Deployment

What are Managed Apple ID's?
Like any Apple ID, Managed Apple IDs provide students and teachers with access to Apple services and the ability to personalize their devices. They’re also used to access Apple services—including iCloud, the Schoolwork app, and collaboration with iWork and Notes. And administrators and staff use them to sign in to Apple School Manager. Unlike personal Apple IDs, Managed Apple IDs are owned and managed by your school or district and are designed to meet the needs and legal requirements of education institutions—including password resets, limitations on purchasing and communications, and role-based administration. Apple School Manager makes it easy for schools to create and manage these accounts at scale. Managed Apple IDs don’t support Family Sharing.

Many states and regions have laws that require schools to protect student data and restrict the ways in which it can be used. Managed Apple IDs are designed to help K–12 schools (or equivalent) comply with student data privacy requirements. See Privacy and Security for Apple Products in Education.

Note: When you use Managed Apple IDs with iWork collaboration, that collaboration is limited to Managed Apple ID accounts within your organization. This is a default setting and can be enabled in Apple School Manager. 

Important: A user with a Managed Apple ID can lock themselves out of their account if they enter an incorrect password more than 10 times. To reset their password, the user must contact an Apple School Manager administrator, Site Manager, People Manager, or another user with password reset privileges.

How Managed Apple IDs are created

Managed Apple IDs are created after you:

• Import accounts from your Student Information System (SIS)
• Import .csv files using the Secure File Transfer Protocol (SFTP)
• Create accounts manually

Important: Keep in mind that every Managed Apple ID must be unique. It also can’t conflict with other Apple IDs that your staff, teachers, and students may already have.

Restricted services and features

Some Apple services and features are disabled for Managed Apple IDs. For example:

• App Store (allows browsing but not purchasing, paid or free)
• iTunes Store (allows browsing but not purchasing, paid or free)
• iBooks Store (allows browsing but not purchasing, paid or free)
• Messages (can be enabled for users in Apple School Manager)
• FaceTime (can be enabled for users in Apple School Manager)
• iCloud Keychain (although, keychain items are saved and restored on Shared iPad devices)
• HomeKit-connected devices
• Apple Pay
• iCloud Mail
• Find My iPhone
• Find My Mac
• Find My Friends
• iCloud Family Sharing
• The ability to lock a note

Note: Not all of these services are available in all countries or regions.

Additionally, Managed Apple IDs are prevented from enrolling in private courses created outside the user’s organization. For example, Managed Apple IDs can subscribe to any public course or public collection, and can enroll in any private course created by a Managed Apple ID within the same organization.

 Support Guide

Use Managed Apple ID's
As an administrator or manager, you use Managed Apple IDs in three main ways, with accounts, classes, and roles. A big advantage as of March 27th, 2018 Managed Apple ID users get 200gb of iCloud storage for free.
 

• Accounts: Administrators can complete a range of tasks within Apple School Manager to manage accounts. For example, you can assign roles or reset passwords for a specific set of users.
   
• Classes: A class is a collection of teacher and student accounts. Classes have at least one teacher added when the class is created. After a class is created, it’s used with your MDM solution to enable classes to appear in the Classroom app for iPad and Shared iPad, and to simplify the experience for students using Shared iPad.
   
• Roles: After a Managed Apple ID is created for a user, the administrator can then assign roles for the user.These roles include manager, teacher, staff, and student. These roles define which tasks users can perform in Apple School Manager with their Managed Apple ID.

In addition, the administrator and manager can manually add an account at any time, such as when a temporary teacher is added to your school. You can also view and edit account information, such as the user’s name, ID number, grade level, and more. Depending on your role, you can also reset a user’s Managed Apple ID password, send them a verification code so they can sign in, and deactivate or restore an account.

 Support Guide

Recommended Managed Apple ID structure

A Managed Apple ID should be different from a user’s personal or work email address to help avoid confusion and possible conflicts with an existing Apple ID.

• A unique user name to the left of the at sign (@).

You can use information from the user’s Student Information System (SIS) account, such as an email address or other account name, as the unique user name. You can also create a unique user name from their names, initials, or ID numbers. If two users end up with the same user name, Apple School Manager will add a number to differentiate them.

For example, scottmiller1@ would be the unique username.

• Text immediately to the right of the @ sign.

Apple recommends using “appleid.” as the text for all accounts.

For example, scottmiller1@appleid. would be the beginning of the full Managed Apple ID.

• The domain of your school.

For example, a fully complete Managed Apple ID would be scottmiller1@appleid.myschool.edu.

Important: This should be your organization’s registered domain name. Don’t use a domain name you created because this can cause all created Managed Apple IDs to fail.

Be sure you use the same formula for all Managed Apple IDs in your organization.

