We manage about 30 company-owned iPhones through Apple Business and Intune. Roughly half the staff rarely need anything beyond the standard setup, but the rest may need to install an app at short notice while working anywhere in the world. Some services, including parking and other location-specific systems, are app-only, so waiting for a helpdesk to package and deploy every app is not practical.
Before we took over, many devices were using personal Apple Accounts, often created with a company email address and sometimes with personal addresses. Face ID and Stolen Device Protection now make it difficult to change or recover some of those accounts because password resets require approval on the enrolled device.
Apple advised us not to use managed Apple Accounts for this scenario and instead suggested that employees create separate personal iCloud accounts for App Store purchases, without using their business email addresses. However, we are concerned about what happens when an employee leaves. If the account is associated with their phone number, can that number be reused for a future employee's Apple Account? Are phone numbers actually limited to one account, and would using our own domain eventually cause Apple to restrict the accounts? We also want to avoid creating Activation Lock or ownership problems when staff leave.
4 Answers
The usual workaround is to use a separate personal Apple Account only for the App Store, while leaving the managed account signed in for the rest of the phone. It should not use the employee's business email address. This keeps app installation separate from device management, although it does mean the company is allowing some personal account use on a corporate device.
If personal Apple Accounts are not permitted, the supported choices are essentially to deploy the apps ahead of time, use app licenses and managed distribution where possible, or provide an approved alternative such as a browser-based service or another payment method. Apple Business is not designed to let managed Apple Accounts freely make arbitrary personal App Store purchases on demand.
For the devices that are supervised, make sure Activation Lock is configured deliberately. In Intune, review the setting called “Activation Lock Allowed While Supervised.” If enabled, you can retain the theft protection benefits while still using the Activation Lock bypass or removal tools available through Intune and Apple Business when a device is reassigned. Save any bypass information before wiping or removing a device.
A phone number can be associated with more than one Apple Account, so it is not permanently consumed by the first account. That said, Apple's signup and verification checks can still reject a number in some situations, so I would not build a staff turnover process around creating disposable accounts. Also check whether the service has a web-based alternative, but that will not help when the provider genuinely requires its app.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures