[ipad] ASM - Verify Domain Ownership on Apple School Manager

[Koldov]

Got an email from Apple asking me to verify Domain ownership...

 

Not sure how to do this though, as I'm pretty sure we don't own them and I don't know how they were created - I think it is something ASM itself created automatically in the process of proving that we are a school...

 

Thing is I'm pretty sure we don't 'own' the Domains they are asking for verification (and to be honest I'm not entirely even sure what they're for)...

 

I think it says something about 'Managed Apple IDs' but as I don't know what that does I'm presuming we don't use them.

 

On further investigation there aren't any Domains in ASM that we do actually own as such.

 

One was used to set up VPP back in the day and is an old LEA email address Domain and the other two are versions of a Domain we do own but with 'appleid' inserted at the beginning or in the middle... not our actual Domain.

 

Finding it a bit confusing!

[aicrd]

I think they verify with TXT records IIRC, so with the ones with appleid in front simpily create a TXT record for appleid.yourdomain.com with whatever TXT value apple have given you.

 

For the LEA ones you can either remove them or ask the LEA to add the TXT for you.

[Koldov]

Thanks, but it's still confusing me... It's asking me to verify that we own '@appleid.yourdomain.com'...

 

Are they actually only asking me to verify we own 'yourdomain.com'...?

 

If so that's no problem, I can add the TXT record as suggested.

 

But there is also a similar one (which looks like it has been verified - with a green dot) although it is in the format 'yourdomaincom.appleid.com' - what is that?

 

I don't remember creating either of those - I think they were created by ASM itself... they both have the domain we own in them though, so why is only one verified?

 

As for the LEA one I would happily let that go to avoid issues in the future if we stop using it altogether, but I think it is the original one connected to the admin account on ASM (which is the Managed Apple ID we sign in with - carried over from the original VPP account) - would that have any effect on our ASM?

 

It's the bottom one in the picture (with 1 account).

 

Edited March 1, 2021 by Koldov

[DJ-1701]

@Brimstone talked about this a few days ago.

 

Apple have started emailed customers who haven’t yet verified their domains in Apple School Manager, and unless they do so they will not be able to create new Managed Apple ID’s on unverified domains from May 26th 2021.

Typically this means that two domains must be verified, if you also have a domain using @appleid.school.sch.uk for your Managed Apple ID's

 

To verify the domain(s), this is the process:

Login to Apple School Manager (ASM)

Go to Settings > Account > Domains

Click verify for your unverified domain

Add the provided TXT record to your external DNS records

Click on the 'Check Now' button to provoke a lookup for your new TXT record

 

The process will need to be repeated for each domain, more info can be found at;

 

https://support.apple.com/en-gb/guide/apple-school-manager/apd15d24426c/1/web/1

 

 

 

 

Also here is my minor comment on the subject.

 

To add to Brimstone's report there, you may find you only get 1 email from Apple stating that 1 domain (the appleid.school.sch.uk) needs to be verified, in fact in our case we found the school root domain itself was also was not verified and needed to be done.

 

You should be able to see if you have any users created with that domain by looking at the User section. I would suggest if you don't have an entry for your domain it would be worth creating one if you plan to use an account in that domain in the future.

[DJ-1701]

Yeah, just need to verify the domain you have an account on, I did both appleid.school.sch.uk and school.sch.uk though. Just in case I need to use appleid.school.sch.uk because some silly person may have registered a home account in the past using their work address or something.

[Koldov]

OK thanks, I should have searched but presumed I was just being stupid and your reply has pretty much confirmed it.... and going to make myself look even more so with the following...

 

Now, I do get the process of verifying domain ownership, I have done it for Google/Adobe/Microsoft... and I can add the TXT file on the domain we own 'yourdomain.com'.

 

But how have you verified the 'appleid' domain? That isn't actually a domain is it? Or at least not one you can confirm you own?

 

I will admit I'm not up on domains/sub-domains etc. But I didn't even create the 'appleid' domains... they did! Do they even exist anywhere outside of the Apple universe?

 

I can only presume they made it out of the actual domain that we do own when our ASM was created, as I'm pretty sure that would have been entered into one of the start-up screens because it is part of both of those 'domains' in the picture (middle one) and that was made up by Apple and the top one that is obviously unverified (orange dot).

 

What I mean is, I don't understand how to verify 'appleid.yourdomain.com' because it doesn't actually exist anywhere outside of that screen on ASM... only 'yourdomain.com' exists...

 

Just to confirm this, I added a domain txt record to our 'yourdomain.com' and went through the whole process... it has not verified yet... thinking it might take something silly like 24 hours I thought I would do a test and added in another domain we own 'yourdomain.co.uk' obviously without any 'appleid' bit and it verified straight away....?????

Edited March 1, 2021 by Koldov

[Koldov]

Just to be absolutely sure I wasn't losing my mind, I have added the domain 'yourdomain.com' into ASM and it verified immediately...

 

Therefore I'm sure 'appleid.yourdomain.com' cannot ever be verified, so why was it even created?

[Foresthippy]

Just to be absolutely sure I wasn't losing my mind, I have added the domain 'yourdomain.com' into ASM and it verified immediately...

 

Therefore I'm sure 'appleid.yourdomain.com' cannot ever be verified, so why was it even created?

 

You can add appleid as a subdomain of yourdomain.com and depending on your DNS management environment, should be able to add txt records to a subdomain too, and therefore verify it.

[Koldov]

You can add appleid as a subdomain of yourdomain.com and depending on your DNS management environment, should be able to add txt records to a subdomain too, and therefore verify it.

 

Thanks! OK, a bit clearer now...

 

So, we would need to actually create a sub-domain due to Apple 'creating' it for us in order to verify to Apple that we own something we never wanted or asked for...

 

...or just delete it from ASM...