Guide for Apple IT: Apple Business Manager

Posted on August 29, 2019

Apple Business Manager is a critical tool that Apple IT managers can use to help effectively manage Apple devices. In this Apple Business Manager guide, we will explore the entire portal and share some guidance on how you can make the most of this powerful tool. We will also explore how Apple Business Manager complements your Apple MDM.

We’ve noticed there is some confusion around how Apple Business Manager is different from the Device Enrollment Program (DEP) and the Volume Purchase Program (VPP). To clarify: Apple is sunsetting DEP and VPP. The DEP and VPP portals will eventually go away; they are being replaced by Apple Business Manager. Apple has given IT admins until December 1, 2019 to upgrade to Apple Business Manager.

In this guide, we’ll cover the three primary components of Apple Business Manager:

  1. Devices
  2. Content
  3. Roles

We’ll start with a basic introduction of Apple Business Manager, sometimes referred to as ABM, and then dive into more specific admin capabilities related to each area.

What is Apple Business Manager?

Here is Apple’s definition:

Apple Business Manager is a simple, web-based portal for IT administrators to deploy iOS, macOS, and tvOS devices all from one place. When used with your mobile device management (MDM) solution, you can configure device settings and buy and distribute apps and books.

To clarify, Apple Business Manager is not an Apple mobile device management (MDM) solution like Kandji, it complements and works together with your Apple MDM solution.

What Does Apple Business Manager Do?

Apple Business Manager covers three main components, which we’ll explore in detail in this guide:

  1. Devices: Enroll devices so that they can be set up automatically with MDM (this correlates to DEP)
  2. Content: Purchase Apps and Books in bulk and manage licenses for users (this correlates to VPP)
  3. Roles: Delegate admin privileges and manage content across locations

Although Apple is slowly phasing out Device Enrollment Program (DEP) and Volume Purchase Program (VPP) terminology in order to unify both concepts under the Apple Business Manager umbrella, we’ll continue to refer to these terms throughout the guide to show you how all these pieces fit together.

Who Uses Apple Business Manager?

Apple Business Manager is designed for anyone who is managing Apple devices for a business, usually an IT admin. 

Apple Business Manager also has a counterpart for the education sector, called Apple School Manager.

How Do I Upgrade to Apple Business Manager?

If you haven’t already upgraded to Apple Business Manager, Apple has made it really seamless to upgrade from DEP and VPP without losing any of your data or existing DEP or VPP tokens. Just sign in to deploy.apple.com or business.apple.com using your Apple Deployment Programs Agent account and follow the instructions. Apple has laid out some helpful upgrade steps here.

Now that we’ve introduced Apple Business Manager, let’s dive into the details of how to use it.

 

1. Devices

Apple Business Manager, together with your MDM, makes it easy to deploy Apple devices that you’ve purchased directly from Apple (or an authorized reseller).

Why Manage Devices In Apple Business Manager?

Once devices are tied to your Apple Business Manager account, it makes deployment much simpler as your company scales. It guarantees that the device is owned and managed by your business (your IT department) instead of the individual employee.

Your devices must be tied to Apple Business Manager in order to be eligible for functionality like device assignments, zero touch deployment, App Store (VPP) application management, and much more.

Purchasing Devices and Managing Suppliers

To make sure all your devices are tied to Apple Business Manager, you need to ensure any new devices you purchase are linked to your account. There are two ways to do this:

  1. Purchasing devices through Apple
  2. Purchasing devices through an authorized reseller

Take the following steps to ensure your suppliers are connected to your Apple Business Manager portal:

  • Apple Business Manager → Settings (lower left sidebar) → Device Management Settings
  • If purchasing devices through Apple, click Edit next to Customer Numbers, and add your Customer Number
  • If purchasing devices through an authorized reseller, click Edit next to Customer Numbers and add their Reseller IDs (you may need to contact your reseller and ask them to send you their Reseller ID)

The Power of Apple Business Manager + MDM

Now that your devices are connected to Apple Business Manager, you can take action on those devices using your third-party MDM solution. 

At a high level, here is how the process works (see the following sections for detailed instructions):

  1. Link your MDM server to your Apple Business Manager account
  2. Associate each device to an MDM server (you may have multiple servers; for example, you may have a dedicated server for iOS and another for macOS)

MDM servers window in Apple Business Manager.Image source: support.apple.com

Once Apple Business Manager and your MDM are connected, you can unlock some very powerful device management functionality. 

