Apple Account SSO Gotcha's!

[RNHurt]

We recently enabled SSO with Apple Business Manager (ABM) and there were a couple of hiccups that I didn't expect.  To be clear, the issues outlined here are with ABM, not JumpCloud.  Apple needs to do better.

1. You have to capture your domain before you can enable SSO.  Once you trigger this in ABM your users will receive a (scary) message from Apple explaining that they have to convert their existing personal Apple Account to a business one in 30 days or Apple will change the email address associated with the account.  This caused quite a bit of confusion among my users and was not very well received.

2. Enabling SSO with ABM converts all your users to "managed" accounts which restricts them in certain ways.  The restriction that most affected us is the inability to access the Apple App Store.  Our users can no longer install applications on their work Apple devices (MacBook, iPad, iPhone, etc.)  You have to install everything from the MDM.  I can sort-of understand Apple's reason for this but I do wish there was a configuration to let users manage their own apps in ABM.

The suggested workaround to this issue is to create a "Self Service portal" in the MDM to provide a custom "App Store".  This alternative App Store is stocked with apps that are purchased and managed by your company.  JumpCloud doesn't have this capability (yet?) but other MDM solutions do (ie JAMF).

[NVergin]

One of the other big limitations is that managed apple accounts cannot be use with TestFlight. This is the single biggest reason that we are unable to enable managed Apple IDs as we use TestFlight for internal app testing.

Why Apple hasn't figured out some workaround for this is beyond me but it has to do with the inability for the managed accounts to access the app store. It would instead require pushing pushing the test app via MDM or another method.