220-1102 Question 202
Single answerApple ID and corporate restrictionsA company issues iPhones to sales staff and manages them with an MDM solution. Users are allowed to use App Store apps needed for work, but the security team does not want employees using personal Apple IDs to bypass company restrictions or mix personal purchases with company-owned devices. A technician is asked to prepare a deployment approach that best supports this requirement. Which action should the technician recommend?
- A
Require each employee to sign in to the iPhone with their personal Apple ID and rely on passcode policies to prevent unauthorized purchases
- B
Create a shared Apple ID for the entire sales department so the company can control app downloads from one account
- C
Use Managed Apple IDs through Apple Business Manager with MDM-enforced restrictions and assign apps to devices or users through the organization
- D
Disable the screen lock so users cannot change Apple ID settings without contacting IT
Show answer and explanation
Correct answer: C
Explanation
The best recommendation is to use Managed Apple IDs with Apple Business Manager and enforce corporate restrictions through the organization's MDM platform. In Apple business deployments, organizations typically supervise company-owned devices and use MDM to control settings such as account changes, app installation behavior, and other restrictions. Managed Apple IDs are intended for work use and help separate corporate resources from personal identities. Apple Business Manager also supports app assignment through organizational purchasing and deployment workflows, reducing dependence on personal Apple IDs for company devices. This aligns with Apple's documented best practices for enterprise and education deployments: use supervised devices, MDM, and organization-managed identities rather than shared or personal consumer accounts.
- A. Incorrect.
This is incorrect. A personal Apple ID is owned and controlled by the employee, not the organization. While passcode and purchase restrictions can help, they do not solve the core problem of separating corporate control from personal accounts. In a business environment, relying on personal Apple IDs can complicate app ownership, device reassignment, and data governance.
- B. Incorrect.
This is incorrect. Sharing one Apple ID across multiple employees is poor practice and can violate Apple's intended account usage model. It creates accountability, security, and synchronization problems, and it does not provide proper user-level management. Shared credentials also increase the risk of unauthorized access and make auditing difficult.
- C. Correct.
This is correct. Managed Apple IDs are designed for organizational use through Apple Business Manager and work with MDM for corporate control. This approach lets the company apply restrictions, manage access appropriately, and distribute apps in a controlled way without depending on employees' personal Apple IDs. It also supports cleaner ownership and lifecycle management for company-issued devices.
- D. Incorrect.
This is incorrect. Disabling screen lock would reduce device security and is not a valid method for controlling Apple ID usage. Screen locks protect corporate data. Apple ID restrictions and app deployment should be managed through MDM policies and organizational identity controls, not by weakening local device security.