How to Link Your MDM Server to Apple Business Manager

Your MDM will likely have their own set of instructions for you to follow to link their MDM server, but the linking process generally follows these steps:

  • Apple Business Manager → Settings (lower left sidebar) → Device Management Settings
  • Click Add MDM Server, and then enter a name (must be a unique name, but doesn’t need to be any specific format; you can also change the name later if you need to)
  • Upload the public key certificate file (this file, ending in .pem or .der, will be provided by your MDM vendor)
  • Click Download Token
  • Upload the token to your MDM solution (steps will vary depending on your MDM)

Note: You may need to update your token if, for example, the person who downloaded the original token changes their Managed Apple ID password or, as a security measure, if that person leaves your organization.

How to Link Your Devices to MDM

How to Associate a Device to an MDM Server by Default

You can set defaults for associating a device to an MDM server, which allows you to assign devices automatically, in bulk. You can even do this if you have multiple MDM servers for different types of devices. For example, you may manage iOS devices on one server and macOS devices on another.

  • Apple Business Manager → Settings (lower left sidebar) → Device Management Settings
  • On Default Device Assignment, click Edit to select the default MDM server

Device assignments in Apple Business Manager.Image source: support.apple.com

Assigning Newly Purchased Devices to an MDM Server

If you’ve just placed a new device order with Apple or a reseller, you can also assign devices to an MDM that way. There are three ways to assign devices:

  1. Serial number: For smaller orders where you have physical access to the device
  2. Order number: For larger orders, if a single MDM is being used for an entire order
  3. Upload CSV file with serial numbers: For specific device groups

You can access all three methods by going to Apple Business Manager → Device Assignments (left panel).

Zero Touch Deployment

Using your MDM and Apple Business Manager, zero touch deployment allows you to automatically prepare devices for new employees without physically touching them.

Apple describes it like this

For example, you can order the devices from Apple, configure all the management settings, and have the devices shipped directly to the user’s home address. After the device is unboxed and activated, the device is automatically enrolled in your MDM solution and all management settings, apps, and books are ready for the user.

This process is enabled by what was formerly called the Device Enrollment Program (DEP), now Apple Business Manager. However, it is through an MDM solution that zero touch deployment is configured and executed.

The step-by-step process for setting up zero touch deployment will differ based on your MDM provider, but the key takeaway is to ensure that your solution integrates with Apple Business Manager, formerly DEP, to unlock this capability.

Release a Device from Apple Business Manager

Devices can be released if they have been retired, lost, or stolen. Although it is possible to release devices using Apple Business Manager, many IT admins prefer to do this within their MDM.

If you do this within Apple Business Manager, there are three ways you can release a device:

  • Serial Number
  • Order Number
  • Upload CSV with Serial Numbers

You can access all three methods by going to Apple Business Manager → Device Assignments (left panel).

 

2. Content

Another major area of focus for Apple Business Manager is content, which refers to Apps and Books you purchase and give to your employees (this function was previously managed through the Volume Purchase Program, or VPP). As with devices, Apple Business Manager works hand-in-hand with your MDM to manage content. This is a two-step process:

  1. Use Apple Business Manager to purchase App Store Apps or Apple Books content
  2. Use your MDM to distribute App Store or Apple Books to your employees’ devices; this can be done remotely, without having to physically touch the device

As with devices, purchasing content through Apple Business Manager ensures that the management of those licenses stays within your company’s control. For example, if an employee leaves your company, their app licenses can be revoked or reassigned to another employee.

Adding Content Managers

If you’re the admin of an Apple Business Manager account, you have the ability to delegate Content Managers who can purchase and distribute content. You may want to handle this yourself, or assign certain groups or locations to another purchaser. Here’s how to invite a Content Manager:

  • Apple Business Manager → Settings (lower left sidebar) → Enrollment Information
  • Click Invite VPP Program Facilitator and enter the Apple ID of the purchaser you want to invite (see the section below on Managed Apple IDs)

You can also add Content Managers to specific locations in Apple Business Manager. Content Managers will only be able to see and access locations they are assigned to.

