I’m not sure how many other schools deal with this, but we found out something rather curious the other day, and it’s been confirmed by Mosyle (our MDM) and a couple of folks on the MacAdmins Slack.
My understanding was that a DEP-enrolled MDM’ed iOS device would not allow an iCloud account (regular Apple ID, not a managed Apple ID) to be locked to it. In other words, you can sign in with an iCloud account, but anyone can just sign out of it without a password. That behavior would totally make sense (after all, it’s not your device—it’s the organization’s, and it’s a supervised device).
Apparently, that’s not actually the case at all.
If you sign in with an iCloud account, you cannot remove the account without getting the password to the iCloud account or wiping the device.
One additional weird piece to this is that even though you can’t sign out of the iCloud account without a password, you don’t actually need the activation lock bypass code after a device wipe. It just re-enrolls in the MDM via DEP. So the iCloud account is locked to the device (until you wipe it), but the device itself isn’t activation locked.
That may be fine if you’re in a school-owned one-to-one iPad program: Student shows up first day of school, gets a DEP-enrolled iPad, signs into her iCloud account, uses it the whole year, and then the school’s tech department wipes it at the end of the school year.
However, we have at the moment a one-to-one bring-your-own-iPad program, and so the school-owned iPads are for special temporary uses (in carts for certain academic programs, as short-term loaners in certain circumstances). So allowing students to sign in with iCloud accounts can be really inconvenient.
The only options we have are:
- Let people sign into their iCloud accounts and then track them down later to remove their accounts. (A lot of tracking down of people.)
- Pre-emptively sign into a generic iCloud account to prevent others from signing into their own iCloud accounts. (A lot of manual labor.)
- Preventing all account sign-ins via MDM restriction. (This also shuts down the ability for people to sign into Mail or Google Apps, though, so it’s a non-starter.).
- Wipe the device every time there’s a lock.
3 responses to “Dealing with iCloud accounts on DEP-enrolled iOS devices”
[…] Dealing with iCloud accounts on DEP-enrolled iOS devices – Alan Siu […]
I work in a hospital and have similar situation as yours, and wiping it after each use makes the most sense to avoid the iCloud issue plus browsing history, etc.
Does “preventing all account sign-ins via MDM restriction” really kill the ability of users to log into the mobile Google apps (or through Safari)? Seems Internet Accounts is largely oriented towards users on personal devices that need to configure the native Mail/Contacts/Calendar with the Google apps, which is certainly not the use case for shared use. Have you spoke with your Apple reps about Shared iPad or an automated wipe-and-reset workflow setup through Apple Configurator?