With Apple Platform SSO, employees can use a Managed Apple ID to sign in on macOS, iOS, or iPadOS devices and automatically enroll into Swif for device management. Below are two ways to integrate Swif with Apple’s Platform SSO:
CNAME approach – Point your chosen domain to
apple-enrollment.swifteam.com
.Hosting JSON – Serve a
.well-known/com.apple.remotemanagement
file yourself for Apple to fetch enrollment details.
Important
If you need both BYOD (Bring Your Own Device) and non-BYOD (Company-Owned/ADE) enrollments, handle them differently depending on the approach.
CNAME approach uses one domain and differentiates BYOD vs. non-BYOD via email prefixes.
Hosting JSON requires two separate domains—one for BYOD JSON and one for non-BYOD JSON.
Make sure to add each user’s Managed Apple ID to their Employee record in the Swif portal (see Section 2) so Swif recognizes them during enrollment.
1. Prerequisites
(Same as in the original article.)
Admin access in Swif and Apple Business Manager (ABM) or Apple School Manager (ASM).
Ability to configure DNS (for CNAME) or upload files to your domain (for JSON hosting).
Managed Apple IDs set up in ABM/ASM for your employees.
2. Set Up Employee’s Managed Apple ID
Each employee who will use Apple Platform SSO needs a Managed Apple ID in your ABM/ASM.
Create or Update the Managed Apple ID in ABM/ASM.
In Swif, edit the employee’s profile and add the Managed Apple ID to the Managed Apple ID field. This ensures Swif matches the user to their device enrollment.
2.1 Differentiating BYOD vs. Non-BYOD
CNAME approach:
You have one domain, e.g.
mdm.yourcompany.com
, pointed toapple-enrollment.swifteam.com
.Separate employees’ IDs by prefix or suffix, e.g.
BYOD:
username.byod@swif.yourdomain
Non-BYOD:
username@swif.yourdomain
Hosting JSON:
You need two different domains or subdomains (one for BYOD JSON, one for non-BYOD JSON).
Match each user’s Managed Apple ID domain to the correct enrollment flow.
employee@byod.yourcompany.com
→ fetches BYOD JSONemployee@company.yourcompany.com
→ fetches non-BYOD JSON
3. Method 1: CNAME to Swif
Pick a subdomain
For example,
mdm.yourcompany.com
.
Create a CNAME record
Point
mdm.yourcompany.com
→apple-enrollment.swifteam.com
.
Verify
Check via a DNS lookup tool.
Set Your Domain to Swif
In the Swif admin console, set the domain you want to use for Platform SSO.You can also set it on the Device Enrollment page.
Enrollment (Optional, you can test enrollment at #6)
On an Apple device, go to System Settings (macOS) or Settings (iOS/iPadOS) → General → Device Management (or VPN & Device Management).
Tap or click Sign in to Work or School Account.
If prompted for a domain, enter
mdm.yourcompany.com
.User enters their Managed Apple ID (e.g.,
username@swif.yourdomain
).Swif will automatically enroll the device as BYOD or non-BYOD based on the user’s ID prefix/suffix.
No separate Swif login prompt is required; the Managed Apple ID sign-in triggers the entire SSO flow.
4. Method 2: Host the JSON on Your Own Domain(s)
4.1 Two Domains for BYOD and Non-BYOD
Each domain can only serve one JSON at
/.well-known/com.apple.remotemanagement
.If you need both BYOD and non-BYOD, create two domains or subdomains, e.g.:
byod.yourcompany.com
→ BYOD JSONcompany.yourcompany.com
→ Non-BYOD JSON
4.2 Obtain the Correct JSON
Swif provides:
Non-BYOD (Company-Owned / ADE)
{ "Servers": [ { "Version": "mdm-adde", "BaseURL": "https://mdm.swifteam.com/api/v1/sso/enroll?team-identifier={{IDENTIFIER}}" } ] }
BYOD
{ "Servers": [ { "Version": "mdm-byod", "BaseURL": "https://mdm.swifteam.com/api/v1/sso/enroll?team-identifier={{IDENTIFIER}}&isbyod=true" } ] }
The {{IDENTIFIER}}
is your Swif team identifier.
