---
title: Apple access management
slug: device-management-apple/apple-access-management
createdAt: 2026-10-06T07:47:35.431Z
---

**Prerequisites**:

- Verify and lock the domain on Apple Business Manager or Apple School Manager.
- Configure at least one EPMM server from the Apple Business Manager or Apple School Manager organizations, where managed apple IDs are present in the Ivanti EPMM.

Signing-in to Managed Apple ID allows organizations to control which Apple services and features users can access.

In Apple Business Manager or Apple School Manager, **Allow Managed Apple Account on** setting controls where users can sign in with their Managed Apple IDs. The administrators can configure this setting to restrict sign-in to managed or supervised devices, or allow it on any of the devices.

- **Any device** (default): Users can sign in with their Managed Apple IDs on any device, regardless of whether it's managed by an EPMM solution.
- **Managed devices only**: Users can only sign in on devices managed by an EPMM solution that supports the Get Token endpoint.
- **Supervised devices only**: Users can only sign in on devices that are supervised (and managed) by an MDM solution that supports the Get Token endpoint.

These settings are a part of the broader "**Access Management**" for Apple Services within Apple Business Manager and Apple School Manager.

:::hint{type="info"}
With enhanced security, restricting sign-in to managed or supervised devices can improve data security by ensuring that work-related data is only accessible on controlled devices.
:::

Managed Apple Account Login will fail if zero or multiple Device Enrollment EPMM server organizations are present in the **Device Enrollment** tab and the administrator sets the **Allow Managed Apple Account** on setting present under **Access Management > Apple Services** is set to "**Supervised Devices Only**" or "**Managed Devices Only**" in Apple Business Manager or Apple School Manger.

:::hint{type="info"}
The devices will fail to log in if the **Managed Apple** account is not present in the Ivanti EPMM Device Enrollment in EPMM server.
:::