Accounts

The Accounts section of the Apple Policy Editor adds mail, Exchange, Google, calendar, contacts and directory accounts to iPhone, iPad and Mac. Click Add account and choose the type. The section also contains the Allow account modification restriction (supervised devices).

On a Mac (macOS 13 or later) the accounts are installed in the session of the users enrolled in the management, usually the user who enrolled the Mac, when they're logged in. The device page lists these users under Mac users, with the state of their accounts. Accounts that take the email address from the device user use the user assigned to the Mac in Cerberus Enterprise.

Common settings

• Name and email of the device user (Mail, Exchange, Google): each device uses the name and email address of its user, set in the Users page (for Google, the user's Google account). Devices without a user, or whose user has no email address, don't get the account. Otherwise, set a fixed email address and full name.
• Account name (optional): the name of the account in Settings and in the apps.
• User name and Password (optional): the user name can contain the variables $EMAIL$, $USERNAME$, $FULLNAME$, $SERIAL$ and $UDID$. Leave the password empty to let the user type it on the device, or leave both empty to let the user type them.
• Applies to: limit the account to some device types.

Account types

• Mail account: IMAP or POP incoming server and outgoing server, with their ports and authentication. The outgoing server can use the same user name and password as the incoming one.
• Exchange account (Exchange ActiveSync): the server, or empty to find it from the email address. Choose the services (mail, contacts, calendars, reminders, notes) and whether the user can change them. With Modern authentication (OAuth) the user signs in with the page of your identity provider, for example Microsoft 365. An Authentication certificate (iOS 17 or later) authenticates the device with a certificate.
• Google account: the user signs in to the Google account with the given email address.
• Calendar account (CalDAV) and Contacts account (CardDAV): the server, port and path.
• Directory (LDAP): the server and port, and the searches (search base, scope and description) used to look up contacts.
• Subscribed calendar: the URL of the calendar (https, http or webcal).

S/MIME

Mail and Exchange accounts can sign and encrypt messages with S/MIME (iOS 17 or later). For each one, choose the certificate: one of the Certificates page, the certificate of the device user, or requested from a SCEP server. You can let the user turn it off, choose another certificate and, for encryption, show a switch for each message.

Security

Passwords and certificates aren't part of the settings sent to the devices: each device downloads its own credentials from Cerberus Enterprise, signing the request with its management certificate. They aren't written in the logs.