Apple School Manager - Federated domain and conflicts

[CHiLL]

I have added our Entra domain into our ASM and it is reporting that there are 81 username conflicts. When I click through, it tells me that our domain is verified, there are 7 managed apple accounts and sign in with Entra is enabled. It also says that there are 81 username conflicts, with "Resolving 81 username conflicts, 46 days left", which it's said now for two weeks. It also does not tell me what usernames are conflicting and no way to force it.

 

Does anyone know how to resolve this?

[RLR]

It doens't tell you what the conflicts are. I remember reading one post that had the idea of checking your email logs to see which users received the email. If the users don't update their apple ID within the time period (60 days I believe?) then they are assigned a random apple ID so your federation will work. You just have to wait until the time period is up until it works.

[supportman]

Yeh we have 170 username conflicts, no idea why or what to do....

 

Are you following a guide from somewhere? as I would love to work out how to set this up.

[CHiLL]

It doens't tell you what the conflicts are. I remember reading one post that had the idea of checking your email logs to see which users received the email. If the users don't update their apple ID within the time period (60 days I believe?) then they are assigned a random apple ID so your federation will work. You just have to wait until the time period is up until it works.

I don't know how this would work with our old Apple accounts that were created manually. For example, our headteacher created their own Apple ID many years ago and used their school email address but they are being prompted to enter a new email address to continue using the account, however they cannot use any email address that contains our federated email domain. It was my understanding that merges where both users had the same email address would be merged, but that doesn't appear to be happening for us and it has said "46 days remaining" for over a week now. It's then my understanding that this would then mean any purchases they may have made are stuck on this non-federated account, when we'd want them to only use their federated account.

 

Yeh we have 170 username conflicts, no idea why or what to do....

 

Are you following a guide from somewhere? as I would love to work out how to set this up.

I've only been following Apple's official guide, ChatGPT, some Reddit threads and a pinch of just YOLOing it.

 

We have previously been able to call Apple's school/business support for issues in the past, however it requires an in-warranty device to log the case under...which we don't have and don't have the money to purchase another at the moment.

[RLR]

I don't know how this would work with our old Apple accounts that were created manually. For example, our headteacher created their own Apple ID many years ago and used their school email address but they are being prompted to enter a new email address to continue using the account, however they cannot use any email address that contains our federated email domain. It was my understanding that merges where both users had the same email address would be merged, but that doesn't appear to be happening for us and it has said "46 days remaining" for over a week now. It's then my understanding that this would then mean any purchases they may have made are stuck on this non-federated account, when we'd want them to only use their federated account.

 

 

I've only been following Apple's official guide, ChatGPT, some Reddit threads and a pinch of just YOLOing it.

 

We have previously been able to call Apple's school/business support for issues in the past, however it requires an in-warranty device to log the case under...which we don't have and don't have the money to purchase another at the moment.

There is no merging of accounts. The old accounts created before you federated are Consumer Apple IDs and are seen as personal accounts. You can't use an email account with the domain you are federating for the consumer Apple ID. You will have to use a different email address that has a different domain.

[bknaggs]

In my experience when you have a conflict the managed Apple ID will be whatever.1@federated domain leaving the original Apple ID being whatever@federated domain

[RLR]

Might find some extra info here:

https://support.apple.com/en-gb/guide/apple-business-manager/axme685676ac/web

 

How Apple notifies users whose Apple IDs conflict

 

Apple will identify users whose personal Apple ID contains the domain name you have registered. Those users receive a mail message and a notification telling them they must rename their personal Apple ID. If they have not renamed their personal Apple ID yet, they keep receiving notifications and mail messages, with one final mail message at 60 days. After 60 days, the user’s personal Apple ID is automatically renamed to a temporary username, and the original username is released and claimed by your organisation.

 

 

 

Whilst looking into this I did come accross their October update that seems to suggest you can transfer an account to be managed: https://support.apple.com/en-us/102771

 

Need to look into this.

 

Hmm, I'm wondering if Apple Business Manager has more features than Apple School Manager as I've found another page that suggests you can transfer stuff:

https://support.apple.com/en-mz/guide/apple-business-manager/axmd2954ada2/web

 

but this page doesn't exist in the ASM User Guide.

Edited November 25, 2024 by RLR

[Brimstone]

It is possible to send a notification to users who have a domain or username conflict in the activity section of ASM you just can't see the email address used...

 

[h=2]Get notified about federated authentication username conflicts[/h]

1. In Apple School Manager , sign in as a user that has the role of Administrator, Site Manager or People Manager.
    
   
2. Select Activity in the sidebar, then look for any activity named “X Conflicts found”, where X is the number of conflicts.
    
   
3. Select the activity, then review the domain these Apple IDs are using.
    
   
4. Select Preferences to go to the Accounts section under Preferences, then select Edit next to Domains.
    
   
5. Look for the domain with the conflicts, then select “X User Name Conflicts”, where X is the number of conflicts.
   WARNING: Be aware that sending notifications will impact all users across the domain you federate. You should speak to your IT administrator before initiating the federation process.
    
    
   
6. Select Continue, select Send Notifications, then select OK.
   A mail message is sent, and a notification to any device connected to their iCloud account, letting each user with a username conflict know they must change their personal Apple ID. The notification may be immediate or it may take some time.
    
   
7. You can view the process of sending mail messages to users with a username conflict in the Activity section of Apple School Manager but you cannot see their actual personal Apple ID.
   

[Brimstone]

I don't know how this would work with our old Apple accounts that were created manually. For example, our headteacher created their own Apple ID many years ago and used their school email address but they are being prompted to enter a new email address to continue using the account, however they cannot use any email address that contains our federated email domain. It was my understanding that merges where both users had the same email address would be merged, but that doesn't appear to be happening for us and it has said "46 days remaining" for over a week now. It's then my understanding that this would then mean any purchases they may have made are stuck on this non-federated account, when we'd want them to only use their federated account.

.

 

If the school used the "single personal Apple ID for multiple devices" which breaks all licensing rules then I'm afraid apart from one device you will have to buy those apps again.

 

The HT can still sign into the App Store using a Personal Apple ID as means of authentication with the iPad or Mac still signed in using a Managed Apple Account, they need to sign in to the App Store App under accounts.