Configuring Access Management for Managed Apple Accounts in the Jamf Pro API

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Jamf Pro supports Get Token requests from devices when access management controls for Managed Apple Accounts are enabled in Apple Business or Apple School Manager. When configured in Jamf Pro and with Apple, access management controls can limit Managed Apple Account sign-in to managed or supervised devices only. You can use the Jamf Pro API to define a specific MDM server object to use in the Get Token response, using the v4/enrollment/access-management API endpoint. A future version of Jamf Pro will enable this capability in the Jamf Pro interface.

Key benefits of this feature include the following:
  • Ability to restrict Managed Apple Accounts access to managed or supervised devices only
  • Enhanced security control over organizational data
  • Granular management of Apple service access
  • Improved compliance with organizational security policies
Best practices for implementation:
  • Ensure all devices meet the minimum OS requirements.
  • Communicate changes to users before enabling access controls.
  • Maintain regular backups of device data during implementation.
Warning:

Enabling access management controls can impact existing device sign-ins by a Managed Apple Account. Users may be signed out if devices do not meet the specified requirements. Ensure that all requirements are met prior to enabling access management controls.

Known Issue

The following known issue should be taken into consideration before enabling access management controls in Apple Business or Apple School Manager:

[PI136113] (Third-Party Issue) Users cannot sign in to Shared iPad devices using Managed Apple Accounts when access management is configured to require managed or supervised devices.

For more information, see the following documentation from Apple:
Requirements

  • Jamf Pro 11.18.0 or later

  • An MDM server token from Apple Business or Apple School Manager configured in Automated Device Enrollment

  • macOS 14, iOS 17 or iPadOS 17 or later

Note:

On macOS, users attempting to sign in to their Managed Apple Account in the System Settings app must be using an MDM-enabled user account. This is because Get Token requests and responses between the computer and Jamf Pro occur over the user channel for MDM communications. This does not apply to macOS sign-in with a Managed Apple Account during account-driven Device Enrollment.

  1. In the Jamf Pro web app, copy the Server UUID from the desired MDM server object to be used for Get Token responses for access management. To accomplish this, do the following:
    1. Navigate to Settings > Automated Device Enrollment.
    2. View the server object record of the desired server instance. This server object must be associated with the same Apple Business or Apple School Manager tenant that the Managed Apple Accounts originate from.
      Note:

      Access management responses can only be configured for one Apple Business or Apple School Manager tenant at a time. If the MDM server object is deleted from Apple Business or Apple School Manager, future Get Token requests during sign ins will fail.

  2. Do one of the following:

    • Use the Jamf Pro API and the /v4/enrollment/access-management endpoint in your preferred manner.

    • Do the following using the documentation at https://servername/api/doc:

    1. Authenticate to get a token.
    2. Navigate to the enrollment section, and click to expand the section.
    3. Scroll down to the POST /v4/enrollment/access-management object, and click to expand it.
    4. Click Try it out.
    5. Replace the example server value for automatedDeviceEnrollmentServerUuid and replace it with the Server UUID that you copied from the Jamf Pro web app earlier.
    6. Click Execute.

      You should receive a "200" server response code.

    7. (Optional) Use the GET /v4/enrollment/access-management API endpoint to confirm the correct server UUID value was set.
  3. In Apple Business or Apple School Manager, do the following:
    1. Sign in to the Apple Business or Apple School Manager portal with a Managed Apple Account that has Administrator or People Manager privileges.
    2. Navigate to Access Management > Apple Services.
    3. Click the Allow Managed Apple Account on pull-down list, and choose the devices users can sign in to with their Managed Apple Account: Any Device (default), Managed Devices Only, or Supervised Devices Only.