Shared iPad device enrolment and restrictions

zocster:

It doesn’t sound like the Web Clips would have caused this. A Web Clip profile is essentially just a Home Screen shortcut to a URL, so it doesn’t interact with Apple ID authentication or account security. I’ve used those by device group before without seeing them affect Apple ID state.

From what you described, it sounds more likely related to the passcode change. Changing the device passcode can sometimes trigger an Apple account security refresh for Managed Apple IDs. If Block account changes = Yes is already enforced, the device can’t complete that refresh, which results in the red “Update Apple ID settings” warning in Settings. The device can still unlock because the existing login token is valid, but the account update itself is blocked.

That would also explain why wiping the iPad didn’t resolve it — the trigger is tied to the Managed Apple ID security state, not the specific device.

Regarding your second question about setup: what has worked more reliably for me is leaving Block account changes set to Unconfigured while the account is first used on the Shared iPad, letting the user sign in and set their passcode once so the account session and security state are established. After that, turning Block account changes = Yes seems to be fine.

So the rough sequence I’ve settled on is:

Leave Block account changes = Unconfigured
User signs in with their Managed Apple ID
Set the screen passcode
Confirm login works once
Then apply Block account changes = Yes

That seems to avoid the “update Apple ID settings” warning appearing later.

The Web Clips themselves shouldn’t have triggered anything here.

I think having block account changes unconfigured at least during account creation is a good idea.

i have these settings, see any I should have unconfigured? Plus I have wifi always on and a wifi policy with SSID and password.

App Store, Doc Viewing, Gaming

Block in-app purchases

Yes

Block download of explicit sexual content in Apple Books

Yes

Ratings region

New Zealand

Movies

Don't Allow Movies

TV Shows

Don't Allow TV Shows

Block App store

Yes

Block playback of explicit music, podcast, and iTunes U

Yes

Built-in apps

Require Safari fraud warnings

Yes

Block internet search results from Spotlight

Yes

Block FaceTime

Yes

Require Siri profanity filter

Yes

Block Apple News

Yes

Block Apple Books

Yes

Block iMessage

Yes

Block Podcasts

Yes

Music service

Yes

Block iTunes Radio

Yes

Block iTunes store

Yes

Block Find My iPhone

Yes

Block Find My Friends

Yes

Block user modification to the Find My Friends settings

Yes

Block removal of system apps from device

Yes

Cloud and Storage

Block iCloud Photos sync

Yes

Block iCloud Photo Library

Yes

Block My Photo Stream

Yes

Block Handoff

Yes

Block iCloud backup

Yes

Block iCloud Private Relay

Yes

Connected devices

Block modifying Bluetooth settings

Yes

General

Block Screen Time

Yes

Block users from erasing all content and settings on device

Yes

Block modification of device name

Yes

Block modification of notifications settings

Yes

Block configuration profile changes

Yes

Block removing apps

Yes

Force automatic date and time

Yes

Require teacher permission to leave Classroom app unmanaged classes

Yes

Allow Classroom to lock to an app and lock the device without prompting

Yes

Allow students to automatically join Classroom classes without prompting

Yes

Thanks!

zocster

1994 posts

Uber Geek
+1 received by user: 105

ID Verified
Trusted
Lifetime subscriber

#3467046 5-Mar-2026 16:21

Yes, I think having Block account changes set to Unconfigured during the initial account setup is a good approach. That allows the Managed Apple ID to complete any background credential checks the first time it signs in on a Shared iPad.

Looking through the settings you listed, nothing there really stands out as something that would interfere with Apple ID setup. Most of those are content or feature restrictions (App Store, media, built-in apps, iCloud features etc.), and they typically don’t affect the Apple ID authentication or session creation process.

Your Wi-Fi configuration policy and “Wi-Fi always on” also shouldn’t cause any issues.

So the approach I’d stick with is:

Block account changes = Unconfigured while the account is first used on the Shared iPad.

User signs in with their Managed Apple ID.

The screen passcode is set and the account session establishes.

After that, Block account changes can be set back to Yes.

Everything else in the restriction set you shared looks pretty typical for a school-managed Shared iPad environment, so I wouldn’t feel the need to change those.

cddt

1967 posts

Uber Geek
+1 received by user: 1904

#3467048 5-Mar-2026 16:31

JayADee:

iPads, Chromebooks, scanner, printers X3, smart devices, phones, APs, laptops etc

I would have assumed the school would have a single IP and everything would be behind that.

Shows you how out of date my knowledge is...

