available, alongside the iCloud Plus services of Private Relay, Hide My Email and Custom Email Domain. Mail comes from your existing platform, which is usually what organisations wanted anyway, but the assumption is worth testing explicitly.
- The media services are all excluded: Apple Music, Apple TV Plus, Apple Arcade and Apple Fitness Plus. And in the App Store, iTunes Store and Apple Books, users can browse but not purchase, which makes volume purchasing through your management platform the only route for paid applications.
Four things that prevent an Apple identity project stalling.
We check the service list against your actual requirements
Find My, Siri, Home, Health, Journal, iCloud Family Sharing, iCloud Mail and the iCloud Plus services are all excluded, as are the media services. Testing which of those somebody was relying on takes an hour and prevents a design that cannot deliver what was promised.
We plan around the four Administrator limit
The Administrator role has the most privileges and is limited to four users. That is a hard cap, and it needs a deliberate decision about who holds it and what happens when one of them leaves, rather than being discovered when a fifth person needs access.
We enumerate every domain including subdomains
Domains must be individually managed and subdomains are treated as separate entities requiring distinct setup. Organisations with several mail domains or regional subdomains frequently find that out partway through, when users on one of them cannot be created.
We federate rather than create accounts by hand
Where Apple Business and your identity provider are linked, Managed Apple Accounts are created automatically for users. That turns account provisioning from an ongoing task into a property of the directory, and it keeps the Apple identity aligned as people join and change roles.
Four phases across roughly four to six weeks.
- 01Week 1
Test expectations against the service list
Which Apple services people currently rely on, and which of those a Managed Apple Account can actually reach. Find My, Siri and iCloud Mail are the three most likely to appear in an assumption somebody has not checked, and all three are excluded.
- Required Apple services listed and checked against availability
- Find My dependency identified and alternative designed
- Mail platform confirmed as external
- Application purchasing route confirmed as volume purchasing
- 02Week 2
Design the identity model
Federation with Microsoft Entra ID, Google Workspace or another identity provider, or synchronisation through OpenID Connect or SCIM. Domains handled individually, since subdomains are treated as separate entities requiring their own setup rather than inheriting.
- Federation or sync route chosen with the identity provider
- Every domain and subdomain enumerated for separate setup
- Account creation approach agreed
- Existing personal Apple account conflicts identified
- 03Week 3
Assign roles deliberately
Roles determine what each user can access, and the Administrator role is limited to four users. That cap needs a decision about who those four are and what happens when one leaves, which is a succession question rather than a technical one.
- Role model designed across the nine available roles
- The four Administrator accounts chosen with reasoning
- Federation management accounts identified separately
- Role review and succession process agreed
- 04Weeks 4 to 6
Configure services and roll out
Administrators can modify access requirements and configure which services are available, so the service set is decided rather than accepted. Then rollout with user guidance covering what the account does and does not do, which prevents the predictable questions.
- Service availability configured deliberately
- Federation enabled and account creation validated
- User guidance issued covering the exclusions
- Support runbook for account and sign-in issues
Six situations where the account model decides the outcome.
A business whose devices use personal Apple accounts
Personal accounts mean the organisation cannot control service access, cannot recover the account when somebody leaves, and cannot separate corporate data from personal. Moving to Managed Apple Accounts is the correction, and the service exclusions have to be communicated as part of it.
An organisation federating Apple identity with Entra ID
Linking Apple Business with Microsoft Entra ID creates Managed Apple Accounts automatically for users, which removes account provisioning as a separate task. For estates already running Entra as the identity source, that alignment is the main reason to do this work.
A school importing accounts from a student information system
Apple School Manager supports creating accounts by importing from student information systems or uploading CSV files, alongside federation. For institutions where the authoritative student record lives outside the directory, that import route is what makes the model workable.
A regulated firm restricting what devices can reach
Administrators can modify access requirements and configure which services are available, and several services are excluded by default anyway. That combination gives a defensible position on what a corporate Apple device can and cannot connect to.
A company relying on Find My for lost devices
Find My is not accessible with a Managed Apple Account, so recovery of a lost device has to come from the management platform rather than from the consumer feature. Organisations planning around Find My need to redesign that before deployment rather than after a device goes missing.
A team distributing paid applications
Users can browse but not purchase in the App Store, iTunes Store and Apple Books. Paid applications therefore come through volume purchasing and your management platform, which is a procurement and distribution process rather than something individuals arrange.
