… and …
> There is one thing I need to mention for anyone going the separate iCloud account route on corp devices: you probably should make sure you have it logged in from a personal Mac or something like that, or some other place where you can have passcodes sent. The reason is that if you should quit, you lose access to the authorized devices (phone, laptop) which will receive auth codes.
> Assuming you ever want to turn that off, you're going to need some way into the account. If you don't have a way to approve the login and provide the passcode, fixing that is going to be rather difficult.
> For this reason, you'll probably want to go create a separate non-admin account on your Mac, then associate it with that "burner" iCloud account, and just let it sit there. Don't use that account on the machine for anything else. Then, if you ever need to get back in and shut things down to stop the autopay stuff, you'll have a way.
Use iCloud Family and make child accounts for corp devices.
As the “parent” account, you control the “child” account, even if the company controls the device, and you can allow the child account to use the apps or music you own, track where the device goes, etc. etc..