Apple Federated Accounts

[DalekSec]

Hi All,

 

Currently all our staff have personal AppleIDs setup with their work address (115 accounts!). I've set the sync with our Azure tenant ready for them to migrate to Federated accounts.

 

Before i hit the button giving people 60 days notice to change i have a couple questions.

 

How long is it between them changing their personal one to another address and Apple syncing with azure to pull in their federated ones?

 

Also as currently i can't do anything with the sync till i boot off the 115 accounts, how do i setup the sync? is it done on user groups or?

 

Thanks

 

Dalek

[BlueScreen]

When you hit the button the 115 accounts will receive an email asking them to update their email address and a reminder every couple of weeks until the 60 days have elapsed. If they are using their Apple IDs for work, enable the OnMicrosoft email address for their O365 account and have have them update the Apple ID to this. I do not think Apple School Manager can import 'personal' Apple IDs.

 

The account federation won't be available until the 60 days have elapsed. After that time you'll have to sign into ASM and manually enable the directory sync. It will run an initial sync (which may take 15 minutes or more to complete).

 

I believe that the sync will pull all the users from your federated source (even suspended users from Google). It should merge accounts that had been manually created in ASM (except Administrators and Site Managers). It will then create accounts for the remaining synced users. If the Apple ID was not in ASM before the directory sync then the federated Apple ID will be linked to a new account and not the one they have been using.

 

Newly created accounts are created as students (I had to manually assign staff to different roles).

 

After the directory sync has completed you can import the new Apple IDs into your MDM (again you may have to manually assign roles).

 

Federated accounts are not removed until they are removed from the federation source. After they are removed from the source they are deactivated and are marked for deletion from ASM.

If you delete an account from ASM that still exists in the federation source it will be created again during the next sync.

[DalekSec]

Thanks for the reply,

 

So just to be clear, i can't sync it till after the 60 days? How do i create new accounts in the meantime? I have 2 accounts that need creating but i can't as the domain has had the first federation stage done so can't create a personal ID with our domain! If i have to wait 60 days to make any new Apple IDs its ridiculous!

[BlueScreen]

If you sign into Apple School Manager you should be able to manually create the accounts - use the Add button at the top of the users list https://school.apple.com/#/main/users. These will behave like personal Apple IDs. After the federation has completed the accounts will merge with the federated accounts and they will be able to sign in with their Azure account (we didn't have to create any accounts during the 60 day grace period).

 

If you can't manually create the Apple IDs give Apple support a phone and they should be able to advise you (they were helpful getting one of our old Volume purchase accounts linked).

[DalekSec]

Ahh yes! Life saver thank you

[Brimstone]

If you sign into Apple School Manager you should be able to manually create the accounts - use the Add button at the top of the users list https://school.apple.com/#/main/users. These will behave like personal Apple IDs.

Any account created within ASM is a Managed Apple ID, not a Personal Apple ID and has all the rules associated with it, no access to buy Apps, no Keychain. If end users are using the same email credentials and logins for both Managed and Personal Apple ID's this can cause massive amounts of confusion and end of a complete mess.

[HereIGoAgain2601]

Does anyone know if there is a way to setup the import so that 'staff' are automatically 'staff' and the 'location' on Apple school manager is a certain school rather than just the default tenant?

[NicholasEsping]

Does anyone know if there is a way to setup the import so that 'staff' are automatically 'staff' and the 'location' on Apple school manager is a certain school rather than just the default tenant?

 

You can sync Apple School Manager with your SIS and that would identify Staff vs Students.

[Brimstone]

You can sync Apple School Manager with your SIS and that would identify Staff vs Students.

 

Not in 99% of UK schools.....

[SYNACK]

Not in 99% of UK schools.....

You can do it manually via the csv import method, not great but workable. Powershell can help tame the files into the required format with a bit of work.

[toffee_paul]

I’ve recently federated about 210 users into ASM from our Azure AD tenant and although there were two members of staff who had previously set up personal Apple IDs using their school email address / Azure username as personal Apple IDs, the sync went through really quickly. I didn’t have to wait 60 days for all the other IDs to sync over. Maybe Apple changed their procedure for this recently or I’d enabled something else in ASM for this to happen but just saying it is possible to do without having to wait.

 

Maybe there’s a threshold and only having two accounts out of 210 was under it.

[Brimstone]

I’ve recently federated about 210 users into ASM from our Azure AD tenant and although there were two members of staff who had previously set up personal Apple IDs using their school email address / Azure username as personal Apple IDs, the sync went through really quickly. I didn’t have to wait 60 days for all the other IDs to sync over. Maybe Apple changed their procedure for this recently or I’d enabled something else in ASM for this to happen but just saying it is possible to do without having to wait.

 

Maybe there’s a threshold and only having two accounts out of 210 was under it.

It’s never taken 60 days for the for the sync to take place, even when users have been using their Azure credentials for a personal Apple ID, it’s the end user who has this time limit to change the email address associated with their Apple ID.

 

‘ Once federation is configured, the Apple program will check for any conflicts with existing Apple IDs that are already using your domain. If any are found, you will have the option to reclaim these Apple IDs for use as a MAID. If you go ahead with this process, users will have 60 days to change their Apple ID before Apple will forcibly change it to a temporary value’