Company Portal - App Deployment

[petben]

I’ve added an App to our Intune iOS company portal, assigned to a staff user group, but the user gets a message they are not allowed to install apps when they select it. So, how do we manage users Apps, allow users to install them from the portal, but not giving them freedom to install anything they like?

[robyholmes]

Did they try and install the app from the Appstore, or the Company Portal? They need to install via the Company Portal.

[petben]

They are clicking in the company portal:

 

"This Apple ID is not allowed to make purchases"

 

They are free Apps - BBC News etc.

 

I don't have any profiles connected to that iPad that would restrict App purchasing.

[Brimstone]

They are clicking in the company portal:

 

"This Apple ID is not allowed to make purchases"

 

They are free Apps - BBC News etc.

 

I don't have any profiles connected to that iPad that would restrict App purchasing.

 

If your users have a Managed Apple ID then that is the reason, a Managed Apple ID can not make purchases.

[petben]

That's a shame, I thought the whole idea of the company portal was to be able to publish Apps for users to install, so we have control of what gets installed. We already use the VPP but that tends to push Apps to whole groups rather than individual staff requests for Apps.

[petben]

I have a related Apple ID question if anyone can help?

 

I have created federated Apple ID's for staff, when I reset an iPad it (according to the configuration profile) it asks the user to sign in with 365, but then it also asks to sign into their Apple ID (and they can sign out of this in the future if they like) we tell them to enter their school Apple ID but I thought the idea was to prevent completely users entering personal Apple ID's. Is there no way to force the school Apple ID and prevent future user changes?

[Brimstone]

That's a shame, I thought the whole idea of the company portal was to be able to publish Apps for users to install, so we have control of what gets installed. We already use the VPP but that tends to push Apps to whole groups rather than individual staff requests for Apps.

You need to configure the app in the company portal “device assigned” that way users can access the download without an Apple ID

[Brimstone]

I have a related Apple ID question if anyone can help?

 

I have created federated Apple ID's for staff, when I reset an iPad it (according to the configuration profile) it asks the user to sign in with 365, but then it also asks to sign into their Apple ID (and they can sign out of this in the future if they like) we tell them to enter their school Apple ID but I thought the idea was to prevent completely users entering personal Apple ID's. Is there no way to force the school Apple ID and prevent future user changes?

The creation of Federated Managed Apple ID’s in iPadOS does not give the user a SSO experience, after logging into the iPad with their Azure AD Credentials (NOT 365) When they then open a MS application it will request their O365 credentials again, if these are the same as Azure AD. When you reset a users iPad if you have Auto enrolment then the iPad just enrols again into ASM and the MDM applies the profile.

 

There currently is no way to force a user to sign I with a Managed Apple ID or for them to sign out and sign in with a Personal Apple ID.

[petben]

Thanks, I did read this the other day and in the olden days of Airwatch there was a ‘device assigned’ checkbox, but in Intune I don’t think there is. Is it just a matter of publishing the app to a device group (rather than user group)? I thought portal apps had to be assigned to user groups….

[petben]

The creation of Federated Managed Apple ID’s in iPadOS does not give the user a SSO experience, after logging into the iPad with their Azure AD Credentials (NOT 365) When they then open a MS application it will request their O365 credentials again, if these are the same as Azure AD. When you reset a users iPad if you have Auto enrolment then the iPad just enrols again into ASM and the MDM applies the profile.

 

There currently is no way to force a user to sign I with a Managed Apple ID or for them to sign out and sign in with a Personal Apple ID.

 

To conclude, there is no way to force a user to sign in with a managed Apple ID or prevent them signing out of this and signing in with a personal Apple ID in the future?