As a MacAdmin, you probably know what an MDM is. But MDM is only half the story if you're new to Mac management. The other half is ABM.
Apple Business Manager (ABM) is an easy-to-use cloud portal that allows businesses to manage the deployment and configuration of Apple devices, Apple IDs, apps, and content within their organization. It merges the capabilities of two prior Apple programs — the Apple Volume Purchase Program (VPP) and the Apple Automated Enrollment Program (ADE, formerly DEP, initially launched in 2013.)
Apple Business Manager is your source of truth regarding your business's Mac inventory.
Think of ABM as a tree. 🌳 You can visualize ABM's features as branches that streamline your organization's management of Apple devices. Each branch is critical in managing your devices, like inventory and enrollment, connecting with your MDM, licensing apps and books, and handling roles and Apple IDs. |
Apple Business Manager key features
ABM offers a range of features designed to simplify the deployment and management of all your Apple Devices, from iPod to Mac Pro.
Device enrollment: ABM allows automatic enrollment of Apple devices into your organization's MDM solution, bypassing manual configuration (for more info, see our support pages.) Your devices automatically flow into your managed device inventory. This applies to Apple devices purchased directly from Apple or authorized resellers or carriers.
MDM: You can connect your ABM account with any MDM solutions you employ. This enables you to distribute your device inventory to your selected MDMs directly from within ABM, offering the flexibility to automate this process according to device models.
Volume Purchase Program: Through ABM, you can buy apps and books in bulk and distribute them to individual devices or users across your organization. This feature ensures every user and device has the necessary tools to function in the company.
Content management: ABM provides centralized control over app updates and changes, enabling better coordination and increased efficiency in managing digital resources.
Managed Apple IDs: With ABM, organizations can also create Managed Apple IDs for employees. These are distinct from personal Apple IDs and are owned and operated by the business.
Role assignment: ABM allows administrators to assign roles with varying permissions and capabilities to different individuals within the organization. This ensures that team members can access only the necessary features and data.
Apple School Manager and Apple Business Essentials
Apple Business Manager (ABM) is part of a family of management tools that includes Apple School Manager (ASM, found at school.apple.com) and Apple Business Essentials (ABE, found at business.apple.com).
Introduced in 2016, ASM aligns closely with ABM's capabilities but is tailor-made for educational institutions. It assists schools in deploying iPads, Macs, and Apple TV units and creating Managed Apple IDs for students and staff, acting as the digital tree trunk of a modern classroom.
ASM has specialized features for an educational environment that includes designated roles for students and instructors, integration potential with Student Information Systems (SIS), remote app locking during class, and a Classroom App for iPad-based teaching.
Apple Business Essentials (ABE) launched in June 2022, following Apple's acquisition of MDM-provider Fleetsmith. This service, although similar in appearance to ABM, enhances its elder sibling's offerings with additional cost-based benefits, encompassing support and iCloud storage. This tool is designed for small businesses, and many companies prefer a more powerful MDM solution.
Device enrollment simplified
With your organization's MDM solution, such as SimpleMDM, you can automatically enroll devices bought directly from Apple or selected carriers and resellers. This feature notably cuts down your setup time and seamlessly handles the onboarding and offboarding process for employees without needing physical access.
ABM also has a whole host of features ensuring an effortless device setup. Automated device enrollment enables businesses to control the initial startup behavior of their devices. When paired with SimpleMDM, organizations get the double benefit of being able to skip specific setup screens during the Setup Assistant phase, enforce automatic software installations, and remain consistent with company security standards. The impact? An efficient open-the-box-and-start-working experience for employees.
ADE and ABM
You may have encountered the term ADE or Apple Automated Device Enrollment, in earlier SimpleMDM blog posts. Today, I want to highlight one of Apple Business Manager's key features: automatically enrolling devices in your chosen MDM solution!
All Apple devices tied to your ABM (bought directly from Apple or authorized resellers, carriers, or added manually through Apple Configurator) are automatically enrolled into your MDM. Notably, this auto-enrollment is exclusive to ABM.
Once part of the Apple Device Enrollment (ADE) program, each device is streamlined to align with your company's or school's requirements. This includes pre-installing relevant apps, alignment with a particular MDM, applying custom settings, and more. This auto-configuration bypasses manual setup, saving your admin team valuable time and resources.
Distribute apps and books in volume.
ABM's approach to app and book licensing
Apple Business Manager (ABM) provides a streamlined solution for businesses to manage app licenses. It lets you purchase licenses directly from Apple and allocate them to employees using their Apple IDs or serial numbers. It eliminates the necessity for individual App Store purchases and enables businesses to reclaim and reassign licenses effortlessly. Additionally, ABM enhances its license management scope to include digital books, supporting companies in bulk purchasing and distributing book licenses across employees' devices.
