Connect Apple Business to Trustaige

Apple Business lets you choose the identity provider your organization’s Managed Apple Accounts sign in with. Choose Trustaige, and your people sign in to their iPhone, iPad, Mac, Apple Vision Pro, Shared iPad and iCloud on the web with the passkey they already use for everything else. Nobody is issued an Apple password, so there is none to forget, reset or phish.

Apple builds this on three open standards. You set each one up yourself, in an app you create in the hub, so you can see exactly what each connection does and change it later:

Connection	Standard	Direction	What it does
Sign-in	OpenID Connect	Apple asks Trustaige	A person proves it’s them with their passkey, and Apple signs them in to their Managed Apple Account.
Security events	Shared Signals	Trustaige tells Apple	When someone’s sessions end or their passkeys change, Apple hears about it within seconds. Apple creates and manages this stream itself, under an administrator’s approval.
Directory sync	SCIM 2.0	Trustaige pushes to Apple	Managed Apple Accounts are created, updated and removed from your directory.

How it fits together, once it’s set up:

Person

Apple

Trustaige

1. Person to Apple: signs in with their work email
   signs in with their work email 1
2. Apple to Trustaige: sends them to Trustaige
   sends them to Trustaige 2
3. Person and Trustaige: passkey
   passkey 3
4. Trustaige to Apple: ID token: email and name
   ID token: email and name 4
5. Apple to Person: Managed Apple Account signed in
   Managed Apple Account signed in 5
6. Trustaige to Apple: directory sync: create, update, disable (SCIM)
   directory sync: create, update, disable (SCIM) 6
7. Trustaige to Apple: session-revoked, credential-change (Shared Signals)
   session-revoked, credential-change (Shared Signals) 7

Before you begin

You need	Why
An Apple Business account with the Administrator role	Only a role that can set up federation and connect an identity provider can do the steps in Apple Business.
A domain verified in Apple Business	Federation applies to one domain at a time. If you haven’t verified it yet, Apple gives you 14 days to add its DNS record.
A Trustaige administrator who may receive security signals	Apple asks this person to sign in while it connects, and they approve Apple’s event stream. The Receive security signals permission, the Settings permission, or superadmin all qualify.
Members whose Trustaige email is on that domain	Apple matches each person to their Managed Apple Account by email address.
A first and last name for everyone who will sign in	Apple refuses a sign-in without both. Trustaige sends the First name and Last name on the person’s profile or, when those are empty, their display name split at its first space. Someone known by one name needs a last name added.

Devices need iOS 15.5, iPadOS 15.5, macOS 12.4, visionOS 1.1 or later. Nothing here needs iOS 27 or macOS 27.

Allow about half an hour. Steps 1 to 4 can be spread out; step 5 can’t: Apple gives you four calendar days from creating its directory-sync client to finish connecting it.

1. Create the app

Apple signs people in with a client ID and secret that you give it, so start with an app of your own.

A web app can already use refresh tokens, which Apple needs to keep the connection alive on its own. You don’t need to change anything else on it.

Choose who can use it. In the app’s Access section, click Assign groups and choose the group whose people should have Managed Apple Accounts, for example Apple users. Apple recommends allowing only specific accounts, and the same group is what directory sync pushes in step 5. With no group assigned, every member of your organization except guests can sign in, but directory sync has no one to push.

2. Turn on Admin approval

Apple uses the one client ID and secret for both sign-in and its event stream, so its stream can’t have a credential of its own. It works under an administrator’s approval instead.

The tab now says Waiting for an administrator’s approval, and shows the two addresses you’ll give Apple:

Field	Value
Transmitter metadata	https://id.trustaige.com/.well-known/ssf-configuration
OpenID configuration	https://id.trustaige.com/.well-known/openid-configuration

3. Connect Trustaige in Apple Business

On the app’s Signals tab, Admin approval now says Approved by you. Under Streams you’ll find Apple’s stream, pushing to federation.apple.com, with the two events it asked for, credential-change and session-revoked, and one acknowledged delivery: the verification event Trustaige sends the moment Apple creates the stream.

Only someone who may receive security signals is ever shown the approval. The people who sign in to their Managed Apple Accounts every day sign in as usual and never see it.

4. Turn on sign-in with Trustaige

Apple turns this on only once no personal Apple Account uses your domain. If one does, the domain’s page says unmanaged Apple Account found and Set up stays greyed out until you start domain capture.

Your developer team doesn’t have to stay on personal accounts. In Apple Business, Settings → Access Management → Apple Services → Developer lets Managed Apple Accounts use the Apple Developer Program, Xcode Cloud and the MFi portal. Add your people’s Managed Apple Accounts to your developer team and they sign in with Trustaige, so someone you deactivate loses developer access too. To make a Managed Apple Account the team’s Account Holder, Apple asks you to contact Apple Developer Support.

To try it, take an iPhone or iPad that isn’t signed in, open Settings, choose to sign in, and enter a member’s work email. Apple hands over to Trustaige, the member signs in with their passkey, and the device finishes setting up their Managed Apple Account with their name already on it. Use someone without an Apple Business administrator role.

From now on, a person who signs in to an Apple device with their work email is sent to Trustaige, and proves it’s them with their passkey. Apple creates their Managed Apple Account the first time they sign in, if directory sync hasn’t already.

5. Sync accounts from your directory

Sign-in alone creates an account the first time someone uses it, and never removes one. Directory sync creates accounts before anyone signs in, keeps names and addresses in step, and disables or removes accounts when people leave.

