Personal Apple ID appears managed by unauthorized MDM

legrandconde wrote:

I have tried on different MacBooks belonging to friends with their own AppleIDs and then with their AppleIDs on my MacBook and your assertion seems accurate for the second notification "enter the password....".

…

So contact Apple Support, and ask them about the status of this account.

Hopefully poking at this didn’t do what this is supposed to do, and enroll the Apple Account into the company or school.

legrandconde wrote:

And one more thing, I had collected logs unified during log stream showing that the appleID had the "MAID" attribute.

https://discussions.apple.com/content/attachment/13c91a80-b866-4a4e-8c60-4eb984730fb6

It is not clear why you are now posting logs from 2025-05-03, but I think you may be misunderstanding what you are seeing there. A request has been made using the Function requestMAIDAuthenticationWithManagedAppleID:personaID: ephemeral: requireAppleMAID: completionHandler:

which I would expect to occur when attempting to sign in for a Work or School account. The log shows what each value was used for that request:

• requestMAIDAuthenticationWithManagedAppleID: - That is what you see as the Apple ID email address (MAID) that was entered by the user.
• personaID: - Is an object of the class type <PersonalID> and None was included in the request.
• ephemeral: - Is a type of managed account where the management only occurs when signed in, such as what you would see on the Work or School sign in so it is set to YES. Management restrictions are removed when signed out of the Work or School management.
• requireAppleMAID: - Boolean value indicating if the request is for an Apple Account. When signing into the Work or School account, it specifically asks for the Apple Account so you see AppleMAID:YES. With the Work/School sign in it will be using either the Apple Business Manager(ABM) or the Apple School Manager(ASM) which means it would be using a Managed Apple ID(MAID) for that request.
• completionHandler: - This is probably the most important part of the request and where you would see the results from the request using those values from above. A completion handler runs on a background thread and will return at a later time so the main thread is not blocked. Nothing in that log shows what was returned from that authentication request.

I am guessing that you thought on that line it was telling you that the email address was a managed account because you saw AppleMAID:YES, and did not realize it was the value used to create the request. The results of the request are not shown and they may not even be logged. The engineers insert the Log command whenever they want to write anything to a log file for debugging purposes and they choose what information they want to include in that log for their own purposes. There is very little user benefit to a log file.

You can't log into a Work or School account with your personal Apple Account, and if you try you will see that exact same message and those logs. Your device is not being managed with any MDM software. The logs are assuming you are attempting to use a managed Apple Account and that will always fail for those exact reasons. The only reason why you would attempt to log in there is if you did have a managed account. It is not used to identify if your account is managed.

As for the core capture daemon (corecaptured) presumably the that’s a documented part of macOS. Here is the man page:

Or maybe this was a reference to the credential manager daemon? AppleCredentialManagerDaemon is a not-particularly-documented daemon used for securely handling user credentials including passwords, tokens, auto-filled data, and the like. It’s a part of the security subsystem on macOS, iOS, and iPadOS, and gets involved in all sorts of system activities including secure connections and purchasing.

Here is some of credential management: Streamline sign-in with passkey upgrades and credential managers - WWDC24 - Videos - Apple Developer

This mechanism is for enrolling (managing, supervising) a device, not for identifying an enrolled device.