The convenience of store credit
To streamline large-volume purchases, ABM introduced the Volume Credit feature. Businesses can prepurchase credits and redeem them for app or book licenses as needed, all through the regular purchase order process.
Partitioning licenses across business locations
ABM offers a Location option for businesses operating across multiple locations. This feature allows companies to designate locations, balance their app distribution, and book licenses among them. Each location has a Volume Purchase Program (VPP) token that simplifies license management.
Create Managed Apple IDs and Assign Roles
Note: Since December 2021, administrators must verify the domains associated with any ABM account, proving the domain ownership. See FAQ for the how-to instructions.
Roles
ABM allows organizations to grant varying access levels to multiple administrators, enabling efficient operations. These roles include Owner, Administrator, People Manager, Device Enrollment Manager, Content Manager, and Staff.
Integrating Managed Apple IDs
ABM administrators register domain names within the interface. For instances where Microsoft Azure Active Directory (Azure AD) or Google Workspace is used, ABM supports federated authentication, allowing employees to use their existing credentials as Managed Apple IDs.
A Managed Apple ID (MAID) is an Apple ID owned by an organization instead of an individual. Managed Apple IDs are currently used in two ways:
Administrators: Assigned Managed Apple IDs to sign into Apple Business Manager and manage accounts.
Employees: Use Managed Apple IDs when enrolling their device to an MDM via User Enrollmentauthenticatescontrols. The Managed Apple ID is used to authenticate the user, control access, and provides app and book licenses.
Within Apple Business Manager, administrators register domain names (yourbusiness.com, for example). Apple IDs with these domains are then generated within the interface.
Benefits of ABM with SimpleMDM
As stated previously, ABM should be your source of truth. Devices are ideally "born" into ABM from purchase and "die" by being released from your ABM organization. Otherwise, your devices never leave ABM itself and will move between MDM branches. (Remember our tree analogy?)
1. Full life-cycle management of all your devices
wipesThis means zero-touch deployment for the MacAdmin using ADE via ABM. With an ABM account linked directly to SimpleMDM, devices can be ready to use immediately upon unpacking. Thanks to ADE, even after a device wipes or resets, devices re-enroll into management, ensuring consistently optimal security.
2. VPP
The applications you purchase through VPP show up in your SimpleMDM account.
Go to Apps & Media > Catalog.
From here, you can filter by App Store Apps and see how many licenses are available to distribute.
3. Controlled updates
When devices are auto-enrolled through ABM into SimpleMDM, they are automatically placed under Supervision. This enhanced level of control provides businesses with additional tools for remote update deployment, ensuring all devices are up to date with the latest security patches and app versions. This maintenance aids in the hardware population compliance of every user with the hardware population.
Apple Business Manager FAQs
Is Apple Business Manager free?
Yes, Apple Business Manager is free.
Apple Business Manager does not cost money; however, it works best when paired with a quality MDM solution, which may have associated costs.
Can you use ABM without MDM?
Technically, you could use Apple Business Manager (ABM) without an MDM solution; however, with an MDM, you can leverage the full capabilities provided within ABM. Without an MDM, ABM primarily serves as an inventory database of Apple serial numbers.
How do you release devices from ABM?
You can release devices through your MDM solution or via Apple Business Manager. This may be critical if a device is lost or stolen. The Apple Business Manager device release process includes these steps:
Sign in to Apple Business Manager from an account with an Administrator or Device Enrollment Manager role.
In the sidebar, click Devices. Search the target device based on the serial number, order number, or CSV file.
Select the device or devices you want to release. Read the dialogue.
Select Release Devices.
Read the additional dialogue. Tick the box next to I understand that this cannot be undone.
Click Release.
How do I verify my Domain in ABM?
As of December 2021, administrators must verify the domains associated with any Apple Business Manager account by proving the company owns the Domain. You can do this by providing a TXT record to the DNS zone file. The verification process consists of the following steps:
Sign in to Apple Business Manager from an Administrator or People Manager account.
Click the user's name at the bottom of the sidebar, then click Preferences, then Accounts.
In the Domains section, click Add Domain. Add your desired Domain, then click Continue.
Click Verify. A TXT record appears. Click Copy.
Paste the TXT record into your DNS zone file.
Finalize the verification by confirming that the TXT record was added. Remove the TXT record from the DNS zone file after verification is complete.
Interested in taking Apple Business Manager for a spin with all the bells and whistles? Start a trial with SimpleMDM and receive a fully functional account within minutes.