Apple doesn’t hand out a SCIM token. It issues your organization an OAuth client for its directory feed, and an Apple Business administrator authorizes it. Connect it that way:

Directory sync now pushes the people in the app’s groups, and the groups themselves; Last sync result on the tab counts both. To push straight away rather than wait for the next change, click Sync Now. While sync is on, Apple Business shows synced accounts as read-only: changes are made in Trustaige.

What Apple receives for each person:

Attribute	From
userName	Their username in Trustaige if they have one, otherwise their email. For Apple it has to be their work email.
name, displayName	Their name in your directory
emails	Their work email
active	Whether they can still sign in

Check that it works

Check	Where	You should see
Apple’s stream works under your approval	The app’s Signals tab	Approved by your name, and Apple’s stream with at least one acknowledged delivery
Directory sync is authorized	The app’s Provisioning tab	Authorized, and a successful last sync
Accounts reached Apple	Apple Business, in its list of user accounts	Your group’s people, read-only
Someone can sign in	An iPhone, iPad or Mac	Signing in with a work email opens Trustaige, and a passkey finishes it

Try the last one with an account that has no Apple Business administrator role.

What happens when something changes

In Trustaige	At Apple
Someone joins the app’s group	Directory sync creates their Managed Apple Account.
Their name or email changes	Directory sync updates the account.
They leave the group, or are deactivated	Directory sync disables or deletes the account, as you chose in step 5.
Their sessions end, or a passkey is added or removed	A session-revoked or credential-change event reaches Apple’s stream within seconds, and Apple asks the person to sign in again on their devices. These are the two events Apple’s stream asks for.
The approving administrator loses the permission, or the approval is revoked	Apple can no longer manage its stream, though the stream keeps delivering. Reconnect from Apple Business (step 3) and have an administrator approve it again.

Keep it running

• The directory-sync secret expires after the 6, 9 or 12 months you chose. Trustaige emails your administrators 30 days before. Create a new secret in Apple Business, then click Replace secret on the Provisioning tab; the authorization carries over.
• The approving administrator leaves. Apple can’t change its stream until someone approves it again. The Signals tab marks the approval as no longer valid. Repeat step 3 with another administrator.
• Tokens refresh on their own. Neither connection needs attention between those events.

Troubleshooting

Apple says it could not verify the provided OIDC configuration

Apple signed you in but couldn’t redeem the sign-in with the client ID and secret it was given. Copy both again from the app’s Credentials, check the app is turned on, and check Apple’s redirect URI is among its Redirect URIs. If you regenerated the secret since, give Apple the new one.

Apple says your account is missing a first or last name

Apple refuses anyone without both. In Directory, open the person and set their First name and Last name, then sign in again.

Apple's connection test fails, or Trustaige never asks you to approve

The Signals tab must show Admin approval, and the person who signs in must have the Receive security signals permission, the Settings permission, or be a superadmin. Anyone else signs in normally and is never asked, so Apple can’t create its stream from their sign-in.

Apple's authorization fails straight after you select Allow

Check that Client authentication is In the request body (client_secret_post), save, and click Authorize again. Apple’s client ID and secret stay the same.

The Provisioning tab says Needs authorizing again

Apple refused the stored authorization; the tab shows what Apple said. Click Authorize again. If you created a new client in Apple Business, enter its client ID and secret first.

The Provisioning tab says Not authorized yet after you clicked Authorize

The callback URL in Apple Business must match the one on the tab exactly, and you have four calendar days from creating Apple’s client to finish.

Nothing is synced

Directory sync pushes only the members of the groups assigned to the app. Assign a group, then click Sync Now.

Someone can't sign in at Apple

Their email in Trustaige must be their Managed Apple Account’s address, on the federated domain, and they must be able to reach the app: in its group, or the app has no groups assigned. Apple Business administrators can’t sign in with federation at all.

Apple shows the wrong user name

Directory sync sends a person’s username when they have one. Remove the username in Trustaige, or make it their work email.

Reference

What	Value
Redirect URI	https://gsa-ws.apple.com/grandslam/GsService2/acs
OpenID configuration URL	https://id.trustaige.com/.well-known/openid-configuration
SSF configuration URL	https://id.trustaige.com/.well-known/ssf-configuration
Scopes Apple requests	openid, profile, email, offline_access, ssf.read, ssf.manage
Directory sync callback URL	https://id.trustaige.com/api/admin/provisioning/oauth/callback
Apple’s SCIM endpoint	https://federation.apple.com/feeds/business/scim
Apple’s authorization URL	https://appleid.apple.com/auth/oauth2/v2/authorize
Apple’s token URL	https://appleid.apple.com/auth/oauth2/v2/token

How the pieces fit. When Apple signs someone in, the ID token carries their email and, with profile, their name, given_name and family_name, so Apple can name the account it creates. A sign-in that asks for ssf.read and ssf.manage keeps them only for the administrator whose approval is on record; for everyone else they are removed and the sign-in carries on. The token Apple holds is checked against that approval on every call it makes to the stream. Apple’s stream asks for two events, session-revoked and credential-change, pushed to an address under https://federation.apple.com/feeds/business/caep/, and each concerns only people who can reach the app. Trustaige sends the stream a verification event the moment Apple creates it, which Apple waits for.

Apple’s documentation

• Intro to federated authentication with Apple Business
• Use federated authentication with your identity provider
• Verify a domain
• Lock a domain
• Capture a domain