Apple defines strict roles and permissions for tasks in Apple Business Manager (ABM) and Apple School Manager (ASM). Federated Authentication requires elevated privileges, as it links your Apple deployment to an identity provider such as Microsoft Entra ID. According to Apple's learning guides, only the roles ofAdministrator and People Managercan enable and configure federated authentication. Other roles such as Content Manager or Device Enrollment Manager have no authority to make federation-level changes. This restriction ensures only trusted admins with organizational oversight can integrate Apple IDs with external identity systems, minimizing security risk and maintaining compliance.
References:Apple Business Manager User Guide - "Roles and privileges"; Apple Learning - "Federated Authentication."