Organisation administration · Public
Configure Apple Business
Connect Apple Business to Skyfallen ONE with OpenID Connect, Shared Signals Framework (SSF), SAML, and SCIM provisioning.
Apple Business integrates with Skyfallen ONE through federated sign-in and directory provisioning. ONE acts as the identity provider: OpenID Connect and SSF handle sign-in and security events, while SCIM synchronizes membership data to Apple Business Manager.
A complete integration usually involves three ONE surfaces:
See Configure SCIM provisioning for generic SCIM behaviour that also applies to Apple connectors.
| Surface | Purpose in Apple Business |
|---|---|
| OIDC Apps | Federated sign-in and SSF event delivery |
| SAML Apps | Sign-on URL Apple reads when the SCIM connection is created |
| SCIM provisioning | User account creation, updates, and deactivation |
Prerequisites
Administrators whose Apple Business role can configure federation cannot sign in through federated authentication themselves; they manage the connection only.
| Requirement | Details |
|---|---|
| Organisation type | Enterprise |
| Verified domain | The Apple Business domain must be verified before federation or directory sync |
| Organisation toggles | OIDC application management, SAML application management, and SCIM application management enabled by Skyfallen |
| Configure permissions | oidc:manage, saml:manage, and scim:manage on your membership |
| Run-sync permission | scim:provision on your membership |
| Member data | Every provisioned member needs a primary email address |
Configure OpenID Connect and SSF
Apple Business uses OpenID Connect for federated sign-in and the Shared Signals Framework (SSF) for backchannel security events such as session revocation and credential changes.
1. Record ONE configuration URLs
- Sign in at iam.skyfallen.one.
- Switch to the enterprise organisation you manage.
- Open SSO → OIDC Apps.
- Select Configuration URLs.
- Copy these values for Apple Business:
| ONE value | Apple Business field |
|---|---|
| Issuer | Not entered directly; used to build the URLs below |
| OIDC discovery | OpenID Connect configuration URL |
| Shared signals | SSF configuration URL |
If your organisation uses a custom IAM hostname, use the issuer and discovery URLs shown for that hostname. Do not mix URLs from different hostnames.
2. Create the OIDC application in ONE
- In SSO → OIDC Apps, select New application.
- Enter a recognizable name, such as AppleBusinessOIDC.
- On the integration step, set:
| Field | Value |
|---|---|
| Redirect URIs | https://gsa-ws.apple.com/grandslam/GsService2/acs |
| Allowed scopes | openid profile email offline_access ssf.read ssf.manage |
| Client type | Confidential |
| Require PKCE | Enabled |
- Complete the legal, access, and session steps, then save the application.
- Copy the generated Client ID and Client secret immediately. The secret is shown only once unless you reset it.
ONE issues ssf.read automatically when ssf.manage is granted. Apple requires both scopes.
3. Connect Custom Identity Provider in Apple Business
- Sign in to Apple Business with a role allowed to configure federation and identity providers.
- Open Settings → Domains.
- Under User sign-in and directory sync, select Get started for the domain.
- Choose Custom Identity Provider, then continue.
- Enter a connection name, such as Skyfallen ONE.
- Paste the ONE Client ID, Client secret, OpenID Connect configuration URL, and SSF configuration URL.
- Complete Apple’s connection test with a single non-administrator test account before enabling federation for the full domain.
Prepare the SAML application
Apple Business reads your ONE SAML sign-on URL when the SCIM connection is created. Create the SAML application before configuring SCIM even though federated sign-in uses OpenID Connect.
- In IAM, open SSO → SAML Apps.
- Create the SAML application Apple Business will reference during SCIM setup.
- Record the ONE Entity ID / Issuer and Sign-on URL.
- Complete and save the SAML application.
See Configure SAML applications for every SAML field. The SCIM provisioning page also displays the issuer and sign-on URL while you configure Apple Business.
Configure SCIM provisioning
Apple Business combines account data imported through SCIM with properties managed in Apple Business. ONE intentionally does not send groups or roles to Apple, so Apple-assigned roles remain authoritative.
1. Create the connector in ONE
- Open SSO → SCIM provisioning.
- Select Add SCIM app.
