1

We are writing the policy of a small company to create 100 Apple ID for their employees. Half will work primarily on iPads and the other half on Macs. We have decided to try to use two-step authentication rather than the traditional, pick three security questions and answers for the work Apple ID.

Many of our workers do not have iOS devices to carry with them, so we will rely on SMS for the pin notification part of the process and have each employee list a corporate SMS number as one of their options so that IT can assist them with resetting an account should the password need to be reset.

Employees with personal SMS and personal and/or work iOS devices will of course list those as additional trusted devices as part of the setup process, but we need to cover all employees wither they have a cell phone, iPod or not. If we ensure that the first SMS number is a work controlled cell phone, we can prevent losing control of these Apple ID by maintaining that service and also escrowing the recovery keys for each work account.

enter image description here

Has anyone run into problems with using Apple ID in this manner or is there a deployment guide that Apple has published to help us decide how to implement Apple ID in the workplace?

Improve this question

1 Answer 1

Reset to default
1

I will say that I have seen two small organizations do this, but the overhead of setting up the escrow of recovery keys took more effort than we are likely to save in three years of supporting the accounts.

  • the actual setup went smoothly
  • people seemed comfortable with mixing work and personal accounts despite the added confusion that it can cause
  • we didn't run into any roadblocks registering common trusted devices.

Also, now that Volume Purchase Plan redemptions can be reclaimed and they are not lost when issuing expensive apps to personal Apple ID, the need to more tightly control which Apple ID is used to redeem a purchase is not nearly as valuable as it would have been in the cases where we looked at implementing this.

The strategy we are now taking is to just establish a written policy that work apps are to be returned to work - just like work computers and work phones and have employees sign for the tools they are provided with an HR policy to deduct value for tools not properly returned at the end of employment.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .