Quick Summary
Apple Business Manager (ABM) helps organisations deploy Apple devices, manage apps, and control user accounts from a single platform. This guide explains how to set up ABM, integrate with MDM, and avoid common mistakes when managing leased Apple devices.
Here’s an overview of the steps involved:
- Initial ABM setup and domain verification
- Create and manage Managed Apple IDs
- Configure essential ABM settings
- Integrate with MDM solutions (Shepherd or Jamf)
- Deploy devices with zero-touch enrolment
- Manage apps and licences.
- Avoid common ABM pitfalls with leased devices
Why Listen to Us?
Devices for Teams has deployed 50,000+ Apple devices through ABM for UK businesses with 50–1,000 employees. As an Apple Authorised Reseller, we configure ABM accounts daily for businesses adopting Apple Device as a Service.
Our team of Support Professionals integrates ABM with Jamf, Microsoft Intune, and Shepherd MDM across various sectors.
We're trusted by...
What is Apple Business Manager?
Apple Business Manager (ABM) is Apple’s free, web-based portal that allows organisations to manage business-owned Apple devices from the point of purchase. It links Macs, iPhones, and iPads directly to your organisation, so devices enrol automatically into your chosen MDM the first time they are switched on.
For organisations leasing Apple hardware, ABM is essential. Without it, devices look like personal purchases, limiting security controls and recovery options. With ABM in place, device ownership is clear, and every Apple device follows the same rules from day one.
Why Apple Business Manager Matters for Your Business
- Maintains Business Ownership of Devices: Ensures Macs, iPhones, and iPads are tied to your organisation, not personal Apple IDs, which is critical for leased or shared devices.
- Enables Zero-Touch Deployment: Devices enrol automatically into MDM on first power-on, removing manual setup and reducing IT workload.
- Improves Security and Compliance: Applies consistent security policies, encryption, and access controls across every Apple device from day one.
- Simplifies Joiners and Leavers: New starters receive ready-to-use devices, while leavers’ devices can be locked, wiped, and redeployed without delay.
- Scales With Modern Working Models: Supports remote, hybrid, and multi-site teams by allowing centralised management without handling devices directly.
Apple Business Manager Initial Setup: Step-by-Step Instructions
Step 1: Sign Up for Apple Business Manager
Visit business.apple.com/signup and click “Get Started.”
You’ll need:
- Your business’s legal name and D-U-N-S number (obtain free from Dun & Bradstreet)
- A company email address (personal emails like @gmail.com aren’t accepted) and website
- Your business’s physical address and phone number
Apple sends a verification code to your email. Enter this code to proceed. Enrolment typically completes within 24-48 hours for UK businesses with verified D-U-N-S numbers.
Step 2: Verify Your Domain
Domain verification proves your organisation controls your email domain. Navigate to Settings > Account > Verification in ABM. Apple provides a TXT record containing a verification string.
Access your domain’s DNS settings (contact your IT department or web hosting provider if needed). Add Apple’s TXT record exactly as provided:
Host: @
Type: TXT
Value: apple-domain-verification=xxxxxxxxxxx
TTL: 3600
Note: Copying the TXT record incorrectly breaks verification. Use copy-paste rather than manual typing.
DNS propagation takes 15 minutes to 24 hours. Once done, return to ABM and click “Verify Domain.” A green confirmation indicates success.
Step 3: Add Administrators
Navigate to Settings > Account > Administrators. Click the “+” button to add admin users. Assign one of four roles:
- Administrator: Full account access, including purchasing
- Content Manager: Manages apps and books only
- Device Enrollment Manager: Handles device assignments only
- People Manager: Creates Managed Apple IDs only
It’s best to assign two administrators initially: yourself and a backup from IT or operations. Limit the administrator role to prevent accidental changes. With this, your initial setup stage is complete.
Account Creation in Apple Business Manager (+ Common Mistakes to Avoid)
After Apple Business Manager is set up and your domain is verified, the next step is creating Managed Apple IDs. These accounts allow employees to access Apple services while keeping devices under business control.
Managed Apple IDs are owned by your organisation, not the individual, which is critical when managing leased Apple devices.
Here are the steps involved:
Step 1: Define a Clear Managed Apple ID Structure
Use role-based Managed Apple IDs such as [email protected] and avoid shared inboxes or generic accounts. Using personal Apple IDs during setup is a common mistake, as it ties devices to individuals rather than the business.
Step 2: Choose Manual Accounts or Federated Sign-in Before You Start
Apple Business Manager supports two methods:
- Manual account creation within ABM
- Federated authentication using Microsoft Entra ID or Google Workspace
If you plan to use federation, enable it before creating Managed Apple IDs. Enabling federation after accounts already exist often causes conflicts and duplicate identities.
