Customize user access to certain apps and services using Apple Business Manager
You may want users who sign in with a Managed Apple Account to access many Apple apps and services. With Apple Business Manager, you can choose what devices users can sign in to and which apps and services are available to them. For example, you can turn on access to specific iCloud features, specify which app data they can store in the cloud, and turn off access to FaceTime and iMessage.
Requirements
Some features require the following:
iOS 17, iPadOS 17, macOS 14, or later.
Support from your third-party MDM solution. Consult your MDM vendor’s documentation to see whether they support these features.
Important: In case requirements for the management state of a device are changed, a Managed Apple Account is automatically signed out of a device if the device state doesn’t meet the new requirements.
Access to services using Managed Apple Accounts
Access to specific services may vary when using Managed Apple Accounts. See Service access with Managed Apple Accounts in Apple Platform Deployment.
Choose what devices users can sign in to
You can choose what devices users can sign in to with their Managed Apple Account.
Note: This feature requires iOS 17, iPadOS 17, macOS 14, or later, and support from your MDM solution.
In Apple Business Manager
, sign in with an account that has the role of Administrator or People Manager.Select Access Management
in the sidebar, then select Apple Services 
.Select “Allow Managed Apple Account on”, then select one of the following:
Any device (default): The user can sign in on any device.
Managed devices only: The user can sign in a on a device that is managed by an MDM solution which supports the new Get Token endpoint.
Supervised devices only: The user can sign in a on a device that is supervised (and managed) by an MDM solution which supports the new Get Token endpoint.
Manage iCloud features and app access
You can customize any of the features below to meet the needs of your organization. This includes deciding what devices a user can sign in with their Managed Apple Account:
Off: The user can’t store their data in iCloud.
Any device: The user can access their iCloud data on any device.
Managed devices only: The user can sign in a on a device that is managed by an MDM solution which supports the new Get Token endpoint.
Supervised devices only: The user can sign in a on a device that is supervised (and managed) by an MDM solution which supports the new Get Token endpoint.
Note: This feature requires iOS 17, iPadOS 17, macOS 14, and support from your MDM solution.
In Apple Business Manager
, sign in with an account that has the role of Administrator or People Manager.Select Access Management
in the sidebar, then select Apple Services .Select iCloud, then select what devices users can sign into with their Managed Apple Account:
Off
Any device (default)
Managed devices only
Supervised devices only
Select Collaboration, then turn on the ability for users to collaborate on files created using Keynote, Numbers, and Pages, and whether to allow those files to be accepted automatically.
Anyone (default): Users can collaborate with any other users using an Apple Account.
Organization only: Users can collaborate only with other users using a Managed Apple Account from the same Apple Business Manager organization.
Off: Users can’t share Keynote, Numbers, or Pages documents.
Auto Accept Files: Users automatically accept invitations to collaborate on a shared document.
Select iCloud from the top, then turn off access to the following iCloud features:
iCloud Drive: Users can store data in iCloud Drive.
Passcodes and Keychain: Users can store their passwords and passkeys in iCloud Keychain.
Access iCloud data on the web: Users can sign in to www.icloud.com to access their data.
iCloud Backup: Users can use iCloud Backup to back up their devices.
Turn off access to storing app data in iCloud for the apps in the table below.
App
Data sync to other devices?
Calendar
Contacts
Freeform
Messages
News
Notes
Photos
Reminders
Safari
Siri
Stocks
Manage user access to FaceTime and iMessage
By default, users who sign in with a Managed Apple Account can access FaceTime and iMessage. You can modify that access.
FaceTime: FaceTime (both audio only and video) can be turned off, allowed with only other users in your organization, or anyone inside and outside of your organization.
iMessage: iMessage can be turned off, allowed with only other users in your organization, or allowed with anyone inside and outside of your organization.
Note: If iMessage is turned off, users can still send and receive SMS/MMS messages.
In Apple Business Manager
, sign in with an account that has the role of Administrator or People Manager.Select Access Management
in the sidebar, then select Apple Services .Select FaceTime, turn it off or on. If you turn it on, select one of the following:
Anyone (default)
Organization only
Select Apple Services from the top, select Messages, turn it off or on. If you turn it on, select one of the following:
Anyone (default)
Organization only
Turn on user access to Apple Wallet
By default, users who sign in with a Managed Apple Account can’t access Apple Wallet. You can turn on their access so they can add employee badges, if allowed by their organization.
In Apple Business Manager
, sign in with an account that has the role of Administrator or People Manager.Select Access Management
in the sidebar, then select Apple Services .Select Wallet, then turn on access to use Apple Wallet.
Turn on user access to Apple Developer content
By default, users who sign in with a Managed Apple Account can’t access any Apple Developer Program content. You can modify that access.
Note: This feature allows users with any role to be added to existing developer teams.
In Apple Business Manager
, sign in with an account that has the role of Administrator or People Manager.Select Access Management
in the sidebar, then select Apple Services .Select Developer, then do any of the following:
Turn on access to Apple Developer Program.
Turn on access to Xcode Cloud program.
Turn on access to the MFi portal.
Important: Command-line services—like
notarytool—won’t work with Managed Apple Accounts.
Turn on user access to AppleSeed for IT
AppleSeed for IT is designed specifically for enterprise and education customers committed to testing each new version of Apple beta software in their organizations. Organizations using Apple Business Manager can designate which account roles in their organization may participate. Participants then use their Managed Apple Account to access the program, and their feedback is associated with their organization.
By default, users who sign in with a Managed Apple Account can’t access AppleSeed for IT. You can modify that access.
In Apple Business Manager
, sign in with an account that has the role of Administrator or People Manager.Select Access Management
in the sidebar, then select Apple Services .Select AppleSeed for IT, then turn on user access to the website.
See Roles: Basic privileges and the AppleSeed for IT website.
Turn on user access to specific privacy and security features
You can turn on access to specific privacy and security features.
In Apple Business Manager
, sign in with an account that has the role of Administrator or People Manager.Select Access Management
in the sidebar, then select Apple Services .Select Privacy & Security, then turn on access to any of the following:
Data & Privacy Access: Allow users access to request a copy of their data.
User Account Lookup: Allow users the ability to look up other user’s contact information.
Automatic sign in on Apple Watch: Allow users to pair their Apple Watch with their iPhone without having to enter a password.