Managed Apple Accounts are the work identities behind account-driven User Enrollment, Shared iPad and work iCloud data on Apple devices. Federating them with Microsoft Entra ID lets users sign in with their normal work credentials instead of a separate Apple password. In this post I'll link Apple Business (Apple's current name for Apple Business Manager) to Microsoft Entra ID, turn on directory sync, handle account conflicts, and fix the failures you're most likely to meet.
Errors this guide fixes
Need admin approvalMicrosoft sign-in (consent screen)+1 more guideAADSTS50105Microsoft Entra sign-in logAADSTS53003 (BlockedByConditionalAccess)Microsoft Entra sign-in log+1 more guide
How it works#
- Apple Business connects to the global Microsoft Entra ID OpenID Connect service (
login.microsoftonline.com). National clouds aren't supported. - Entra ID authenticates the user and issues the tokens, so your MFA and certificate-based authentication apply. Apple never writes data back to Entra ID.
- Admin consent gives Apple read access through these scopes:
openid profile emailfor sign-in,Domain.Read.Allfor your verified domains,Directory.Read.Allfor users,AuditLog.Read.Allfor password changes and resets, andoffline_accessfor a refresh token so it can keep reading. - When Entra ID changes or resets a user's password, Apple ends the Managed Apple Account session and asks the user to sign in again.
- Users sign in to assigned iPhone, iPad, Mac, Apple Vision Pro and Shared iPad, and then to iCloud on the web. iCloud for Windows doesn't support Managed Apple Accounts.
Prerequisites#
- A Microsoft Entra Global Administrator for the approval step. Once the connection works, Apple lets you lower that account to Global Reader, Application Administrator or Cloud Application Administrator, or to Directory Readers plus Reports Reader. Apple describes the read access those roles give as required by Apple Business, so treat the account as a dependency: don't delete or disable it.
- An Apple Business account whose role can configure federation and connect an identity provider. Accounts with that permission can't use federated sign-in themselves; they only manage it.
- Users whose user principal name (UPN) matches the address they should use as their Managed Apple Account, because directory sync maps
userPrincipalNameto it. - A message for staff who already use the work domain for personal Apple Accounts.
Step-by-step#
1. Approve federated authentication#
- In Apple Business, go to Settings › Domains and select Get Started next to User sign-in and directory sync.
- Select Microsoft Entra ID › Continue, then Sign in with Microsoft as a Global Administrator.
- Read the agreement, select Consent on behalf of your organization, then Accept.
- Review the verified and conflicted domains, then select Done.
Watch out: From this point nobody can create a new personal Apple Account with the domain, which can affect other Apple services your users rely on. Apple's guide covers this under transferring Apple services.
2. Work through user name conflicts#
Apple checks whether personal Apple Accounts already use your domain, and you can't test until that check is complete. Admins report that the owners are asked to change the email address on those accounts within about 60 days, after which Apple renames any remaining accounts to a temporary user name and releases the address to your organization; the personal account itself stays with the user. Tell people before you start.
3. Test with one user#
- In Settings › Domains, select Federate next to the domain.
- Select Sign in to Microsoft Entra ID Portal and sign in as an ordinary user from that domain.
- Select Done twice, then sign out of Apple Business.
Note: The test also changes your default Managed Apple Account format. It only runs once the conflict check is complete and the default format has been updated.
4. Turn on sign-in#
In Settings › Domains, select Manage next to the domain and turn on Sign in with Microsoft Entra ID.
5. Turn on directory sync#
In Settings › Domains, under Directory Sync, select Set up next to the domain. Apple labels this feature Microsoft Entra Connect, but it's Apple Business reading your directory, not the Entra Connect Sync server you may run on-premises. Synced accounts are read-only in Apple Business until you disconnect; after that they become manual, editable accounts. The first sync is the slowest. Use Sync Now to pull changes immediately.
| Microsoft Entra ID | Apple Business |
|---|---|
givenName / surname | First Name / Last Name |
userPrincipalName | Managed Apple Account and email address |
department, Employee Id | Department, Person Number |
employeeOrgData.costCenter / employeeOrgData.division | Cost Center / Division |
objectId | Not shown; used to detect conflicting accounts |
What it changes for Intune#
- Account-driven User Enrollment: the user enters their work account (their UPN) in Settings › General › VPN & Device Management, and the Apple sign-in hands over to the Entra sign-in page. The same domain must also host the service discovery file. See account-driven User Enrollment with Intune.
- Conditional Access: a federated sign-in is an Entra sign-in to Apple's application, so your policies apply. A policy that targets all resources and requires a compliant device can block a personal iPhone that isn't enrolled yet.
Verify#
- In Apple Business, Settings › Domains shows sign-in turned on for the domain and directory sync set up. Synced users appear as read-only.
- In the Microsoft Entra admin center, the consent created an Apple enterprise application. The audit log has the consent entry, and the sign-in logs show pilot users signing in to that application successfully.
- On a test device, a pilot user enters their work address, gets the Entra sign-in page and MFA prompt, and finishes signing in.
Common errors and fixes#
| What you see | Cause | Fix |
|---|---|---|
Need admin approval during step 1 (or Approval required if you use the admin consent workflow) | The account isn't a Global Administrator | Approve with a Global Administrator |
| Sign-in fails during approval or the test | Wrong credentials, or the test user isn't in the domain being federated | Use an account from that domain |
| An Apple Business admin can't sign in with Entra credentials | Federation managers are excluded by design | Use a separate account for daily work |
Cannot turn on Microsoft Entra Connect Sync now. You must federate a domain to turn on Microsoft Entra Connect Sync (reported by admins) | Directory sync was attempted before federation | Finish steps 1 to 4 first |
AADSTS50105 | The Apple enterprise application requires assignment and the user isn't assigned | Assign the user's group, or turn off assignment required |
AADSTS53003 (BlockedByConditionalAccess) or AADSTS53000 | A Conditional Access policy blocks the Apple application sign-in | Find the policy in the sign-in log and adjust it (guide) |
| Directory sync stops after an admin account clean-up | The approving account was deleted, disabled or lost the roles that give Apple read access | Restore it, or approve again with a Global Administrator |
If your tenant lives in a national cloud, Apple doesn't currently support federation, so Managed Apple Accounts keep their Apple-managed passwords.
