Apple Business Manager
A practical step-by-step guide to apple business manager, including preparation, instructions, common issues, tips, and next steps.
Apple Business Manager (ABM) is a free web portal that lets your company buy, assign, and manage Apple devices, apps, and accounts from one dashboard. The outcome is simple: devices you buy arrive enrolled to your company, and you control who gets access. The main caution is that some setup steps are hard to undo, so plan your structure before you click through them.
Fast Answer
- First step
- Sign up at business.apple.com with your company's legal entity details and a verified business domain.
- Core setup
- Add your reseller ID, create Managed Apple Accounts, and link a Mobile Device Management (MDM) server.
- Time needed
- 1-2 hours
- Difficulty
- Moderate
- Watch out for
- Device Activation Lock
Before You Start
- Company legal details: Your registered business name, address, and a tax ID or D-U-N-S number. Apple verifies these against public records.
- Verified domain: You need to prove you own your company's email domain before you can create Managed Apple Accounts.
- An MDM server: ABM is the source of truth for devices and accounts, but it does not push settings. You need a separate MDM tool to enforce passcodes, install apps, and wipe devices.
- A decision-maker: Someone who can approve which devices are company-owned and whether you allow personal (BYOD) devices.
- A reseller or carrier account number: Required to get new and existing device purchases automatically added to ABM.
Step-by-Step Instructions
-
Register your organization
Go to business.apple.com and select Enroll. Enter your company's legal name exactly as it appears on your tax documents. Provide a D-U-N-S number if you have one; otherwise Apple can look it up for you during signup.
You will need a business email address on your company domain, not a personal Gmail or Yahoo account. Apple uses this to verify you are a real business and not an individual reselling devices.
Tip: Use a shared inbox like [email protected] rather than a single person's address. If that employee leaves, you won't lose access to the admin account.
-
Verify your business domain
After registration, Apple asks you to prove you own your email domain. You add a TXT record to your DNS settings or upload a verification file to your website. This step usually clears within 24 hours.
Once verified, you can create Managed Apple Accounts that use your company domain, such as [email protected]. These accounts are owned by the company, not the employee, which matters when someone leaves.
Watch out: If your IT team already uses Google Workspace or Microsoft Entra ID, you can federate. This means your existing directory manages logins, and ABM just trusts it. Do not duplicate accounts manually if federation is an option.
-
Connect your reseller or carrier
In ABM, go to Preferences > Device Management Settings and add your reseller's ID. You will need to call your reseller and ask them to link your ABM customer number to their account. Most major carriers and authorized resellers support this.
Once linked, any device you buy through that reseller automatically appears in ABM when it ships. You do not have to manually enroll devices one by one.
Tip: Ask your reseller for their "Apple Authorized Reseller ID" before you call. Having it ready saves a back-and-forth.
-
Add your MDM server
In ABM, go to Settings > MDM Servers and create a new server entry. Download the server token (.p7m file) and upload it into your MDM tool. The MDM tool will give you a push certificate; upload that back into ABM.
This handshake is what lets your MDM push settings to devices. Without it, ABM knows a device exists but cannot enforce anything on it.
Renew early: The MDM push certificate expires after one year. If it lapses, all device management stops working until you renew it. Set a calendar reminder 30 days before expiration.
-
Assign devices to people or groups
When a device appears in ABM, you assign it to an MDM server. You can assign it to a specific user or to a group like "Sales" or "Warehouse." The assignment tells the device which MDM profile to pull on first boot.
For devices already in use, you can manually add them using Apple Configurator on a Mac. This is useful for devices bought before you set up ABM.
Tip: Use groups, not individual assignments, whenever possible. When someone leaves, you just remove them from the group and the device reassigns automatically.
-
Create Managed Apple Accounts
Go to Accounts and create accounts for your team. Each account gets a company email address and iCloud storage. You can assign roles like Administrator, Manager, or Staff.
Use federation if your company already runs Google Workspace or Microsoft Entra ID. Federation means you do not create accounts in ABM at all; they sync from your identity provider.
Watch out: Managed Apple Accounts are not the same as personal Apple IDs. Users cannot merge them, and they cannot use the account to buy personal apps or media. Keep this distinction clear in your onboarding docs.
-
Buy and assign apps and books
In ABM, go to Apps and Books, search for the app you need, and buy licenses in bulk. You can assign licenses to users or devices. Device-based assignment is better for shared iPads; user-based is better for one-person-one-device setups.
You can also enable "custom apps" if you have an in-house app that is not in the public App Store. You will need a separate agreement with Apple for that.
Tip: You can revoke and reassign app licenses. If someone leaves, reclaim their license and give it to the next hire. You do not pay twice.
-
Test with one device before rolling out
Before you enroll 50 laptops, take one device and run through the full setup. Erase it, connect it to Wi-Fi, and confirm it pulls the MDM profile automatically. Check that the apps you assigned install correctly and that the passcode policy applies.
Document what you see. This becomes your internal setup guide for new hires and saves hours of repeated troubleshooting.
Do not skip this: A misconfigured MDM profile can lock you out of your own test device. Always keep a spare admin account and a recovery method before you enforce strict policies.