Step 3: Create Managed Apple IDs
Go to People > Add and create accounts individually or in bulk using a CSV file.
Assign each user:
- A Managed Apple ID
- The appropriate role (standard user, People Manager, or other limited role)
Limit administrator roles to key IT staff and only grant the access each user needs. A frequent mistake is assigning admin permissions to non-IT users, which increases security and configuration risks.
Step 4: Control Access to iCloud and Apple Services
Decide which Apple services users can access, such as:
- iCloud Drive
- Device backups
- Find My
For leased devices, limiting iCloud access helps prevent Activation Lock and simplifies device recovery and redeployment. Allowing unrestricted iCloud access on leased devices often leads to Activation Lock problems and delays when devices need to be recovered.
Step 5: Test on a Real Device
Before rolling out at scale, sign in with a Managed Apple ID on a test device. Confirm:
- Automatic MDM enrolment
- App installation
- Security policy enforcement
Skipping this step commonly results in enrolment or app deployment issues during live onboarding.
Essential Configurations in Your Apple Business Manager (ABM)
These are necessary settings that ensure devices enrol automatically, remain secure, and are easy to manage at scale.
1. Device Enrolment Integration
To enable zero-touch deployment, Apple Business Manager must be connected to your Mobile Device Management (MDM) platform, such as Shepherd, Jamf, or Microsoft Intune.
To connect ABM to your MDM:
- In Apple Business Manager, go to Settings > Device Management Settings
- Select Add MDM Server
- Download the public key file
- Upload this file to your MDM platform’s ABM integration section
- Your MDM generates a server token—download this token
- Upload the server token back into Apple Business Manager
Once connected, Apple devices purchased through authorised resellers, such as Devices for Teams, automatically appear in ABM, typically within 24 hours.
To assign devices to your MDM:
- Go to Devices
- Select the relevant devices
- Choose Edit Device Management
- Assign them to your MDM server
This ensures devices enrol into MDM automatically the first time they are switched on.
2. Integrating Shepherd MDM with Apple Business Manager (ABM)
Shepherd MDM is designed for managing Apple devices in UK organisations. When integrated with ABM, it enables:
- Automatic device enrolment on first power-on
- App deployment through Apple’s app licensing system
- Security policy enforcement, including passcodes, encryption, and FileVault
- Centralised device inventory and status visibility
To integrate Shepherd MDM with ABM:
- Log in to the Shepherd MDM dashboard
- Go to Settings > Apple Business Manager
- Select Configure ABM Integration
- Upload the ABM server token generated earlier
Once completed, Shepherd synchronises your Apple device inventory, usually within minutes.
For organisations using Devices for Teams’ Apple Device as a Service, this integration is handled as part of onboarding, removing the need for manual technical setup.
3. App and Licence Distribution Using Apps and Books
Apple Business Manager includes Apps and Books, which centralises app purchasing and licence management.
To assign apps:
- Go to Apps and Books > Apps
- Search for the required app (for example, Microsoft 365, Slack, or Adobe Creative Cloud)
- Select Get and choose the number of licences
- Assign licences to either Managed Apple IDs or devices
Best practice: Assign licences to users rather than devices. This allows apps to follow the employee if they receive a replacement or upgraded device, reducing rework and licence waste.
Common Pitfalls When Using ABM With Leased Devices
- Forgetting to Remove Devices at Lease End: When leased devices are returned, they should be removed from Apple Business Manager to avoid confusion with newly issued hardware. Go to Devices > Select the device > Actions, then Remove.
- Not Supervising Leased Devices: Enable supervision during MDM enrolment to enforce key controls such as Activation Lock management, AirDrop restrictions, and mandatory VPN usage. Without supervision, users can factory reset devices and bypass management entirely.
- Using Personal Apple IDs on Leased Devices: Personal Apple IDs on leased devices create data security risks. Enforce the Managed Apple IDs-only policy through MDM. Shepherd MDM blocks personal Apple ID sign-ins automatically.
- Insufficient Admin Accounts: Avoid bottlenecks by having at least two admin accounts with full access, plus department-specific content managers for smoother operations.
Benefits of Using ABM With an MDM Solution
Apple Business Manager delivers the most value when combined with a Mobile Device Management (MDM) solution such as Shepherd MDM, Jamf, or Microsoft Intune. Together, they create a controlled, scalable system for managing leased Apple devices from day one.
Key benefits include:
- Zero-Touch Deployment: Devices ship directly to employees, automatically enrolling them into MDM. Apps, VPN profiles, and security policies are applied without IT handling the device.
