Using MDM without Managed Apple ID

[spicyricey]

I’ve been taking on the task on implementing an MDM solution for our organization, previously we “made” apple ids that we would distribute out and have access too. We did this mainly for issues when a employee leaves and we can’t access the phone, or factory reset it.

We are pretty open to users purchasing apps with their company cards, and using the device as they see fit as they are mainly for executive/remote users who make up a small amount of our organization.
I noticed the managed apple IDs look pretty restrictive in terms of what a user is able to do with their phone, but we still want to be able to fully manage the device itself. Is there any limitations on using our MDM solution with zero touch deployment without managed Apple IDs?

[sjoubanian]

It really depends what you plan to do with the Managed Apple IDs. They could be used for iCloud on each machine, and to accept VPP licenses for the App Store (and Books), but neither are required. Your IT staff need them to use ABM/ASM but that’s the only strict requirement.

On purchasing apps, it can be pretty wasteful for users to purchase apps on the company card and their personal Apple ID, because you can’t reassign those apps later. VPP is pretty great, not just to push out the free apps like iWork, iLife, and Microsoft Office, but also because you can reassign the more expensive ones between devices as necessary. Apps can be assigned per-user (Managed Apple ID) or per-device (serial number).

The rest will depend on your MDM provider and if/how you will require authentication at the Setup Assistant.

[spicyricey]

@sjoubanian ​ Good to know they aren’t required, in our current environment it would be a pretty hard shift for us to go in a heavily managed direction (even though it would better in the long run). I will probably end up pushing for the VPP though, especially if we can assign per device rather than using the apple IDs. Right now we use generic apple ids for those users, we will most likely start making personal ones with their company email as part of the onboarding process/deployment of those devices.