I use VMware Fusion to run a few virtual machines; I have one for Windows 10, another for the current version of macOS, and another when there is a beta version of the new operating system. I don’t use these often, but I do need them for testing from time to time.
This morning, I noticed that I hadn’t yet updated my macOS virtual machine to High Sierra, so I downloaded the latest installer and updated it. Around the time the update finished – I wasn’t in front of my Mac – I got an alert on my iPhone that my Apple ID was locked for security reasons. I proceeded to unlock it, but I had to reset the password. And, of course, sign in again on every one of my devices, often in multiple apps or settings, create new app-specific passwords for certain apps, and so in. It takes a couple of hours to do this.
Now this happened to me a few weeks ago, when I installed the macOS Mojave beta in a virtual machine. I thought there might be a connection between that installation and the reset, but I couldn’t be sure. Now I am.
It seems that the virtual machine is somehow doing something that Apple interprets as a security risk; perhaps it tries to sign in too many times to my iCloud account, and Apple blocks it. This is good security, but since I have two-factor authentication on that account, I would expect that I first receive an alert or email that a device is trying to sign into my Apple ID. I see this every time I use, say, a new browser to use one of Apple’s services, or when I get a new Apple device. But for some reason, the virtual machine is not prompting the same type of alert.
Am I alone in seeing this? Is anyone else having this issue? If not, it would be interesting to find out what is causing this for my account. I’ve contacted Apple support, and they are escalating this, but it will take a few days to get an answer.