Block iCloud and iTunes Sign-Out

[jhumphrey]

I assign a company AppleID to a device and wish to prevent a user from signing out and then using their personal AppleID. Fewer than half of my devices are enrolled in DEP at this point.

[PhilipDAth]

For Apple you need the devices in Device Owner mode (such as via DEP or enrolled via Apple Configurator on a Mac) to enforce things.

And when you do it this way, the licences are bought through the Systems Manager Apple account.

[jhumphrey]

These phones are Supervised. I tried enabling 2-factor authentication with my phone number but the user can change the AppleID password and Trusted Phone Number without triggering anything other than a notice after the fact to the rescue email address.

I want to block the user from making any changes to the AppleID. We have had too many instances of users leaving devices logged into iCloud with personal accounts and forgotten passwords.