Apple Business Manager

Apple Business Manager (ABM) is a free web-based portal from Apple that helps businesses and IT teams manage their fleet of iPhones, iPads, Macs, and Apple TVs. This guide walks you through the entire setup process, from initial enrollment to linking your device management solution. It's essential for any organization looking to automate device deployment, securely distribute apps, and create managed accounts for employees, ensuring company data and hardware are properly controlled.

Fast Answer

Main Goal: Enroll your organization at business.apple.com using your legal business information and a D-U-N-S number.
Key Requirement: You must complete a verification process where Apple contacts a legal representative of your company to confirm your authority.
Next Step: Once approved, you connect a Mobile Device Management (MDM) solution to start managing devices.

1-5 business days Time needed

Intermediate Difficulty

Verification delays Watch out for

Before You Start

Setting up Apple Business Manager requires specific legal and technical information. Gathering everything beforehand will make the enrollment process smooth and prevent common delays. This is not a casual sign-up; it's a formal registration of your business with Apple's deployment programs.

What You Need

D-U-N-S Number: A unique nine-digit identifier for businesses from Dun & Bradstreet. Apple uses this to verify your organization's identity and legal status. If you don't have one, you can look it up or request one for free.
Legal Business Information: Your organization's official legal name, headquarters address, and phone number. This information must exactly match what's associated with your D-U-N-S number.
A New Email Address: You need an email address that is not already associated with any Apple ID or other Apple service. This will be used to create the initial administrator account. Using a role-based address like `[email protected]` is a best practice.
Verification Contact: The name and email address of a person in your company who can act as a legal representative (e.g., CIO, IT Director, or legal counsel). Apple will contact this person to verify the enrollment. You must inform this person beforehand so they expect the call or email.
A Mobile Device Management (MDM) Solution: While not needed for enrollment, ABM's primary function is to work with an MDM. Your MDM is the tool that actually sends commands and policies to your devices. ABM tells devices where to find their MDM.

Check first: The verification contact you provide must have the authority to sign legal agreements on behalf of your company. Apple will ask them to confirm that you are authorized to enroll the organization in the Apple Business Manager program. Choosing the wrong contact is the most common reason for enrollment failure.

Step-by-Step Instructions

Follow these steps carefully to enroll your organization and set up your Apple Business Manager account correctly from the start.

Start the Enrollment Process

The first step is to begin the official sign-up on Apple's portal. This is where you'll provide the initial information about your company.

Navigate to business.apple.com and click "Enroll now." You will be presented with a form asking for your organization's details. Enter your company's name, D-U-N-S number, phone number, and website. Be extremely careful with the details here. A typo in your legal name or address can cause the D-U-N-S lookup to fail and halt your progress.

Enter Your Administrator and Verification Details

Next, you'll enter information about yourself (the person enrolling) and the separate verification contact. This is a critical step for security and verification.

For the initial administrator account, you will provide your name and the new, unused email address you prepared earlier. Remember, this account will have full control over the ABM portal, so protect its credentials. Then, enter the details for your chosen verification contact. Double-check their name, title, and email address. This is the person Apple will reach out to in the next phase.

Tip: After submitting the enrollment, immediately contact your verification contact. Let them know to expect an email and possibly a phone call from Apple within the next few business days. This simple step can prevent the verification email from being missed or ignored.

Wait for the Verification Call and Email

Once you submit your application, the waiting period begins. Apple's team will review your submission and then contact your designated verification contact to confirm that the enrollment is legitimate. This process can take anywhere from a few hours to several days.

During this phase, Apple's representative will call your verification contact. They will ask them to confirm the name of the person enrolling (your name) and to agree that the organization wants to enroll in Apple Business Manager. If the contact doesn't answer, Apple may leave a message or send an email with a link to a confirmation page. Patience is key here; do not submit a second application.

Approve the Terms and Create Your Administrator Account

After your verification contact confirms the enrollment with Apple, you will receive an email at the address you provided for the administrator account. This email confirms that your enrollment has been approved.

