Error when adding a 2nd number to 2FA

We use Jamf Now to manage our phones with the Apple Business Manager MDM.

Under Apple Business Manager - People - Accounts ... you can add a new user which may be what we are looking for here? This simple process to create an Apple ID gets a temporary password created for you, which is emailed, then you have to set up a new password and 2FA on first use of the account .. surprise surprise I was able to use my phone number even though this had previously reached the maximum number of accounts.

I will create some more accounts and see if there is a new limit to the use of one phone for 2FA of these ABM accounts.

Does anyone know the answer to this already?

We have tested Managed Apple IDs which as mentioned above are easily set up within Apple Business Manager. We set up several using my phone number for 2FA for all of them so maybe there is no limit to this?

BUT ... Managed Apple IDs are restricted to 5G of storage and you can't subscribe to more.

AND ... with a Managed Apple ID you can't sync Messages .. this poses a problem for us when changing a lost phone, or upgrading to new phone, when we want to use iCloud to restore previous messages to the new phone.

SO .. back to normal Apple IDs .. we have to use these, and will have to let the end users use their own phone number for 2FA .. COME ON Apple, how about an improvement to this?

FORTUNATELY .. Jamf can generate a security code which can be used to unlock and reset a managed phone when you don't have access to the Apple ID account.

We did look into an MDM. In fact we used an MDM (Meraki) for 2 years. We managed to get the Meraki as part of our cell phone plan at no extra cost. It looked great at first but in practice it was not useful. It turns out any user can just remove the Meraki Systems Manager app and then that device is not managed by us any more. We found that there is no way to forbid people to remove the Systems Manager app. well actually we can enforce a policy of not allowing users to remove ANY apps but we didn't want to restrict them that much. My colleague looked for other MDM solutions that did not allow users to take over full control of their phone and found only expensive enterprise level solutions. There is just nothing at a price point that works for small to medium size business. As TMHOH-Admin says above, MDM is just not in the budget.

Well, OK, we went back to how we used to do it. That is to set up each user's phone with a private appleid linked to a private email address that only company system administrator have access to. This worked great until Apple enforced 2 factor authentication. Even then, although awkward it still worked with 2fa if I set my own phone number as a trusted number for each user's private appleID. Now that Apple has imposed a limit on how many different appleIDs a phone number can be listed as a trusted number, it just doesn't work anymore.

I may have to get one or 2 new phone numbers (and pay the monthly fee) just to manage everyone's appleID. But I don't even know how many phone numbers I would need. I have not yet learned what is the limit. Does anyone here know - for how many different appleIDs can I use my phone number as trusted number before apple says "This phone number has been used too many times. Choose a different number."

have you ever considered an MDM?

It's bad enough we're forced to upgrade to the latest iOS no matter how many times you say 'no, not now', and then being forced to use 2FA even though it doesn't work well in our environment, but then Apple decides we can only use a single verification phone number 'so many times' too? The more decisions Apple makes on our behalf and forces us into, the less business friendly their products become to a small business. We have limited funds and an MDM solution just is not in the budget. I have almost 200 apple devices I support. I need whatever this arbitrary number of 'times I can use my phone number' apple has decided is the limit to be... removed please. I can't afford to purchase more phone numbers just so I can upgrade my devices to the latest iOS, and turn on two factor because APPLE says I have to do it. We're being forced to fit into Apple's vision of a perfect world.

Guess what happens when your products no longer fit the needs of small businesses?

Thanks for sharing. I work for a company that we manage mobile fleets, primarily through a variety of MDM's, and I can tell you that if the iOS device is properly enrolled, in any MDM, the device management can not be removed by the user.

I have the exact same issue. I hope there is someone who knows. Is this a new restriction? what is the limit of how many device's for which my phone number can be set up as a "trusted phone number"?

I have the same problem .. if Apple want to restrict the use of one phone number then they should at the very least offer adding an Authenticator option for the two factor authentication?

Thanks, I'll have a look at Jamf

I think there is a 30-day period after enrolling to MDM on a phone that the user can actually opt out. This is an Apple policy that cannot be avoided during MDM enrollment.

Again, if the device is not enrolled correctly, you are correct.