Skip to main content
This guide applies to Apple devices
Apple Business Manager is now Apple Business. Apple School Manager is unchanged. For more information, see Introducing Apple Business and Apple Business Manager is now Apple Business.
Users often sign in to their devices with a personal Apple Account for iCloud, iMessage, Photos, and Find My. This article covers what happens to that account when the device enrolls in Iru Endpoint, and what you can control afterward.

​
What Enrollment Does to a Personal Apple Account

Enrollment installs an MDM profile that establishes a management relationship between the device and Iru Endpoint. It does not act on the Apple Account signed in to the device. Specifically, enrollment does not:
  • Sign the user out of their personal Apple Account
  • Delete, move, or grant your organization access to their iCloud data
  • Convert a personal Apple Account into a Managed Apple Account
A personal Apple Account remains the user’s own account, managed by the user. What changes after enrollment is which iCloud services the device is permitted to use, which you control through the Restrictions Library Item rather than through the account itself.
A personal Apple Account signed in on a device does not make that device BYOD. Whether a device is corporate-owned or personally owned is determined by how it was enrolled, not by which Apple Account is signed in. A corporate Mac enrolled through Automated Device Enrollment is still a supervised, corporate-owned device even if the user signs in to iCloud with a personal account. For personally owned device enrollment, see Apple BYOD Management.

​
Differences by Enrollment Method

1

Automated Device Enrollment

Devices enrolled through Apple Business or Apple School Manager are supervised. Users can still sign in with a personal Apple Account unless you restrict the relevant services, and supervision makes the full set of iCloud restrictions available to you.
2

Manual Enrollment (BYOD)

Devices enrolled through the Enrollment Portal are not supervised. Personal Apple Account use is expected on these devices, and several iCloud restrictions are unavailable because they require supervision.
For more detail on which controls each method makes available, see Apple Device Supervision.

​
Activation Lock

The most significant consequence of a personal Apple Account on a managed device is Activation Lock. When a user signs in with a personal Apple Account and enables Find My, user-based Activation Lock is enabled, also known as iCloud Activation Lock. A device in this state cannot be erased and reactivated without that user’s Apple Account password, which is a problem when you reassign or recover the device. By default, user-based Activation Lock is not allowed on supervised devices. When devices are enrolled through Automated Device Enrollment, Iru Endpoint sets the Activation Lock Allowed While Supervised MDM option to false. You can change this in the Automated Device Enrollment configuration before enrolling if you want to permit it.
On a Mac that a user set up and signed in to before enrollment, existing user-based Activation Lock remains enabled after the device enrolls. An Activation Lock bypass code cannot retroactively disable it. The user must turn Find My Mac off and then back on for the bypass code to take effect.
Preventing Activation Lock does not prevent users from signing in to Find My. For bypass codes, migration considerations, and removing Activation Lock through Apple Business, see Activation Lock.

​
Restricting iCloud Services

The Restrictions Library Item controls which iCloud services a managed device can use. These apply to whichever Apple Account is signed in, including a personal one. Commonly used settings include:
  • Disallow iCloud Drive: Disables document and app data syncing to iCloud. iPhone and iPad devices must be supervised.
  • Disallow iCloud Keychain: Disables syncing the Keychain to iCloud. iPhone and iPad devices must be supervised.
  • Disallow iCloud Desktop & Documents: Disables syncing Desktop and Documents folders to iCloud. Mac only.
  • Disallow iCloud Photo Library: Disables the iCloud Photo Library on Mac, iPhone, iPad, and Vision.
  • Disallow device backup to iCloud: Prevents backing up the device to iCloud. Requires a supervised device. iPhone, iPad, and Vision only.
  • Disallow iCloud Private Relay: Prevents the user from turning on iCloud Private Relay. Requires a supervised device. Available on Mac, iPhone, iPad, and Vision.
  • Disallow managed app data storage in iCloud: Prevents managed apps from using iCloud sync. Available on iPhone, iPad, and Vision. Not available on Mac.
Mac computers additionally support disabling individual iCloud services including Mail, Calendar, Notes, Reminders, Address Book, and Bookmarks. See the Restrictions Library Item for the full list and the OS versions each setting requires.

​
Restricting iCloud Sync After Setup Can Remove Local Files

During initial setup, macOS allows users to sync their Desktop and Documents folders with iCloud. If the Mac later enrolls in Iru Endpoint and that feature is disabled through a restriction, macOS removes the previously synced data from the Mac. Although this is alarming for users, their data still resides in their iCloud account. Tell your team before enrolling whenever you plan to disallow iCloud syncing, so they can make sure they retain access to anything critical. If users report missing local files after enrollment, check the Restrictions Library Item assigned to their Blueprint for iCloud settings.

Apple Accounts Overview

Understand personal and Managed Apple Accounts

Activation Lock

Manage user-based and device-based Activation Lock

Configure the Restrictions Library Item

Control which iCloud services managed devices can use

Apple Device Supervision

Understand which controls supervision makes available