Quick Reference
| Use this | Why | |
|---|---|---|
| New device from reseller | Automatic enrollment via reseller ID | Device arrives pre-linked to ABM with zero manual work |
| Existing device already in use | Apple Configurator on a Mac | Manually adds device to ABM without wiping it first |
| Employee leaves the company | Remove from group, reassign device | Reclaims the device and app licenses for the next hire |
| Shared iPad for a team | Device-based app assignment | Apps stay on the device regardless of who logs in |
| Company uses Google or Microsoft directory | Federation | One login for email and Apple services, no duplicate accounts |
| MDM certificate about to expire | Renew 30 days early | Prevents management breaking on all enrolled devices |
Common Problems When You Set Up Apple Business Manager
Most ABM problems come from one of three places: verification, assignment, or certificates. Here is what to watch for and how to fix it.
Domain verification fails
If Apple cannot verify your domain, check that the TXT record is published correctly. Use a public DNS lookup tool to confirm. The most common cause is a typo in the record value or a DNS provider that has not propagated the change yet. Wait 24 hours before escalating to Apple support.
Devices do not appear after purchase
This usually means your reseller did not link your ABM customer number to their system. Call them and confirm the link is active. Also check that you added the correct reseller ID in ABM preferences. If the device was bought through a retail store, it will not auto-enroll, and you will need to add it manually.
MDM enrollment loops or fails
If a device keeps asking for the MDM profile but never finishes, the push certificate may be expired or mismatched. Delete the MDM server entry in ABM and re-add it. If that does not work, check your network. Some corporate firewalls block Apple's enrollment ports.
Managed Apple Account conflicts
If a user already has a personal Apple ID with the same email address, you cannot create a Managed Apple Account with that address. The user must change their personal Apple ID email first, or you assign a different company address. This is a common snag during onboarding.
Activation Lock on a returned device
If an employee leaves and their device is Activation Locked, you need their personal Apple ID password to unlock it unless you set up ABM correctly from the start. With ABM and MDM, you can bypass Activation Lock because the device is company-owned. Always enable this in your MDM settings before you hand out devices.
Advanced Tips for Apple Business Manager
Once the basics work, these moves save time and reduce risk as your fleet grows.
Use federated authentication
If your company runs Google Workspace or Microsoft Entra ID, federate with ABM. Users log in with their normal work credentials. When you disable their account in your directory, they lose Apple access automatically. No separate offboarding step needed.
Set up a staging Apple ID for setup
During initial device setup, you need an Apple ID to reach the home screen. Create a dedicated staging account, like [email protected], and use it only for setup. This keeps your personal admin account out of the enrollment flow and makes troubleshooting easier.
Automate app assignment with groups
Instead of assigning apps to individual users, assign them to groups like "Field Sales" or "Warehouse." When you hire someone, add them to the group and they get the right apps automatically. When they leave, remove them and the licenses return to the pool.
Review your device assignment regularly
Every quarter, run a report in ABM that shows which devices are assigned where. Look for devices that are unassigned, assigned to former employees, or sitting in a server you no longer use. Cleaning this up prevents security gaps and license waste.
Keep a break-glass admin account
Create one Administrator account in ABM that is not tied to a real person and store its credentials in a password manager. If your primary admin loses access or leaves, this account gets you back in. Document it in your IT runbook.
Final Checklist for Apple Business Manager
- Company registration complete: Legal name, address, and tax ID verified with Apple.
- Domain verified: TXT record or file upload confirmed, enabling Managed Apple Accounts.
- Reseller linked: Customer number shared with your reseller and reseller ID added in ABM.
- MDM server added: Push certificate uploaded and token downloaded, with renewal date set.
- Test device enrolled: One device erased and confirmed to pull the MDM profile on setup.
- Groups created: Device and user groups set up for app assignment and reassignment.
- Admin accounts secured: Break-glass admin created and credentials stored safely.
- Federation reviewed: Directory integration configured if your company uses Google or Microsoft.
- Offboarding process written: Steps to remove a user, reassign their device, and reclaim app licenses.
- Quarterly review scheduled: Calendar reminder to audit device assignments and certificate expiry.
Next action: If you have not registered yet, go to business.apple.com and start the enrollment. If you are already enrolled, open your MDM server settings and confirm the push certificate has more than 30 days before expiry. That one check prevents the most common outage.
Apple Business Manager FAQ
Is Apple Business Manager free?
Yes. ABM itself is free. You pay for the devices, apps, and any MDM software you choose. Apple does not charge for the portal.
Do I need an MDM to use ABM?
You can use ABM without an MDM, but you will not be able to enforce settings, push apps silently, or wipe devices remotely. For any serious device fleet, an MDM is required. ABM only handles device ownership and account management.
Can I use ABM for a small business with five employees?
Yes. There is no minimum size. Even a five-person team benefits from automatic enrollment and centralized app management. The setup effort is the same.
What happens to devices if I cancel ABM?
Devices remain functional, but you lose the ability to assign them to an MDM, push apps, or manage accounts. Any MDM policies already applied will stay until the device is erased or the profile is removed. You can re-enroll later, but there may be a gap in management.
Can I merge a personal Apple ID with a Managed Apple Account?
No. They are separate account types. A Managed Apple Account cannot access personal purchases, and a personal Apple ID cannot be converted into a Managed Apple Account. Users should keep them separate.
How do I add a device that was not bought through a reseller?
Use Apple Configurator on a Mac. Connect the device, and use the "Add to Apple Business Manager" option. This adds the device to your portal without erasing it. You can then assign it to an MDM server.
Related articles
Ai Startup Funding News
A practical step-by-step guide to ai startup funding news, including preparation, instructions, common issues, tips, and next steps.
Business Administration
A practical step-by-step guide to business administration, including preparation, instructions, common issues, tips, and next steps.
Business Checking Account
A practical step-by-step guide to business checking account, including preparation, instructions, common issues, tips, and next steps.