JayADee

2236 posts

Uber Geek
+1 received by user: 483

#3467049 5-Mar-2026 16:38

I will keep pondering. At least now with the change account settings unblocked the error is just sitting in the settings, not popping up. Interesting to see if tomorrow the other 2 accounts have an error as well.

Thanks for looking over the settings.

JayADee

2236 posts

Uber Geek
+1 received by user: 483

#3467132 5-Mar-2026 20:17

I can reproduce the error by opening the Apple Music app (that comes with the iPad and that I have set in device restrictions to ‘yes’ to disable the music service and convert it back to ‘classic’ mode) and mucking about in there using a student shared iPad account. I reproduced the settings error on both other accounts. Experimenting in books (also blocked) didn’t result in a permanent issue like Apple Music.

I have “Block playback of explicit music, podcast, and iTunes U” on so I might try allowing the Music Sevice and see if that gets rid of the error without allowing any child-unfriendly music. Or according to Google I could try use Show or Hide apps to specifically hide the com.apple.Music bundle ID.

zocster

1994 posts

Uber Geek
+1 received by user: 105

ID Verified
Trusted
Lifetime subscriber

#3467135 5-Mar-2026 20:27

Interesting find — that actually makes sense.

Apple Music is one of the apps that still tries to check the Apple ID media services state in the background, even if the service itself is restricted. On Shared iPads with Managed Apple IDs that can sometimes trigger the “Update Apple ID settings” prompt because the app is attempting to verify the account against Apple’s media services.

If the music service is disabled while the app is still present, opening it can occasionally trigger that account check. When account changes are blocked, the device can’t complete the refresh, which leaves the warning sitting in Settings.

Your idea of allowing the Music service but keeping “Block playback of explicit music, podcasts, and iTunes U” enabled is a sensible test. That should still prevent inappropriate content while allowing the underlying media service check to complete normally.

It’s also consistent with what you saw with Books — some apps seem to attempt a one-off account check, while others (Music especially) can keep retrying and leave the settings warning behind.

Curious to hear whether allowing the Music service clears it on those devices.

HP

Shop now for HP laptops and other devices (affiliate link).

JayADee

2236 posts

Uber Geek
+1 received by user: 483

#3467137 5-Mar-2026 20:33

I’ll let you know, I’ll turn the restriction off and by morning it should have hit the iPads. Yeah the books app just does a check you can dismiss…

Here’s hoping it will clear the error without allowing anything child unfriendly because then I can just leave it alone. Otherwise I might try ‘hiding’ Apple Music next.

edit to add: still not sure this is the cause but it’s worth a try.

JayADee

2236 posts

Uber Geek
+1 received by user: 483

#3467172 6-Mar-2026 07:35

Yeah, so that didn't work.

I have been wanting to try removing the user in intune-> device serial-> users and re-adding the users on the iPad but I hadn't been able to get the user list for this iPad to show up (the ones you really need to do something to never do.)

With all the changes to the device restrictions I thought why not attempt one last passcode reset? That was a bit of a disaster, I got a stuck apple logo right after the user google login part. I did a force restart and am now restoring the iPad in iTunes on my laptop.

If I have to I can create a brand new Google login and start from scratch on these accounts since it was a test group but it seems a bit crazy to have to go that far.

I'm still thinking that either having the device policy set to restrict changes to account during account creation OR the passcode reset is the culprit.

Sooo, I have a restored iPad sitting here I'm going to try re-adding two messed up plus one ok account to and will see what happens!

Update Edit: added the 3 accounts to the iPads, all 3 have the error. This is with the change account settings enabled (been enabled over 24 hrs).

JayADee

2236 posts

Uber Geek
+1 received by user: 483

#3467199 6-Mar-2026 09:46

I removed the three accounts from the iPad using InTune, used a fresh test, fake, user account federated from Google and so far this account has no errors even playing those short music (sample?) clips in the Apple Music app.

So I’m back to the individual accounts I reset are messed up, unless this test account starts giving me errors later. I’m at a bit of a loss what to try next with those accounts. If I have to I can create a new Google account which will generate a new Apple account but it seems over the top to have to.

zocster

1994 posts

Uber Geek
+1 received by user: 105

ID Verified
Trusted
Lifetime subscriber

#3467200 6-Mar-2026 09:51

That’s actually a useful test result. If a completely fresh federated account works normally on the same device, it strongly suggests the device configuration and restrictions are fine. It points more toward something stuck in the state of those original Managed Apple ID accounts rather than a problem with the iPad or the policies.

What may have happened is that when the device passcode was changed earlier while account changes were blocked, Apple flagged those accounts as needing an account security update. Because the restriction prevented the device from completing that refresh, the account state may have remained in a “pending update” condition even after being removed and re-added to the iPad.