Create Managed Apple IDs from existing email addresses

Managed Apple IDs don’t have to be the same as user email addresses. If everybody in your organization has an email address and those addresses have never been used for the Device Enrollment Program, Volume Purchase Program, or personal iTunes or iCloud accounts, then you can choose to create Managed Apple IDs using those email addresses.

Important: If you choose to use existing email addresses for Managed Apple IDs, the user will have to remember two passwords—the original one that is associated with their email address, and the one associated with their Managed Apple ID.

Managed Apple IDs, roles, and passwords

When you create each account, you assign a role that defines the privileges for that account. If you’re importing from your Student Information System (SIS), the individual doing the import automatically assigns roles.

You can define password policies for each account, and it’s easiest to assign them per role. Student role accounts can have a simpler four- or six-digit passcode. Teacher, Staff, Manager, and Administrator accounts must have strong passwords consisting of at least eight characters.

Managed Apple ID password complexity

When you add users to Apple School Manager, you set a password complexity for that user. That complexity level dictates which Lock Screen appears when a user signs in with Shared iPad. A four- or six-digit passcode shows only digits on the screen. A complex password shows the full keyboard. When the user signs in with their Managed Apple ID and their initial password, they are prompted to change their password using the level of complexity you initially set in Apple School Manager.

If you add Profile Manager as one of your MDM servers to Apple School Manager, you have the option of merging any users in Apple School Manager to Profile Manager. When you do this, those users appear in the Profile Manager users list. After they appear, you can view their Managed Apple ID password type in the About tab. For more information on merging users, see Merge Apple School Manager accounts.

Important: If you set the Lock Screen behavior to a four- or six-digit passcode and the Apple School Manager setting for that user is set to a complex password, that user must manually enter their Managed Apple ID and password.

Inspect Managed Apple IDs

Organizations can comply with legal and privacy regulations by using Managed Apple ID inspection. Administrator, manager, and teacher accounts can be granted inspection privileges for specific accounts (those used on organization-owned devices that are configured for multiple users). Inspectors can monitor only accounts that are below them in the school’s hierarchy. For example, teachers can monitor students, and administrators can inspect managers, teachers, and students.

To inspect an account, an authorized user must create special inspection credentials within Apple School Manager for a specific Managed Apple ID. These credentials can be used only to access that Managed Apple ID, and they expire after 7 days. During that period, the inspector can read and modify the user’s content stored in iCloud Drive or in CloudKit-enabled apps. Every request for access is logged in Apple School Manager. Logs show the inspector’s name, the Managed Apple ID in question, the time of the request, and whether or not the inspection was performed. All users with inspection privileges can search these logs, which discourages misuse of inspections.

Create Managed Apple IDs

1. Click your name in the upper-right corner, then choose Setup Assistant.
2. Click Add next to Create Accounts and Classes in Setup Assistant.
3. Click Change Settings to view the options for the Managed Apple ID. They are:
   1. Domain: This option is everything to the right of ”@appleid.” in the Managed Apple ID.
   2. Include “appleid.” in the domain: This option prevents potential conflicts by prepending “appleid.” to the existing domain name.
4. Select your settings for each group, then click Save Format to close the format window and return to Setup Assistant.
5. Click Preview Accounts and Classes to view all the proposed Managed Apple IDs for the selected groups.
6. If the Managed Apple IDs are approved, click Create Managed Apple IDs to begin the process. You can view the progress in Setup Assistant.
7. Click Skip Setup Assistant.

You can also edit the default Managed Apple ID formats within the Settings for your Location.

 Support Guide

Edit Managed Apple ID Format

In some cases, it may be necessary to change the Managed Apple ID for several accounts or all locations. For example, if the domain name of the organization changes. Managers who have the “Create, edit, and delete Managed Apple IDs” privilege can edit the Managed Apple ID of user accounts.

After you change the Managed Apple ID, active users can sign in using their new Managed Apple ID and existing password. If the new format includes an element that’s missing or empty for that user, the user’s Managed Apple ID won’t be updated. If the new format results in a Managed Apple ID that’s already in use, a number is added to the end of the new Managed Apple ID to make it unique.

There are two options when changing Managed Apple ID formats:

• Change the Managed Apple ID format for all locations: This option changes the format for all new users. Existing users still use the original format.
   
• Change the Managed Apple ID format for users: This option changes the format for all new and existing users.

See the support guide below for more information on changing Apple ID formats for administrator accounts, single user accounts, multiple users accounts, and SIS or SFTP accounts.

 Support Guide

Using a managed Apple ID you can collaborate with other organization managed Apple ID's.
Invite others to your documents and work on them together in real time. Collaboration is built into the iWork apps and Notes on iPhone, iPad, iPod touch, Mac, and iCloud.com.

Invite Others

Collaborate

Stop Sharing