Apple Business Manager: what it is and how it works with MDM

Last updated: 2026-10-15

Apple Business Manager (ABM) is Apple's free web portal for organisations that deploy iPhones, iPads and Macs. It links every company-owned device to your mobile device management tool, so devices enroll and configure themselves the first time they are switched on. ABM is not an MDM itself: it is the layer that tells Apple which MDM for businesses should take control of each device. Since April 2026, ABM lives inside Apple's unified Apple Business platform.

What is Apple Business Manager used for?

Apple Business Manager is used to prove that a device belongs to your organisation and to hand its management to the right MDM server. From one portal at business.apple.com, IT admins assign purchased devices, buy app licences in volume, create Managed Apple Accounts for employees and delegate admin roles. The MDM then applies settings, apps and security policies.

ABM covers four jobs that would otherwise require manual work on every device:

• Automated Device Enrollment (ADE): devices bought from Apple or an authorised reseller appear in ABM with their serial number. Once assigned to an MDM server, they enroll automatically during setup and become supervised, which unlocks stricter controls. ADE was formerly called the Device Enrollment Program (DEP).

• Apps and Books: the former Volume Purchase Program. Admins buy app licences in bulk and assign them to devices or users through the MDM, with no personal Apple Account needed.

• Managed Apple Accounts: work accounts owned by the company, which can be created automatically by federating with Microsoft Entra ID or Google Workspace.

• Roles and audit: admins, people managers and device enrollment managers get separate permissions, and the activity history shows who reassigned what.

A Mac set up this way never needs to pass through the IT team. The employee opens the box, connects to Wi-Fi and the device pulls its configuration on its own, a process usually called zero-touch deployment.

What changed when Apple Business replaced ABM?

Apple announced Apple Business on 24 March 2026 and launched it on 14 April 2026. It replaces three products, Apple Business Manager, Apple Business Essentials and Apple Business Connect, with a single free service available in more than 200 countries and regions. The device-assignment features of Apple Business Manager remain, and Apple Business adds a basic built-in MDM.

Source: Apple Newsroom, "Introducing Apple Business", 24 March 2026.

For an IT team already running ABM with a third-party MDM, the practical change is small: the same portal, the same MDM server links and the same Apps and Books tokens keep working. Most people, including Apple's own support documentation, still call this part of the service Apple Business Manager.

The built-in MDM suits small, Apple-only teams with simple needs. It does not manage Windows or Android devices, and it offers baseline compliance controls rather than the conditional access, patching and reporting that a security audit usually expects. Companies with mixed fleets or ISO 27001 obligations generally keep a dedicated MDM connected to ABM.

How does Apple Business Manager work with an MDM?

Apple Business Manager and the MDM are linked by a server token. You create an MDM server entry in ABM, exchange tokens with your MDM, then assign devices to that server. When an assigned device is activated or reset, it contacts Apple, learns which MDM manages it and enrolls before the user reaches the home screen.

The sequence looks like this:

1. Link the MDM: in ABM, add an MDM server, upload the public key from your MDM and download the server token back into it.

2. Set a default assignment: choose which MDM server receives new Macs, iPhones and iPads by default, so devices from future orders are routed automatically.

3. Order through an eligible channel: devices bought from Apple or an authorised reseller are added to ABM once the reseller has your Organisation ID.

4. Prepare the enrollment profile: in the MDM, define the Setup Assistant screens to skip, the apps to install and the policies to apply (FileVault, passcode, OS updates).

5. Ship to the employee: at first activation, the device enrolls, becomes supervised and installs its configuration. A user cannot remove supervision without the organisation releasing the device.

What about devices bought elsewhere?

Devices bought through a consumer channel, such as a retail store or a marketplace, are not added to ABM automatically. Admins can add them manually with Apple Configurator, the free iPhone app for Macs or the Mac app for iPhones and iPads. Those devices go through a 30-day provisional period during which the user can remove them from management, so manual addition is a fallback, not a deployment strategy. The manual enrollment guide details that process.

Can you switch MDM without wiping devices?

Yes, since iOS 26, iPadOS 26 and macOS 26. In ABM, an admin reassigns devices to the new MDM server and can set a migration deadline. Users receive enrollment prompts, and after the deadline macOS forces the migration. Before these releases, changing MDM usually meant erasing each device, which made switching providers expensive in staff time.

Which MDM should you connect to Apple Business Manager?

Any MDM that supports Apple's enrollment protocol can be linked to Apple Business Manager. The right choice depends on the fleet mix: Apple-only fleets often favour Apple-specialist tools, while mixed Windows and Mac fleets tend to choose a cross-platform MDM tied to their identity provider. The table compares the options most often shortlisted.

Three prerequisites apply whatever the tool: an active ABM account with at least two admins, a verified company domain for Managed Apple Accounts, and an identity provider such as Microsoft Entra ID if you want accounts and conditional access to follow employees automatically. Our guide on choosing and installing an MDM covers the selection criteria in more detail.

How do you sign up for Apple Business Manager?

Signing up is free and takes a few days, mostly for verification. You enroll at business.apple.com with your company's D-U-N-S number, a work email that has never been used for an Apple Account, and the name of a verification contact with authority to approve the request, such as the CEO or CFO. Apple calls that contact before granting access.

Prepare these items before starting:

• D-U-N-S number: it must match the legal name and address of the entity. If you do not have one, Dun & Bradstreet issues it for free, which adds a delay of several days.

