Managed Apple Accounts and Apple Business Manager sign-in

Apple Business Manager is Apple's free web portal where an organization manages its Apple devices, apps and work accounts. Managed Apple Accounts are Apple Accounts the organization owns. With federation, people sign in to them using their existing work identity, such as a Google Workspace account.

Update, October 2026: in April 2026 Apple renamed Apple Business Manager to Apple Business, which now includes built-in device management. The rest of this guide describes the service as it worked in March 2026.

Many small teams start with everyone signing in to company iPhones and Macs with their personal Apple Account. That works until someone leaves with the account that holds company notes, files or app purchases. Apple Business Manager and Managed Apple Accounts separate the company's side from the person's side. Federation then removes one more password by reusing the identity your team already has.

The three pieces

• Apple Business Manager. A web portal for organizations. Administrators use it to enroll devices in device management, assign apps and books, and create and manage work accounts.
• Managed Apple Accounts. Apple Accounts created and owned by the organization, previously called Managed Apple IDs. They give people access to Apple services for work while keeping that data apart from their personal accounts.
• Federated authentication. A link between Apple Business Manager and the organization's identity provider, so people sign in to their Managed Apple Account with the work username and password they already use.

Personal and Managed Apple Accounts compared

Question	Personal Apple Account	Managed Apple Account
Who owns it?	The person	The organization
Who creates it?	The person	An administrator, federation or directory sync
Who resets the password?	The person, through Apple	An administrator, or the identity provider when federated
How are apps obtained?	Bought or downloaded by the person	Generally assigned by the organization
What happens when someone leaves?	They keep it	The organization disables or removes it

A Managed Apple Account cannot use the same address as an Apple Account someone already has, so the work email address has to be free, or freed, before it can be used.

How federation works

1. Verify the domain. The organization proves it owns its email domain in Apple Business Manager. Federation needs a verified domain.
2. Clear conflicts. Before connecting the identity provider, people who use a personal Apple Account with a work address are notified and given a set period to stop using that address on the personal account.
3. Connect the identity provider. An administrator links Apple Business Manager to an identity provider such as Google Workspace, or another provider Apple supports. One identity provider is linked at a time.
4. Let people sign in. Usernames are generally the person's work email address. They sign in on their device with their work password, which the identity provider checks.
5. Keep the directory in step. Directory sync can create and update accounts from the identity provider ahead of sign-in, the same idea as SCIM provisioning for business apps. The guide to SCIM provisioning explains that pattern.

The administrators who set up federation keep separate accounts to manage it, so a problem with the identity provider does not lock them out of the portal.

Managed Apple Accounts and other apps

Federation answers how people sign in to Apple's own services. Signing in to other business apps is a separate question, and there are two common patterns:

• Sign in with Apple. Managed Apple Accounts can be used with third-party apps and websites that support Sign in with Apple, if the administrator allows it. The administrator controls which apps are allowed.
• Single sign-on through the identity provider. Many business apps connect directly to the identity provider instead, using standards such as SAML or OpenID Connect. The guide to single sign-on for a small business covers that route.

Before you plan around either pattern, ask each vendor which one it supports for business accounts. Support for consumer Sign in with Apple does not always mean support for Managed Apple Accounts.

A planning checklist

• Pick the identity source. Decide which system is the source of truth for who works at the company, and federate from that.
• Clean up addresses. Find out who already uses a work address as a personal Apple Account before you verify the domain.
• Protect the identity provider. Once it controls sign-in to devices, it deserves the strongest sign-in you have; see two-factor authentication and passkeys for small teams.
• Plan for leavers. Disable the person in the identity provider and in Apple Business Manager on the same day, and recover company devices.
• Limit admin roles. Give administrator rights to as few people as practical, the same principle as field-level permissions in business apps.

Frequently asked questions

Is Apple Business Manager free?

Apple Business Manager itself has no charge. The devices, any paid apps you assign, and the device management service you connect to it are paid separately.

Do I need device management to use Managed Apple Accounts?

Not to create the accounts. Device management is what enrolls company devices, applies settings and assigns apps, so most organizations that use Apple Business Manager connect one. Small teams can start with accounts and add device management later.

What happens to a Managed Apple Account when someone leaves?

The organization controls it. Administrators can disable or delete the account in Apple Business Manager, and with federation, disabling the person in the identity provider stops them signing in. Plan the order so company data on their devices is recovered before access ends.

Is a Managed Apple Account the same as Sign in with Apple?

No. A Managed Apple Account is the account itself, owned by the organization. Sign in with Apple is a way to use an Apple Account to sign in to other apps and websites. A Managed Apple Account can use Sign in with Apple where the administrator allows it.