4.3 Serve the JSON Immediately at /.well-known/com.apple.remotemanagement
Create the
.well-known
folderFor example:
byod.yourcompany.com/.well-known/com.apple.remotemanagement
company.yourcompany.com/.well-known/com.apple.remotemanagement
Return the JSON
The URL must serve only this JSON text—no
.json
filename, no extra HTML.
Enrollment Flow (Optional, you can test enrollment at #6)
On the Apple device
Open System Settings (macOS) or Settings (iOS/iPadOS) → General → Device Management (or VPN & Device Management).
Tap or click Sign in to Work or School Account.
Enter Your Managed Apple ID
Apple prompts the user for the Managed Apple ID to proceed with Platform SSO.
If the user’s ID domain is
byod.yourcompany.com
, Apple fetches the BYOD JSON; forcompany.yourcompany.com
, it fetches the non-BYOD JSON.
No Extra Sign-In
Once Apple validates the Managed Apple ID, the device automatically follows Swif’s enrollment—no separate Swif credentials are required.
5. Add Managed Apple ID to Apple Business Manager and Swif
Add a new managed domain, eg.
swif.<yourdomain>
or{{DOMAIN}}
to Apple Business Manager (ABM) -> Managed Apple Accounts. You need to create a TXT record on your DNS server to verify the newly added managed domain.After the domain is verified and added to ABM, please remove the TXT record from your DNS server.
Create a managed Apple ID for the employee (device user) on Apple Business Manager with these managed Apple ID formats:
CNAME:
For BYOD (Bring your own device) users: xxx.byod@swif.{yourdomain}
For Non-BYOD users: xxx@swif.{yourdomain}
JSON Hosting:
For BYOD (Bring your own device) users: xxx@byod.yourcompany.com
For Non-BYOD users: xxx@company.yourcompany.com
After creating, please send an email to inform the user to finish signing on ABM.
6. Test Enrollment
To enroll a device via Platform SSO, please follow the steps here.
On the Apple Device
Go to System Settings (macOS) or Settings (iOS/iPadOS) → General → Device Management (or VPN & Device Management).
Tap or click Sign in to Work or School Account.
Enter Your Managed Apple ID
Apple will prompt the user for the Managed Apple ID to proceed with Platform SSO.
Swif Enrollment
If the system finds a valid JSON in the domain of the managed Apple ID (
{{DOMAIN}}/.well-known/com.apple.remotemanagement
), it will trigger the Swif enrollment flow.
Enrollment Completes
The device finalizes MDM enrollment with Swif. Users will see confirmation of a “Work or School” account added.
7. Troubleshooting & FAQs
DNS Checks
For the CNAME approach, confirm
mdm.yourcompany.com
→apple-enrollment.swifteam.com
.For JSON, ensure
/.well-known/com.apple.remotemanagement
is publicly accessible and returns only the JSON.
Managed Apple ID Setup
Make sure each employee’s Managed Apple ID is also updated in Swif’s Employee settings. Without this, Swif cannot match the user during enrollment.
BYOD vs. Non-BYOD
CNAME: Use email suffixes like
.byod
vs. no suffix.JSON: Use separate domains for each scenario.
One JSON per Domain
Apple only supports a single JSON response at
/.well-known/com.apple.remotemanagement
per domain.
No Additional Authentication
Platform SSO handles enrollment with the Managed Apple ID, so employees do not sign in separately to Swif.
Contact Support
If enrollment fails, check device logs and your domain setup. Contact Swif Support if you need more assistance.
That’s it! By setting up your domain and JSON (or CNAME) and assigning each employee’s Managed Apple ID in Swif, you’ll enable a seamless Apple Platform SSO flow. Users simply sign in with their Managed Apple ID on the device, and enrollment completes automatically—no separate Swif login is required. For more details, see Swif’s Knowledge Base or contact our Support team.