In a co-managed setup, the internal IT person often holds the most important Apple credentials: the Organisation Administrator role in Apple Business, the DMS (formerly MDM) console and the admin vault. If they’re the only person who holds them, their last day can quietly lock the business out of its own devices.
The fix is to give every admin credential a second owner before anyone resigns, hand over in a set order on exit day, and remove the leaver’s access last. If you’ve already lost access, Apple has a recovery route through AppleCare. This is about the person who runs IT. Ordinary leavers are covered in what happens to a Mac when an employee leaves, and the wider split of who owns what is in our co-managed responsibility matrix.
What breaks when the only Apple Business administrator leaves?
Nothing, at first
Devices keep working, apps keep updating, and people carry on. That’s what makes this easy to miss. The calls we get about it rarely come on the leaving day. They come weeks later, when someone tries to set up a new MacBook and can’t sign in to Apple Business.
Then the routine jobs stop
Without an Organisation Administrator, you can’t add devices to Apple Business, assign them to your DMS, change roles or manage the DMS connection. Two annual renewals are the usual tripwire. The token that links Apple Business to your DMS expires every year, and so does the Apple push certificate your DMS uses to talk to devices. That certificate has to be renewed with the same Apple Account that created it. If that account belonged to the person who left and nobody can get into it, the fallback is a new certificate and re-enrolling every device.
Which admin credentials need a second owner before anyone resigns?
Apple Business
Have at least two Organisation Administrators. In a co-managed fleet, one of them is often your IT provider. Apple’s own guidance is to add a second Organisation Administrator before changing how admin password resets work, because losing every admin account means going through AppleCare.
The verified email and phone on each admin account
Admin accounts sign in with a Managed Apple Account password and a six-digit code sent to a verified phone number. Apple’s documentation says administrator accounts can’t use federated sign-in through Microsoft Entra ID or Google Workspace, even when everyone else does. So the phone that receives that code matters, and if it’s someone’s personal mobile, recovery leaves with them. Use email addresses on your own domain and phone numbers the business controls.
The DMS console
Whether you run Addigy or another platform, the console needs a second named admin with their own login and MFA. Check which Apple Account renews the push certificate, and make sure it’s one the business owns.
FileVault recovery keys and Activation Lock
FileVault recovery keys should be escrowed in your DMS for every Mac, so whoever has DMS access can unlock a Mac if its owner forgets the password. Apple Business can turn off Activation Lock on company devices, which is another reason the admin role can’t sit with one person.
The password vault and your identity provider
The admin vault in 1Password needs at least two people with owner rights. The same goes for the global admin role in Microsoft Entra ID or Google Workspace, since that’s where federation for everyone else is configured.
For each of these, write down who the second owner is and where the recovery route is documented. A note that only lives in the leaver’s head doesn’t count.
What is the handover sequence on exit day?
Start as soon as you know someone’s leaving, because the last day is too late for most of this. The order matters.
During the notice period
- Add a second Organisation Administrator in Apple Business.
- Change the verified email and phone on each admin account to ones the business owns.
- Add a second admin to the DMS console.
- Move the push certificate’s Apple Account to a business-owned account, if it isn’t already.
- Confirm that the DMS holds a FileVault recovery key for every Mac.
- Give a second person owner rights in the admin vault and the identity provider.
- Ask each new owner to sign in to each system and confirm that it works.
On the last day
- Change the shared passwords that the leaver knew.
- Remove the leaver’s admin roles.
- Disable the leaver’s accounts.
Never add the replacement admin and remove the leaver on the same day. Removing the leaver comes last, and only after the second owner has signed in successfully everywhere. The Cyber Essentials requirements expect accounts to be removed when someone leaves, including accounts used by an IT provider, so this order keeps you compliant without risking a lockout.
What can you do if you have already lost access?
If another Organisation Administrator still has access
They can reset the leaver’s password and verification phone number in Apple Business. If one administrator requests a password reset through Apple’s account reset page, every other Organisation Administrator is emailed. If nobody acts within 72 hours, Apple sends a reset link to the account’s verified email and phone, and that link lasts seven days.
If the only administrator’s details are still reachable
A sole Organisation Administrator can reset their own password straight away through Apple’s account reset page, as long as the business can still receive the code on the verified phone.
If every administrator account is gone
Apple’s documentation says to contact AppleCare, which will confirm your identity and start the reset. Apple doesn’t publish a timescale or a full list of what the check needs, so have your organisation’s legal details, the D-U-N-S number you used to set up Apple Business, and someone with authority to act for the business ready before you call. For the DMS console, contact the vendor’s support.
The fifteen-minute audit
Open Apple Business and count the accounts with the Organisation Administrator role. If there’s one, add a second before doing anything else. Then check that the email and phone on each admin account belong to the business, and that FileVault recovery keys and the DMS console each have a named second owner. If any of those four checks fail, talk to us about co-managed support, and we’ll help you close the gap this week.
Related articles
- Co-managed IT: Who actually owns what? A responsibility matrix for Mac-first businesses
- Bringing a new internal hire into an existing co-managed arrangement
- What happens to a Mac when an employee leaves: the offboarding steps most businesses skip
FAQs
What happens if our only Apple Business administrator leaves?
Day-to-day, very little. Devices keep working. The problems start when you need to add or assign a device, change a role, or renew the annual token and push certificate your device management depends on. Without an Organisation Administrator, none of that can happen until access is recovered.
How many Organisation Administrators should we have?
At least two, and in a co-managed fleet, one is usually your IT provider. Apple itself recommends adding another Organisation Administrator before changing password reset settings. Each admin account should use a business email address and a business-controlled phone number, so access never depends on one person’s mobile.
Can our IT provider hold an Apple Business admin account?
Yes, and in a co-managed setup it’s common. Give the provider its own named account and keep it separate from your internal team’s. Under Cyber Essentials, accounts used by an IT provider are in scope, so they need the same controls and the same removal process as anyone else’s.
How long does AppleCare take to restore admin access?
Apple doesn’t publish a timescale, and the only figures around are individual reports. Plan as if it could take a while, and keep your organisation’s legal details and D-U-N-S number to hand. The far quicker route is never needing it, which is why a second administrator matters.