Click the link in the email to go to the Apple Business Manager site. You will be asked to review and agree to the program's terms and conditions. Once you agree, you will be prompted to create your administrator account. This involves setting a secure password for your Managed Apple ID. This is the final step in creating the primary account that will manage your entire ABM instance.

Configure Your Domain and Set Up Federated Authentication (Optional but Recommended)

Before adding users, it's a best practice to claim and verify your company's domain(s). This prevents others from creating Managed Apple IDs using your email domain. It also enables a powerful feature called Federated Authentication.

Go to Settings > Accounts. Here you can add domains you own (e.g., yourcompany.com). You will need to prove ownership by adding a TXT record to your DNS settings. Once verified, you can connect ABM to Microsoft Azure Active Directory or Google Workspace. This allows your employees to sign in with their existing company username and password, which greatly simplifies account management.

Link Your Mobile Device Management (MDM) Server

Apple Business Manager doesn't manage devices directly; it works as a middleman to tell your devices which MDM server to enroll with. You must link your MDM solution to ABM.

In your MDM platform (like Jamf, Kandji, or Microsoft Intune), find the section for Apple Push Notification service (APNs) and Automated Device Enrollment. You will download a public key file from your MDM. Then, in ABM, go to Settings > MDM Server Assignment, click "Add MDM Server," give it a name, and upload the public key file. ABM will give you a server token file to download. You'll then upload this server token back into your MDM platform to complete the link. This "handshake" authorizes your MDM to manage devices through ABM.

Configure Device Assignments and Purchase Apps

With your MDM linked, you can now automate device enrollment. Go to Settings > Device Management Settings and set a default MDM server for each device type (iPhone, iPad, Mac). Now, any new devices you purchase from Apple or an authorized reseller will automatically be assigned to your MDM upon activation.

Next, navigate to the Apps and Books section. This is where you can "purchase" apps in bulk, even free ones. Search for an app, select "Volume," enter the quantity of licenses you need, and "buy" them. These licenses are now owned by your organization and can be assigned to devices or user Apple IDs through your MDM. This ensures the company retains control over app licenses, not the employee.

Tip: To ensure new devices are automatically added to ABM, provide your Organization ID to your Apple sales representative or authorized reseller. You can find your Organization ID under Settings > Enrollment Information.

Quick Reference

Situation	Use this	Why
Setting up a brand new iPhone for an employee.	Automated Device Enrollment	It forces the device to enroll in your MDM right out of the box, ensuring it's secure and configured before the user can access it.
Need to install Microsoft Office on 50 iPads.	Apps and Books (Volume Purchasing)	It lets you buy and distribute app licenses in bulk. You retain ownership and can revoke and reassign licenses when an employee leaves.
Employees complain about needing another password.	Federated Authentication	Links ABM to Azure AD or Google Workspace, so employees can use their existing company login for their Managed Apple ID.
Adding an existing, already-used Mac to management.	Apple Configurator	This utility for Mac lets you manually add existing iOS, iPadOS, and macOS devices to your ABM account. It requires physical access to the device.

Common Problems When You Use Apple Business Manager

Even with careful preparation, you might encounter some common issues. Here’s how to troubleshoot them.

Problem: The enrollment is taking more than a week.
The most common cause is a missed verification call or email. First, check with your verification contact to see if they missed anything from Apple (it might be in their spam folder). If they haven't received anything, you can check your enrollment status with Apple directly. Do not submit a new application, as this can create duplicates and further delays.
Problem: My D-U-N-S number was not found or is incorrect.
This usually happens because the legal name or address you entered does not exactly match the records at Dun & Bradstreet. Use Apple's D-U-N-S Number lookup tool during enrollment to find your number. If details are wrong, you must contact D&B directly to update them before you can complete the ABM enrollment.
Problem: The email address I want to use is already taken.
The initial administrator account and all subsequent Managed Apple IDs cannot use an email address that is already tied to a personal Apple ID. There is no workaround. You must create a new, dedicated email address for the administrator account.
Problem: My new devices aren't showing up in ABM.
For devices to appear automatically, you must buy them from Apple or an authorized corporate reseller who participates in the program. You also need to give them your Organization ID. If you bought devices from a retail store or another source, they won't be added automatically. You will need to add them manually using the Apple Configurator app on a Mac.

