I have a users with a federated account in apple business manager - showing as locked in apple business manager. Entra showing user is fine

Andrew Hearn 0 Reputation points
2026-05-19T10:31:59.4333333+00:00

I have a user unable to sign in to either their current iphone, or activate a new device, because their Apple Business manager federated account is locked. Apple are unable to do anything as this is controlled by sync from Entra ID.

nothing in Entra ID is showing this user as locked, or a "risky user". we have tried password resets, account unlocks, and everything works fine for the windows side of things, but no update to the ABM side of things.

i have 200 other users with E/M5's, Copilot, and Intune licenses with working federated accounts, who i can see when they have a locked apple account due to password expiry, the lock is removed by doing a password reset.

I have tried logging a support ticket, but repeatedly been scuppered/frustrated by the "AI" assistant. so i'm here. asking for any pointers of where to look, or even if there is the possibility to actually deal with a human being in some sort of support context.

If I can get some ideas as to where to look next, that would be amazing. many thanks for your time.

Community Center | Not monitored
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-05-19T10:32:17.8133333+00:00

    For a federated Apple Business Manager (ABM) account that appears locked only on the Apple side while Microsoft Entra ID shows the user as healthy, the next steps must focus on:

    1. Verifying that Entra is still correctly synchronizing the password state and sign-in status for this user.
    2. Escalating to a support channel that can look at tenant-level federation and lockout behavior.

    From the provided information, the most relevant guidance is around how password and lockout state flows from on-premises AD to Entra ID and then to federated services, and how to troubleshoot when some users can sign in and others cannot.

    Actionable checks and steps:

    1. Confirm password/lockout state in Entra and on-premises AD
      • Ensure the account is not flagged with “User must change password at next logon” in on-premises AD. If it is, clear that flag or have the user change their on-premises password, then wait for synchronization.
      • If the user ever changed their password directly in a cloud portal, change it again on-premises and allow it to sync. This ensures Entra has the authoritative, current password state.
      • If using password hash sync, verify that the user’s PwdLastSet is syncing correctly to Entra’s LastPasswordChangeTimestamp. If custom sync rules were created, confirm that PwdLastSet is not filtered out for this user.
    2. Check for partial sync issues affecting only this user
      • Since other federated users work, treat this as a “some users can’t sign in” scenario.
      • Validate that this user is fully in scope for Entra Connect sync and not accidentally excluded by OU or attribute-based filtering.
      • Use tools such as IdFix (if applicable) to check for duplicate UPNs or email addresses that might cause this user to be treated differently in the sync pipeline.
    3. Review sign-in and risk signals in Entra
      • Even though the user is not marked as “risky,” review Entra sign-in logs for this user around the times ABM shows lockouts. Look for repeated failed sign-ins or conditional access blocks that might cause Apple to treat the account as locked.
      • If there are repeated failed attempts from Apple endpoints, this can explain why ABM shows a lock even when Entra shows the user as fine.
    4. Re-trigger a clean password change flow
      • Perform a password reset on-premises (or in Entra if cloud-only) and ensure the change syncs.
      • Wait for synchronization and then test sign-in to a Microsoft cloud service first (e.g., Microsoft 365) to confirm the new password works end-to-end.
      • After that, attempt ABM sign-in/activation again to see if Apple picks up the updated password and clears the lock.
    5. If the user is federated via AD FS or another IdP
      • If federation is via AD FS or a non-Microsoft federation server, verify that the relying party trust and token issuance are correct and up to date, as misconfigurations can cause repeated failures that appear as lockouts on the relying system.
      • Ensure any recent changes to federation configuration have been applied and that the Entra relying party trust is healthy.
    6. Escalate via Microsoft support when tenant-level lockout/federation behavior is suspected
      • Because Apple indicates the lock is controlled by Entra and other users are fine, this may require tenant-level investigation of federation and sign-in logs that only Microsoft support can perform.
      • For similar “locked out / MFA / tenant” issues where admins cannot resolve via portal, the recommended path is to open a support ticket so the Data Protection or identity support team can directly assist and restore access.
    7. Human support options
      • If standard support ticket creation is blocked by the virtual assistant, use the documented global support phone numbers for Entra/identity to reach a support engineer who can bypass the automated flow and attach logs to the case.

    These steps focus on ensuring the user’s password and lockout state are correctly synchronized and that there are no hidden sync or federation issues affecting only this account. If all checks are clean and the issue persists, a Microsoft support case with sign-in logs and correlation IDs from the user’s failed Apple sign-in attempts is required so the identity team can trace the flow end-to-end.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.