• Legal entity details: registered name, address, phone number and the website on your own domain.

• Enrolling administrator: a real person's legal name and a work email not tied to any existing Apple Account.

• Verification contact: a senior manager who will answer Apple's call and confirm the administrator.

Once approved, the administrator creates a Managed Apple Account, accepts the terms and should immediately add a second administrator. The next steps are to verify your domain, link the MDM server and give your resellers the Organisation ID.

What are the most common Apple Business Manager mistakes?

Most Apple Business Manager problems come from setup shortcuts rather than from the tool. A single administrator who leaves the company, expired tokens and devices bought outside eligible channels account for the majority of failed enrollments. Each one is easy to prevent if it is planned when the account is created.

• Only one administrator: if that person leaves, recovering the account takes time. Keep at least two, with role-based permissions for everyone else.

• Expired tokens: the MDM server token, the Apple Push Notification service certificate and the Apps and Books token each need renewing every year. An expired push certificate cuts the link with every enrolled device, and recreating it with a different Apple Account forces re-enrollment.

• Personal Apple Accounts as admin logins: admin and service accounts should be Managed Apple Accounts owned by the company, not personal ones.

• Devices bought outside eligible channels: they need manual addition through Apple Configurator and stay removable for 30 days.

• Domain conflicts: if employees already created personal Apple Accounts with the company email domain, Apple asks them to change those addresses when you verify the domain. Warn them before you start.

• No default MDM assignment: new devices land in ABM unassigned and skip zero-touch enrollment, which defeats the point of the setup.

ABM and a connected MDM also matter for security audits. ISO 27001:2022 includes a control on user endpoint devices (Annex A 8.1), and auditors expect evidence that every laptop is inventoried, encrypted and centrally managed. ABM's device list and the MDM's compliance reports provide that evidence. The guide to ISO 27001 and SOC 2 explains what auditors look for.

Practical box: Apple Business Manager setup checklist

• D-U-N-S number matching the legal entity

• Enrollment completed and verification call answered

• At least two administrators, roles assigned

• Company domain verified, employees warned about personal Apple Accounts

• Federation with Microsoft Entra ID or Google Workspace configured

• MDM server linked and set as default for Mac, iPhone and iPad

• Organisation ID shared with every reseller

• Apps and Books token connected to the MDM

• Token and push certificate renewal dates in the IT calendar

• Zero-touch test on one device before the next hiring wave

For the end-to-end enrollment flow, see the zero-touch deployment tutorial for Apple devices.

Get Apple devices enrolled before they ship with Fleet

Making Apple Business Manager work means verifying the D-U-N-S number, keeping the reseller linked to your Organisation ID, renewing tokens and push certificates every year and checking that each new Mac lands on the right MDM server. Each step can be handled in-house, but every missed renewal or unassigned device turns into a manual setup on the employee's first day.

Fleet runs the Apple device lifecycle end to end in one platform, across 150+ countries:

• Ready on day one: devices arrive pre-configured through zero-touch enrollment with Apple Business Manager or your MDM, so employees are operational as soon as they log in.

• Security policies applied: Fleet MDM enforces your policies, with remote enroll, configure and wipe; security partners are ISO 27001 and SOC 2 certified.

• Real-time visibility: every device, OS version and compliance status tracked in the Cockpit dashboard.

• Delivery to remote employees: Macs, iPhones and iPads delivered in 3 to 5 working days.

• Onboarding and offboarding: order, deliver, store, transfer and redeploy devices from one place, without a local supplier per country.

Over 100,000 users from 1,500 companies already rely on Fleet. Book a demo and see how Fleet gets your Apple fleet enrolled and secured before devices reach your team.

FAQ

Is Apple Business Manager free?

Yes. Apple Business Manager, now part of Apple Business, is free in more than 200 countries and regions. The costs come from the devices, from a third-party MDM if you use one, and from optional add-ons such as extra iCloud storage or AppleCare+ for Business.

Can you use Apple Business Manager without an MDM?

Since April 2026, yes, for basic needs: Apple Business includes a built-in MDM with Blueprints, remote lock and wipe. Before that, ABM alone could not configure devices. Organisations with Windows devices, compliance requirements or advanced security policies still connect a dedicated MDM.

What is the difference between Apple Business Manager and Apple Business Essentials?

Apple Business Manager was the free portal for device assignment, app licences and Managed Apple Accounts. Apple Business Essentials was a paid US subscription adding device management, iCloud storage and AppleCare. Both were folded into Apple Business in April 2026, and the Essentials device-management fee was removed.

Is Apple Business Manager the same as DEP?

DEP, the Device Enrollment Program, was one of the programmes merged into Apple Business Manager in 2018, together with the Volume Purchase Program. Its function now goes by the name Automated Device Enrollment and is configured inside ABM.

Can I add an iPhone or Mac bought from a retail store to Apple Business Manager?

Yes, with Apple Configurator, but the device goes through a 30-day provisional period during which the user can remove it from management. For zero-touch enrollment, buy from Apple or an authorised reseller linked to your Organisation ID.

Conclusion

Apple Business Manager is the free link between your Apple devices and your MDM: it proves ownership, routes each device to the right server and keeps app licences and work accounts under company control. Since April 2026 it sits inside Apple Business, which adds a basic built-in MDM, but the setup rules have not changed: two admins, a verified domain, eligible purchase channels and tokens renewed on time.