- Platforms
- iOSiPadOSmacOS
- Products
- Apple BusinessEntra ID
- Result
- Users from your Microsoft Entra groups appear in Apple Business as federated Managed Apple Accounts, and leavers are deactivated
Overview
Create Managed Apple Accounts in Apple Business automatically from Microsoft Entra ID users, and deactivate them when users leave the scope.
Managed Apple Accounts (formerly Managed Apple IDs) are work accounts that your organization creates and owns in Apple Business (formerly Apple Business Manager) or Apple School Manager. They support only the features and services needed for work on iPhone, iPad and Mac, and on company-owned devices they replace personal Apple Accounts.
Managed Apple Accounts can live next to a personal Apple Account. In User Enrollment (BYOD) the user must sign in with a Managed Apple Account to finish enrollment. On Shared iPad they give users their own persistent session instead of a temporary session or guest account.
In 2021 Apple Business offered two automatic ways to create these accounts from Microsoft Entra ID (the third way is creating them manually):
- Federated authentication: the account is created the first time the user signs in with their Microsoft Entra ID account (just-in-time).
- SCIM (System for Cross-domain Identity Management): the Microsoft Entra provisioning service creates the accounts ahead of time, and also deactivates them when a user leaves the provisioning scope.
Here is a deactivated account in Apple Business after I removed the user from the provisioning group:
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Entra ID Free is enough for user provisioning; the provisioning logs need Microsoft Entra ID P1 | Entra licensing |
| Admin role | Application Administrator or Cloud Application Administrator in Microsoft Entra ID | Entra roles |
| Organisation Administrator in Apple Business, or a role with permission to set up federationSuch admins can't sign in with federated authentication themselves. | Apple roles | |
| Entra ID | One Microsoft Entra tenant per Apple Business organization, and groups of users for the scope (nested groups aren't synced) | Directory sync |
| Apple | A verified domain in Apple Business | Domains |
| Federated authentication with Microsoft Entra ID set up and tested (it creates the Apple Business Manager app in Entra) | FederationIntro |
The Apple Business Manager enterprise app in Microsoft Entra ID, created by the federated authentication setup:
Configuration
Start the connection in Apple Business, finish it in Microsoft Entra ID, then set the scope.
| Step | Console | What you set |
|---|---|---|
| 3.1 | Apple Business | SCIM connection, token and tenant URL |
| 3.2 | Entra | Automatic provisioning with the Apple token |
| 3.3 | Entra | Provisioning scope: users and groups |
Start the SCIM connection in Apple Business
Apple Business
Sign in to Apple Business as an administrator, go to Settings > Data Source (2021 menu) and select Connect next to SCIM:
Apple Business shows a secret token and the tenant URL. Copy both (I masked the token here):
Token: ******** (shown only once, copy it now)
Tenant URL: https://federation.apple.com/feeds/business/scimNote: you have only 4 days to add the token in Microsoft Entra ID. After that, you must start again.
Turn on provisioning in Microsoft Entra ID
Microsoft Entra admin center
In the Microsoft Entra admin center, go to Enterprise apps > All applications and open the Apple Business Manager app that federated authentication created:
Open the Provisioning tab and select Get started:
- Provisioning Mode: Automatic
- Tenant URL:
https://federation.apple.com/feeds/business/scim - Secret Token: the token from Apple Business
When Test Connection succeeds, Apple Business shows SCIM as Connected after about a minute:
Optionally, under Settings > Notification Email, enter a person or group that should get provisioning error emails.
Choose who is provisioned
Microsoft Entra admin center
Set the provisioning Scope:
With Sync only assigned users and groups, add users and groups under Users and groups. Only users are synced, also the users inside the groups. In my example testuser, testuser2, testuser3 and the users in two groups are provisioned:
Result
Finally, check the accounts in Apple Business and the provisioning logs in Microsoft Entra ID.
An account imported from Microsoft Entra ID with SCIM shows in Apple Business with:
- Account Status: New Account
- Authentication: Federated
- Role / Location: Staff (you can change it in Apple Business)
- Source: SCIM, Microsoft Entra ID
The Microsoft Entra provisioning logs record every operation of the provisioning service, such as the query for users in scope (testuser, testuser2, testuser3 and so on):
After the first cycle, Microsoft Entra ID runs incremental cycles about every 40 minutes (see How application provisioning works). The first cycle takes longer in large tenants:
If accounts don't sync, see Resolve identity provider OIDC or SCIM sync conflicts in the Apple Business guide.