Apple Business setup for IT teams

Apple has merged Apple Business Manager, Apple Business Essentials and Apple Business Connect into one service, Apple Business. Older documentation and some MDM integrations still call it ABM. What Apple Business offers can differ by country, so check what's available where you are before you decide how to manage your devices.

If you use a separate MDM, you assign your eligible devices to it in Apple Business. The MDM then delivers the enrolment settings, apps and security policies.

First check that your organisation details in Apple Business are correct, and find out what Apple needs to verify them. For devices bought directly from Apple, link your Apple customer number. For a participating reseller, give them your organisation ID and add their reseller ID in Apple Business. These are separate routes, so if you buy both ways, you need both links.

Before an order ships, ask the supplier to confirm they've registered the devices to your organisation. A Mac that isn't registered won't enrol in your MDM by itself when it's first switched on.

Then assign a test device to your MDM and go through Setup Assistant yourself. Check the enrolment profile, the mandatory settings and whether your network lets the device reach Apple and your MDM. A device listed in Apple Business isn't configured yet. This test shows you whether the setup works.

Apple Configurator can add supported devices that were bought outside these routes. The method depends on the device and on which Configurator app you use. It can mean erasing the device, so plan a backup and a time when the person can do without it.

A device added this way starts in a provisional period. During that time, the person using it can still remove it from management. Check which models qualify and Apple's current instructions before you plan to add a whole batch this way.

Decide first what you need Managed Apple Accounts for. If your identity provider is supported, federation lets people sign in with the work account they already use. Before rollout, verify your domains and sort out conflicts with personal accounts. These come from staff who created a personal Apple Account with their work email address. Many apps need no Managed Apple Account at all, because you can assign them to the device.

Connect Apps and Books to your MDM with the token of the location that should own the licences. Then test one licence from start to finish. Assign it, remove it and give it to another device, to see whether licences come back when a device is retired. Note which account and which location own the token, so whoever renews it knows where it came from.

The MDM server token and the Apps and Books token both expire. Give each one a named owner, put the dates in a calendar and renew before they run out. After each renewal, enrol a test device or assign an app. When a token lapses, enrolled devices usually carry on, so the problem tends to show up with the next new device or app.

The APNs certificate lets your MDM contact your devices. It's renewed outside Apple Business, with the same Apple Account that created it. If someone creates a new certificate, every enrolled device loses the link and has to enrol again.

Releasing a device removes it from your organisation in Apple Business, and it no longer enrols automatically. That's what you want for a Mac you sell or give away. Make release a step in your retirement process, and give the right to release devices only to the administrators who do that work.

Apple Business · Apple Platform Deployment