- Enter a recognizable name, such as AppleBusinessSCIM.
- Choose Apple Business as the provider.
- Leave the client ID and client secret empty until Apple Business generates the real values.
- Enable Deactivate users removed from ONE if removed memberships should become inactive in Apple Business.
- Save the connector.
- Copy the OAuth callback URL shown for the saved connector.
The Apple preset fixes these values:
2. Create Custom Sync in Apple Business
- In Apple Business, open Settings → Domains.
- Under Directory Sync, select Set up for the domain.
- Next to Custom Sync, select Enable.
- Paste the ONE OAuth callback URL.
- Create the connection.
- Create the SCIM Application.
- Copy the generated SCIM client ID.
- Create and copy the SCIM client secret, choosing a validity period of 6, 9, or 12 months.
- Store both values securely before leaving the page.
Apple gives you four calendar days to transfer the credentials to ONE and establish the connection. If that window expires, create the connection again.
3. Complete authorization in ONE
- Return to SSO → SCIM provisioning in ONE.
- Edit the Apple Business connector.
- Paste the Apple SCIM client ID and client secret.
- Save the connector.
- Select Authorize.
- Sign in to Apple Business with an administrator account.
- Review the authorization request and continue.
- Return to ONE and confirm that the connector status is connected.
- Select Sync to perform the initial synchronization.
The initial Apple synchronization can take longer than subsequent cycles. Enabled ONE connectors also run hourly.
| Setting | Value |
|---|---|
| SCIM connector base URL | https://federation.apple.com/feeds/business/scim |
| Authorization URL | https://appleid.apple.com/auth/oauth2/v2/authorize |
| Token URL | https://appleid.apple.com/auth/oauth2/v2/token |
| Token revoke URL | https://appleid.apple.com/auth/oauth2/v2/revoke |
| Authentication | OAuth 2.0 |
| OAuth client authentication | POST body (client_id and client_secret) |
| Unique user identifier | userName |
Attribute mapping
ONE searches for an existing remote user by externalId before creating one. Do not change this identifier in Apple Business.
| ONE source | SCIM attribute |
|---|---|
| Membership ID | externalId and enterprise employeeNumber |
| Primary email | userName and primary work email |
| First and last name | name.givenName, name.familyName, and displayName |
| Phone | Primary work phone, when present |
| Organisation legal name or name | Enterprise organization |
| Active membership | active: true |
| ONE permissions | Not sent to Apple Business |
| Action | Where | Notes |
|---|---|---|
| Run SCIM sync now | SCIM connector → Sync | Requires scim:provision |
| Reauthorize SCIM OAuth | SCIM connector → Authorize | Required after replacing an OAuth client secret or revoking access |
| Replace expiring SCIM secret | Apple Business, then ONE | Renew before the selected Apple expiry period ends, save in ONE, and authorize again |
| Reset OIDC client secret | OIDC Apps → Reset secret | Update the secret in Apple Business Custom Identity Provider |
| Pause scheduled SCIM runs | Clear scheduled provisioning on the connector | Keeps the connector and credentials |
| Problem | Resolution |
|---|---|
| Federation test fails in Apple Business | Confirm redirect URI, client ID, client secret, and the exact OpenID and SSF configuration URLs from Configuration URLs |
| Apple rejects SSF scopes | Ensure the OIDC application allows ssf.read and ssf.manage |
| SCIM authorization is rejected | Confirm the SCIM client ID, client secret, callback URL, and Apple authorization/token URLs |
| Apple setup expired | Recreate Custom Sync in Apple Business and repeat SCIM authorization |
| Apple attributes are read-only | Expected while SCIM is connected; disconnecting in Apple converts them to manual accounts |
| Removed users remain active in Apple | Enable deactivation on the SCIM connector and run another sync |
Permission summary
Full definitions are in Organisation permissions reference.
| Permission | Who needs it | Purpose |
|---|---|---|
oidc:manage |
IAM administrators | Create and maintain the Apple Business OIDC application |
saml:manage |
IAM administrators | Create the SAML application referenced during SCIM setup |
scim:manage |
IAM administrators | Create, edit, authorize, pause, and remove the SCIM connector |
scim:provision |
Directory operators | Start an immediate SCIM synchronization |