Purchasing Apps and Books (formerly VPP)

Before Apple Business Manager, you would have purchased content from the VPP portal. Once you have migrated to Apple Business Manager, you’ll purchase content by going to Apple Business Manager → Apps and Books (left sidebar) → Search Accounts. 

During the migration process, you’ll choose a location for the licenses to be assigned. You can easily transfer licenses between locations after purchase (however, this applies only to Apps; Books are tied to a specific user and cannot be transferred).

Distributing Content: Apple Business Manager + MDM

Although you purchase licenses for Apps and Books in Apple Business Manager, the distribution of those licenses can only be done through an MDM. 

It is recommended by Apple to assign content to devices before they are given to employees. Also, it is recommended to assign content to devices, not users. 

However, this process will vary based on your MDM. For example, in Kandji, we manage this process through a flexible object called Blueprints. Groups of devices are assigned to a Blueprint, which contains a set of apps, configuration profiles, and parameters. Blueprints can be created based on team, department, location, or various security requirements.

VPP distribution can be slow if you are working with a high volume of apps. Plan ahead and try to distribute content in batches to keep the process running smoothly.

Third-Party Apps Not In Mac App Store

Although purchasing and distributing content from the Mac App Store is pretty simple, it can get complicated if a particular App doesn’t exist in the Mac App Store.

For many reasons which we won’t cover in this post, there are common business apps that are not available in the Mac App store, such as Adobe Creative Cloud, Google Chrome, Zoom, and Sophos.

Purchase and distribution of non-Mac App Store Apps, sometimes referred to as third-party apps, will be managed exclusively from your MDM and will vary greatly depending on your MDM solution. In Kandji, we make it easy to add any third-party app by simply dropping in a .zip, .pkg, .dmg, or .app file.

 

3. Roles

This leads us to the third area of focus for Apple Business Manager: managing roles. Roles really means defining who is allowed to use the system and how. We are also going to cover some other activities exclusive to admins, such as tracking activity, managing Apple IDs, and more.

Role Management in Apple Business Manager

There are five different role types in Apple Business Manager:

  1. Administrator
  2. People Manager
  3. Device Manager
  4. Content Manager
  5. Staff

Apple has a useful table that breaks down the role privileges for each one.

Roles are tied to locations, so a user may have different role privileges for each location they are assigned to.

To edit a role privilege for a user, go to Apple Business Manager → Accounts → Search for your desired Account and click Edit.

Note: Role management is not intended for end users, only for those who will be performing management tasks within Apple Business Manager. End users will be imported through your MDM. For example, Kandji does this by syncing with your G Suite or Office 365.

Working with Managed Apple IDs

Managed Apple IDs are created for each account within Apple Business Manager. Managed IDs should only be created for employees that leverage Apple Business Manager for management functions. You will create a Managed Apple ID for a user before assigning them a role in Apple Business Manager.

Apple support has a great article with best practices for how to structure and create Managed Apple IDs.

View Activity & Log Files

If you need to pull activity reports or troubleshoot errors in Apple Business Manager, you can view its log files. Apple has provided a table with detailed breakdown of all the activity types.

However, we’ve found that admins tend to view activity and logging in their MDM instead of Apple Business Manager. Logging is incredibly useful for troubleshooting errors or ensuring your actions were successful. In our experience, the most helpful MDM activity tracking is visible in two ways:

  1. Global activity stream: A single stream of global activity across all devices and users that can be viewed, filtered, and downloaded
  2. Individual device activity: While looking at a device record within an MDM, seeing the device-specific activity; in our opinion, this is less common than it should be

kandji-apple-mdm-device-activity

For example, common types of activities visible within Kandji include:

  • MDM commands failed or completed
  • Blueprints created or changed
  • Applications failed or successfully installed
  • Applications blacklisted
  • New device enrollments
  • Devices active or missing
  • Parameters changed
  • Remediations failed or completed

Support

If Apple Business Manager admins need more questions answered, here is a list of primary Apple support outlets. Also, be sure to familiarize yourself with the level of support offered by your MDM provider. 

 

Apple has made it clear that Apple Business Manager is designed to complement an MDM solution. However, not all MDM solutions integrate with Apple Business Manager the same way, so make sure you explore your MDM’s integration capabilities in depth. 

Kandji is committed to helping you get the most out of Apple Business Manager. With Kandji, you can be confident that your Apple fleet is in safe and secure hands from deployment to retirement. Try Kandji for free today.