Help, there’s a Mac on my network (9): the personal Apple Account

Episode 9 of the series Help, there’s a Mac on my network.

What happened

It started with a notification. “Your iCloud storage is almost full.” Marieke was standing in Ruud’s doorway holding her MacBook Air. “Do I have to buy something now? It’s been nagging me for a week.”

Ruud put down his mug and opened Finder. The sidebar didn’t just say Desktop. It said Desktop, under iCloud Drive. He clicked through. A folder called “Quotes 2026”. A folder called “Council estimates”. A spreadsheet with the purchase prices of every supplier they had. And in between, a folder called “Terschelling July”, which Ruud very deliberately did not open.

Then the Photos app popped up, because Marieke had left it open yesterday. Beach, ice cream, a dog that wasn’t Marieke’s. Ruud closed it. A message appeared in the top right corner: “Mum where’s the PlayStation charger”. Then another one: “Never mind”.

“Those are my kids,” Marieke said. “Handy, isn’t it, that it all comes in on the laptop too.”

Ruud nodded slowly. Handy was one word for it. He had a few others.

Sam walked in carrying a bag of cable ties, glanced over Ruud’s shoulder once and said: “Can I just…?” He opened System Settings, clicked Marieke’s name at the top, then Find My. “Find My Mac is on. With her personal account. So this Mac is tied to her Apple Account, not to us.”

“Meaning?” Marieke asked.

“Meaning if you ever forget your password, or leave, we own a very expensive paperweight,” Sam said kindly.

Ruud looked at his mug. “Have you tried turning it off and on again?” Not going to help this time.

What’s really going on

On a Mac you sign in twice. Once with the user account on the Mac itself, and once with an Apple Account in System Settings. That second one decides where iCloud sends everything. When Marieke set up the Mac she simply typed in her own Apple Account, the same one as on her iPhone. Perfectly sensible, and exactly where it goes wrong.

With a personal Apple Account, the Mac syncs a lot to that person’s iCloud by default:

• Desktop and Documents: with this option on, both folders move into iCloud Drive. Anything Marieke drops on her desktop lives in her private cloud.
• Photos: with iCloud Photos, her entire iPhone library shows up on the work Mac.
• Passwords: iCloud Keychain, now the Passwords app, carries business passwords into her personal account.
• Messages: with Messages in iCloud, every conversation, kids included, lands on the work Mac.

That cuts both ways. Private stuff sits on a company device, and company data sits in a private cloud you have no say over as an admin. Those quotes contain customer names, addresses and phone numbers. That is personal data, so GDPR is watching. The company has no agreement with Apple covering Marieke’s personal iCloud and can’t retrieve or delete the data when it needs to. Is it automatically a data breach? Not necessarily. But it is out of your control. If in doubt, run it past whoever handles privacy in your organisation.

Then there’s Activation Lock. On a Mac with Apple silicon or a T2 chip, Find My turns Activation Lock on automatically. After an erase, only the Apple Account that set the lock can activate the Mac again. Windows has nothing quite like it: a laptop tied to someone’s personal Microsoft account, you just wipe and reinstall.

The business alternative is a Managed Apple Account. You create it in Apple Business, and if you federate Apple Business with Entra ID, people sign in with their normal work account. The account belongs to the company. In Apple Business you decide whether iCloud Drive, Passwords and Keychain, iCloud Backup and web access are allowed, and whether iMessage and FaceTime work only inside the organisation or not at all.

How to fix it

1. Data first, everything else second

1. Install the standalone OneDrive app (not the App Store version) and sign in with the work account.
2. Turn off Desktop and Documents in iCloud under System Settings, Apple Account, iCloud, iCloud Drive. Heads up: the files stay in iCloud Drive and you get empty local folders back. Move them yourself afterwards.
3. Put business files in OneDrive or, better for shared quotes, in the right SharePoint library. Personal files stay where they are.
4. Move business passwords out of Marieke’s iCloud Keychain and into your company password manager.
5. Then turn on OneDrive Folder Backup with KFMSilentOptIn and KFMOptInWithWizard, so Desktop and Documents go to the work OneDrive from now on.

2. Get Activation Lock under control

Have Marieke sign out of her Apple Account on the work Mac herself. That turns off Find My and releases Activation Lock. If that’s ever no longer possible, someone with the right privileges can turn off Activation Lock in Apple Business, but only if the Mac was in Apple Business before the lock was set. A Mac bought outside your usual supplier can be added with Apple Configurator on an iPhone, after an erase. So only after step 1. From then on it enrols in Intune through Automated Device Enrollment and is supervised. On a supervised Mac, user-linked Activation Lock is not allowed by default.

3. Restrictions through Intune

In the Intune Settings Catalog, under Restrictions, you’ll find Apple’s iCloud restrictions: iCloud Documents and Data, iCloud Photos, iCloud Keychain, Password AutoFill and AirDrop, among others. There’s also a separate setting for iCloud Desktop and Documents. Check what your own tenant shows. Managed Open In, which you may know from the iPhone, has no real Mac equivalent that I could confirm. If you want control over what happens to files, look at Endpoint DLP in Microsoft Purview, which also works on macOS if your licence covers it. And set DisablePersonalSync in OneDrive so a personal OneDrive can’t sit next to the work one.

4. And the employee’s own Mac?

Apple has account-driven User Enrollment for that, on the Mac from macOS 14. The employee signs in with a Managed Apple Account, work data stays separate, and the company sees nothing of their personal stuff. Intune currently supports that method only for iPhone and iPad. A personal Mac enrols in Intune through the Company Portal app, which is a full device enrollment. So be upfront with the employee about that.

5. The conversation with the boss

Ruud didn’t make a fuss. He said: “I don’t want your holiday photos ending up in our backup, and I don’t want our quotes in your photo album.” That worked better than an hour on GDPR. Her personal account stays on her iPhone, the work Mac gets the work account. And she gets something out of it: no more full iCloud, and no PlayStation messages popping up during a Teams call with the council.

Ruud’s lesson

Marieke didn’t do anything wrong. She did exactly what Apple asked her to: sign in with her own account. As an admin, your job is simply to get to that moment before she does. Whoever decides which account a Mac starts with on day one decides where the data goes for the next few years. And the “Terschelling July” folder? Never saw it. Honestly.

Read more: Apple Business, Entra ID and Intune, Passwords and Mac in a Windows network.

This is episode 9 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.