How UAE organisations handle Apple identity.
| Feature | Federated Managed Apple Accounts | Manually created managed accounts | Personal Apple accounts |
|---|---|---|---|
Organisation owns the account | Yes | Yes | No |
Created automatically | Yes, from the directory | No | By the user |
Aligned with directory identity | Yes | Manually | No |
Service access controlled | Yes | Yes | No |
Purchasing restricted | Browse only | Browse only | Unrestricted |
Survives the person leaving | Yes | Yes | No |
Provisioning effort | None ongoing | Per user | None, but uncontrolled |
Find My available | No | No | Yes |
Device recovery route | Management platform | Management platform | Personal Find My |
Suitable for corporate devices | Yes | Yes | No |
What a Managed Apple Account can and cannot reach.
| Service | Available to a Managed Apple Account | |
|---|---|---|
| iCloud Drive, Photos, Notes, Calendar, Contacts | Yes, with Continuity across devices on the same account | |
| AirDrop, Handoff, Universal Clipboard, Sidecar, iPhone Mirroring | Yes | |
| iMessage and FaceTime | Yes, turned on by default | |
| Document collaboration in Keynote, Pages, Numbers | Yes, plus Reminders and Notes | |
| Apple Developer Program, App Store Connect, Xcode Cloud, TestFlight | Yes | |
| Find My, Siri, Home, Health, Journal | No | |
| iCloud Mail | No | |
| iCloud Plus, Private Relay, Hide My Email, Custom Email Domain | No | |
| Apple Music, Apple TV Plus, Apple Arcade, Apple Fitness Plus | No | |
| Purchasing in App Store, iTunes Store, Apple Books | Browse only, no purchasing |
Five steps, and the first is expectation testing.
- 1
Check required services against what is available
Health, Siri, Home, Find My, Journal, iCloud Family Sharing, iCloud Mail, the iCloud Plus services and the media services are all excluded, and purchasing is browse only. Establishing which of those somebody assumed is the first and most valuable conversation.
- 2
Design the identity and domain model
Federation with Microsoft Entra ID, Google Workspace or another identity provider, or synchronisation through OpenID Connect or SCIM. Every domain enumerated separately, since subdomains are treated as distinct entities requiring their own setup rather than inheriting from a parent.
- 3
Design the role model within the cap
Roles determine what each user can access across nine of them, and the Administrator role is limited to four users. Note also that users whose role permits configuring federation cannot sign in using federated authentication, only manage the federation process.
- 4
Configure service availability deliberately
Administrators can modify access requirements and configure which services are available, so the default set is a starting point. Deciding which services are on, with a reason recorded for each, produces a position that can be explained to a security reviewer.
- 5
Enable, validate and brief users
Federation enabled and account creation validated end to end, then user guidance covering what the account does and does not do. The exclusions generate predictable questions, and answering them in advance removes most of the first week support volume.
What organisations ask about Managed Apple Accounts.
Fifteen questions worth answering first.
Service expectations
- Do we rely on Find My for lost devices?Not available on these accounts.
- Is Siri part of the use case?Also not available.
- Did anybody assume iCloud Mail?It is excluded.
- Do users need to buy applications?They can browse, not purchase.
- Are any media services expected?Music, TV, Arcade and Fitness are excluded.
Identity
- Which identity provider are we federating with?Entra ID, Google Workspace or another.
- Have we listed every domain?Subdomains need separate setup.
- Do users have personal Apple accounts on our domain?A common conflict.
- Are we syncing with OIDC or SCIM?Both are supported routes.
- Who manages federation?They cannot sign in federated.
Roles
- Who holds the Administrator role?Limited to four users.
- What happens when one leaves?Plan the succession.
- Are lower roles used appropriately?Nine are available.
- Do we review role assignment?It drifts otherwise.
- Which services will we turn on?Administrators configure this.
List the Apple services your users expect, then check them against the exclusions.
Find My, Siri, iCloud Mail and the media services are all unavailable, and purchasing is browse only. That comparison takes an hour and reshapes more Apple deployments than any other check.
Related Services
Explore more solutions that work great with this service
Activation Lock management
Keep reclaimed Apple hardware usable instead of locked.
Apple Business Migration
What replaced Apple Business Manager, and what to verify now
Apple School Manager UAE
The account layer under every school Apple deployment
Apple Platform SSO
The Mac password and the company password, finally the same one
Apple Device Management
Mac and iPhone fleets, encryption, patching and the September cycle
iPhone and iPad Management
Remove company data from a phone you do not own
macOS Management Dubai
FileVault, admin rights, updates and the Rosetta deadline
Shared iPad Deployment
One iPad, many users, sized properly