Before going as far as creating new Google accounts, I’d try letting one of those accounts sign in on another iPad once (with account changes unblocked) so it has a chance to complete whatever account check it is trying to do. Sometimes just logging the account in on a different device or recreating its Shared iPad session clears that state.

Since the new test account works, it doesn’t look like anything in your device restrictions or Music settings is fundamentally wrong. It’s more likely those specific accounts just need a clean opportunity to refresh their Apple account state.

JayADee

2236 posts

Uber Geek
+1 received by user: 483

#3467202 6-Mar-2026 09:59

I agree, as long as the fresh account doesn’t get the same error a week from now! These ones initially seemed fine too.

I’ve been trying to think of a way to clear the error on the accounts. I have an unboxed iPad here I can start from scratch and put the affected accounts on. But I’m thinking since I have tried wiping this iPad twice now the problem might be part of the Apple account, not retained info on the iPad.

But you think it’s worth a shot?

Edit: I went into ASM, one of the dodgy user accounts, changed the child to ‘staff’ category and back again, put the passcode length back to 4 digit (from the staff 8) and put the child’s account back on the original iPad. No error at the moment.

Might try that with the other 2 faulty ones.

Edit 2: in ASM tried just changing the passcode to 8 digits, save, change back to 4 digits, save. Put the account back on the iPad, worked.

I guess in a week or two we’ll see if this works or not.
I’m going to try that on another account on another iPad that has this error without removing the account from the iPad first, see if it kicks the account loose…

Note to self: never change a user passcode

Dell

Shop now for Dell laptops and other devices (affiliate link).

JayADee

2236 posts

Uber Geek
+1 received by user: 483

#3467304 6-Mar-2026 15:39

I finally figured out if I mash the account error popup ('verification failed' popup, then 'go to settings' popup) button on the iPad account long enough it finally either gives me a pop up that allows me to re-enter the passcode or else it allows me to to go to the security settings and put the old passcode in and change it to a new one.

I got all the accounts fixed and tested at home (multiple login-logouts, music app) took them to school to make sure they'd work on their own wifi, had to repeat the exercise with a couple and when I left they were all working with no errors.

I have locked the device 'account changes' restrictions again.

I checked a few of the non-test group that didn't have any passcode changes and they still seem fine. So here is hoping when I look at them again on Monday everything is terrific.

zocster

1994 posts

Uber Geek
+1 received by user: 105

ID Verified
Trusted
Lifetime subscriber

#3467306 6-Mar-2026 15:49

Nice bit of persistence — that lines up with what it looked like earlier, where the accounts just needed a chance to complete the pending verification.

What you effectively did was force the device to finally complete the Apple account security refresh by re-entering or resetting the passcode through the prompt. Once that state clears, the warning disappears and things behave normally again.

Good sign as well that the accounts without passcode changes never showed the issue. That reinforces the idea that the trigger was the earlier passcode change combined with the account restrictions being in place at the time.

Re-locking the account changes restriction afterwards is exactly what I would have done too. At least now you know there’s a way to clear it if it ever pops up again.

Hopefully Monday is uneventful, but it sounds like you’ve got the environment back into a stable state.

JayADee

2236 posts

Uber Geek
+1 received by user: 483

#3467327 6-Mar-2026 17:01

Yes, here is hoping. All but three iPads of the 34 have updated the device restriction blocking device changes already.

Thanks for sticking around.

Prev 1 | 2

News and reviews »

New ECOVACS DEEBOT T80S OMNI Available Now
Posted 9-Apr-2026 11:11

Ring Brings 4K Video to Battery-Powered Doorbells
Posted 9-Apr-2026 11:01

Synology Announces a New Privacy-First Home Monitoring Experience for BeeStation Plus
Posted 9-Apr-2026 10:02

GIGABYTE X870E AERO X3D DARK WOOD Redefines the Motherboard
Posted 7-Apr-2026 14:06

Datacom Acquires Auckland Data Centre from T4
Posted 2-Apr-2026 09:43

Spark Launches Satellite Service with SMS and data options
Posted 2-Apr-2026 09:16

Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Updates »

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Support Geekzone »

You can support Geekzone with a one-off or recurring donation via PressPatron.

RSS feeds

Main feed

Forums feed

Copyright

©2002-2026 Geekzone®

Site features

Geekzone BI dashboard

Geekzone Badges

Geekzone Status Page

Site Information

Subscribe to Geekzone

Privacy Statement

Forum Usage Guidelines (FUG)

Advertising

Trademark and copyright