Advanced Tips for Apple Business Manager

Once you've mastered the basics, these advanced strategies can further streamline your device management and enhance security.

Use Role-Based Access Control (RBAC): The initial administrator account has full privileges. This is risky for daily use. In ABM, go to Accounts and create new accounts with specific roles. For example, create a "Content Manager" role for someone who only needs to buy apps and books, and a "Device Enrollment Manager" for staff who handle hardware logistics. This limits access based on job function and improves security.
Integrate with Your Asset Management System: Use the APIs provided by Apple and your MDM to sync device information (like serial numbers and assigned users) with your company's IT asset management database. This creates a single source of truth for all your hardware and reduces manual data entry.
Create Multiple MDM Server Links: You are not limited to a single MDM server. If your organization has different departments with different management needs (or is testing a new MDM), you can link multiple MDM servers in ABM. You can then assign devices to specific servers based on location, department, or device type.
Leverage Custom Apps: If your company develops its own in-house iOS or macOS apps, you can use Apple Business Manager to distribute them privately and securely. You submit the app to Apple for review, and once approved, it appears in your "Apps and Books" section, ready to be deployed to your managed devices without being listed on the public App Store.

Apple Business Manager FAQ

Here are answers to some of the most frequently asked questions about Apple Business Manager.

Is Apple Business Manager a free service?

Yes, Apple Business Manager itself is a completely free portal provided by Apple. However, to make use of it, you will need a paid subscription to a third-party Mobile Device Management (MDM) solution, which is what actually manages your devices.

What is the difference between Apple Business Manager and an MDM?

Apple Business Manager is the framework that enables management. It handles device enrollment automation (letting new devices know they are company-owned) and content purchasing (Apps and Books). The MDM is the actual software that sends commands, configurations, security policies, and apps to the devices after they've been enrolled via ABM.

Can I add devices we already own to Apple Business Manager?

Yes, but the process is manual. For iPhones, iPads, and Apple TVs, you can use the free Apple Configurator app on a Mac to supervise the devices and add them to ABM. For Macs, there is a similar manual enrollment process. Devices added this way have a 30-day provisional period where a user can remove the management profile. Devices purchased through an authorized channel are permanently managed and cannot have the profile removed.

What are Managed Apple IDs?

Managed Apple IDs are special accounts created in Apple Business Manager that are owned and controlled by your organization. They are designed for business use and provide employees access to Apple services like iCloud Drive and Notes, but with IT oversight. Unlike personal Apple IDs, you can reset passwords and audit accounts. They cannot be used to make purchases on the App Store; all content is provided through ABM's Apps and Books feature.

Final Checklist for Apple Business Manager

Before you go live, run through this final checklist to ensure your setup is complete and ready for your employees.

D-U-N-S Number Confirmed: You have your correct D-U-N-S number and your legal business information matches it perfectly.
Verification Contact Alerted: Your designated contact knows to expect communication from Apple and has the authority to approve the enrollment.
Administrator Account Secured: You've created the initial admin account with a strong, unique password and have enabled two-factor authentication.
Company Domain(s) Verified: You have successfully added and verified your company's email domains within ABM settings.
MDM Server Linked: The token exchange between ABM and your MDM platform is complete and the connection is active.
Default Device Assignment Set: You have configured the default MDM server so that new devices are automatically assigned upon purchase.
Initial Apps Purchased: You have used the Apps and Books feature to acquire licenses for the core applications your employees will need.
Provide Organization ID to Resellers: You have shared your unique Organization ID with your Apple or authorized reseller purchasing contact for future orders.