- Automated App Updates: MDM pushes app updates via ABM’s VPP integration, ensuring apps like Adobe Creative Cloud update automatically without user interaction.
- Enhanced Security: ABM’s DEP enrolment prevents MDM removal, ensuring employees cannot factory-reset supervised devices without admin credentials.
- Simplified Licence Management: ABM tracks app licence usage, allowing quick licence reassignment when staff leave, unlike traditional App Store purchases, which remain tied to devices.
How ABM and MDM Support Different Use Cases
Hybrid Workforce Management
ABM enables devices to be shipped directly to remote employees and enrolled automatically into MDM. This removes the need for in-office setup and ensures every device follows the same security and configuration standards.
How Devices for Teams Supports
We pre-enrol MacBooks in your ABM account before shipping, eliminating the device assignment step. Staff receive devices ready for zero-touch setup. Our UK support team handles any enrolment issues remotely.
Education Sector Deployment
ABM’s “Classes” feature groups students by year. Teachers assign different apps to Year 7 (basic productivity) vs Year 11 (advanced coursework apps). iPad enrolment through ABM typically completes within minutes per device. Shared iPad mode lets multiple students use a single device.
How Devices for Teams Supports
We configure the ABM class structure pre-deployment. iPads arrive pre-enrolled with age-appropriate restrictions (no social media, filtered web access).
Scaling Start-Up Rapid Growth
ABM standardises configurations regardless of device quantity. Hiring 10 people monthly? ABM enrols their MacBooks identically using preset profiles. Compliance auditors verify enforcement through ABM’s reporting, passcode policies, FileVault encryption, and VPN usage.
How Devices for Teams Supports
Our Flex plan lets you add MacBooks mid-term without renegotiating contracts. We ship devices within 48 hours, pre-configured in your ABM. When staff numbers fluctuate, we return unused MacBooks penalty-free, and ABM automatically removes them from inventory.
Retail Multi-Location Management
ABM’s location groups organise devices by store. Deploy store-specific apps (Birmingham gets the local inventory app, Manchester gets a different version). Lost iPad? ABM’s remote lock and wipe prevent data exposure. Damaged MacBook? Ship replacement, ABM auto-configures for that store manager.
How Devices for Teams Supports
We ship pre-configured devices directly to each store location. Store managers unbox and hand to staff, with no IT involvement. When stores open/close, you can adjust device quantities on your subscription. Our Shepherd MDM integration provides real-time device health monitoring for all locations.
Why Choose Devices for Teams for Apple Business Manager?
- Complete ABM Setup: We handle all ABM setup steps, from account creation to MDM integration. Devices arrive pre-enrolled and ready to use.
- Apple Authorised Partner Expertise: As authorised resellers, we resolve ABM issues through direct Apple support channels.
- Pre-Configured Device Delivery: Devices ship pre-enrolled in ABM, ready for staff to authenticate and start working almost immediately.
- Ongoing ABM Administration: Need updates or changes? Our UK team handles ABM adjustments as part of your DaaS subscription, without extra fees.
- Proven Track Record: 4.9 Trustpilot rating, ISO 27001 accredited, and over 40 years of experience deploying ABM for UK businesses across various sectors.
Frequently Asked Questions
What's the difference between ABM and MDM?
ABM manages device procurement, enrolment, and app licences. MDM (like Shepherd) manages security policies, app deployment, and remote troubleshooting. ABM triggers automatic MDM enrolment when devices power on. You need both for complete Apple device management.
How long does ABM setup take?
Domain verification takes 24-48 hours. Initial ABM configuration (adding admins, creating Managed Apple IDs, integrating MDM) takes 2-4 hours for in-house IT teams. Devices for Teams completes full setup within 48 hours as part of onboarding.
Can I integrate ABM with Microsoft Intune?
Yes. ABM supports Intune, Jamf, Shepherd, and most enterprise MDM solutions. Integration requires uploading ABM’s server token to Intune’s Apple MDM settings. Devices for Teams configures Intune-ABM integration during onboarding.
How much does Apple Business Manager cost?
ABM itself is free. Costs come from MDM solutions (Shepherd, Jamf, Intune charge £8-15 per device monthly) and VPP app licenses. Devices for Teams includes Shepherd MDM at no additional cost in our Apple Device as a Service subscription.
What's the minimum number of devices needed for ABM?
No minimum. ABM benefits start with 5+ devices, automating enough configuration to save IT time. Organisations with under 5 Apple devices may find manual configuration simpler than ABM administration overhead.
Job Title: Website Coordinator
LinkedIn Link: https://www.linkedin.com/in/lauren-millar-09b085198/
Specialise in: Digital Marketing, Website
Interests: Going to the gym, Socialising with friends