How to add devices to Apple Business Manager (ABM)

Apple Business Manager (ABM) is free portal offered by Apple that enables businesses to simplify and automate the bulk deployment and management of corporate Apple devices, including iOS, iPadOS, macOS, and tvOS devices. Similar to Apple Business Manager (ABM), Apple also offers Apple School Manager (ASM) a dedicated service for schools to simplify the management of Apple devices.

Apple Business Manager (ABM) was previously known as Apple Device Enrollment Program (Apple DEP) and users can automatically or manually add devices to Apple DEP for over-the-air management.

Prerequisites

Ensure the following pre-requisites are met to enroll Apple devices using Apple Business Manager (ABM) enrollment:

• Apple Business Manager must be available in your country. Find the list of countries where ABM is supported here.
• The devices must be purchased from Apple or its authorized resellers. You can view the list of Apple's preferred resellers here.

In case of devices purchased neither from Apple directly nor from its authorized resellers, you can still add devices to Apple Business Manager (provided they're running or capable of running iOS 11.0 or later versions) as explained here.

NOTE: The steps mentioned in this document are also applicable to the Apple School Manager portal.

• How Apple Business Manager (ABM) works?
• Integrating Apple Business Manager with MDM
• How to add devices to Apple Business Manager?
  • Adding Reseller details to the ABM portal
  • How to manually add devices to Apple Business Manager?
• Device Activation Settings
• Syncing Devices
• Assigning Users to Devices
• Remove Devices from ABM

How Apple Business Manager (ABM) works?

The process first starts, when your organization purchases Apple devices from Apple or from Apple authorized resellers. You have to log into your Apple Business Manager account. If you already have an account with Device Enrollment Program, you can migrate to Apple Business Manager by following the prompts available on your DEP portal. You have to register MDM with the Apple Business Manager portal. Once you have registered the DC server, secure communication is enabled between the DC server and the Apple portal. This is used to synchronize the details of devices, purchased by your organization. When you find the devices synced from the Apple portal, you can assign it to users. Whenever the devices are activated, all restrictions and configurations imposed using MDM are automatically installed on all your devices over-the-air (OTA). By configuring ABM, you can ensure all the organization's devices are managed by MDM by default as soon as they are activated.

Benefits of Apple Business Manager (ABM) Enrollment

• The device is Supervised which means you have additional control over the device. For detailed information on Supervised Devices, refer to this.
• The devices can never go unmanaged from MDM at any point, even if the device is factory reset.
• Users can skip initial setup steps for a faster device activation
• Out-of-the-box enrollment to ensure devices are usage ready immediately upon activation.

Integrating Apple Business Manager with MDM

After creating your organization's Apple ID and deployment account by following the steps mentioned in the ABM Program Guide, you need to carry out the steps outlined below, to seamlessly enroll and manage your organization's corporate Apple devices into MDM using Apple Business Manager enrollment.

First, you need to link the DC server to your organization's ABM account. For this:

1. On the DC server, navigate toAgent tab and click on ABM/DEP under the Mac ,on the left pane.
2. Download MDM Public Key which has to be uploaded on Apple Business Manager portal.



3. Sign in to Apple Business Manager portal using your organization's managed Apple ID.
4. Click on Settings -> Device Management Settings and navigate to Add DC Server, to create a virtual server on the portal.



5. Enter a name for the server based on your organization's locations or departments.
6. Now, you need to upload MDM Public Key, downloaded earlier from MDM and click on Save.



7. Click on Download Token to download the server token from ABM. Click on Download Server Token when prompted.                                      



8. Navigate back to your MDM console and add the Server Token under Upload Server Token.    
9. Specify the e-mail address to receive notifications regarding Server Token expiry.
10. Click on Upload to complete the uploading of the Server Token. You can configure the device activation settings as explained here.

Setting a default server

Using Apple Business Manager you can automatically assign the purchased devices to particular servers once they have been added to the portal. Additionally, you can select different servers based on the type of device being enrolled. It is recommended to assign different types of devices to different servers. All of these servers can be integrated and managed using DC. To select a default server for a particular type of device-

1. Select the required server from the list and click on Edit.
2. Under Default Device Assignment, select the device type.
3. Click on Apply to ensure all the devices added to the portal are assigned to this server.

How to add devices to Apple Business Manager portal?

One of the advantages of using Apple Business Manager to enroll your Apple devices is that the devices can be enrolled without any interaction with the devices. There are two methods available to add devices into Apple Business Manager. IT admins can use any of the following methods to add devices to Apple Business Manager:

• Adding reseller details to the ABM portal
• Manually adding devices (iphone/ipad) to Apple Business Manager portal

Adding Reseller details into the ABM portal

To add devices to Apple Business Manager, the reseller details must be added to the ABM portal. So every time devices are purchased from the same reseller, the devices are added to the ABM portal and in turn, to the MC server due to the integration of the ABM portal with the DC server.

Note: On ABM, only the Administrator or Device Manager roles can add the reseller details.

1. Log into ABM using your organization's credentials. The option to add resellers is only available on the Device Manager's console, apart from the Administrator's console.
2. Click on Settings -> Device Management Settings. Navigate to Customer Numbers to add your Apple Customer Numbers and ABM/DEP Reseller IDs.
3. Click on Apply, to save the details.

How to manually add devices to Apple Business Manager?

After linking your DC Server to the Apple Business Manager (ABM) portal, if you have devices purchased before integrating the portals, you can add devices to Apple Business Manager using one of the three methods:

• Add devices by serial number
• Add devices by order number
• Add devices by uploading a CSV file

• Using Order Number
• Using Serial Number
• Uploading CSV File

To add devices directly to DC, follow the steps mentioned below:

1. On your Apple Business Manager portal, navigate to Device Assignments.
2. Select the option Order Number or Serial Number or Upload CSV file for choosing devices as shown and mention the required details. If you have chosen Upload CSV file, you are prompted to browse and upload the CSV file containing the serial numbers of all the devices.
3. Now, you must choose the action Assign to Server and specify the name of the DC server which was configured earlier.

The Apple devices are now added to the DC server, automatically.

Device Activation Settings

On adding devices to MDM using Apple Business Manager enrollment, all the devices are enrolled successfully. Before the enrollment is complete, you have to configure the settings to be applied to the devices, on device activation. You can create and apply these settings to all your devices at one go, by following the steps mentioned below:

1. On DC console, navigate to Enrollment -> Apple -> Apple Enrollment(ABM/ASM).
2. Complete the required fields displayed under Device Activation Settings.

• Authenticate and auto-assign users on device activation (Applicable only for On-premises): If you want to automate the user assignment process, enable this option and select the group to which the device is to be added upon enrollment. This allows the users to assign devices to themselves, on device activation, using their Active Directory credentials.
• Skip these configurations during device setup: During device activation, you are required to follow some initial setup steps. With MDM, you can optionally skip selective steps or completely skip the setup. Assuming your organization wants to prevent users from setting up Siri during the setup assistant process, you can do so by selecting Siri from the list of configuration settings provided. The list of configuration settings is given below.

Mac Account Settings

As imaging for deploying Mac devices has been stopped by Apple, DC provides a quicker and more efficient means of deployment by automating the creation of a local admin account on device activation. The local admin account created on the device has the following benefits:

• Device maintenance is simplified as security checks and device audits can be carried out without user intervention and during non-work hours, thereby preventing loss of productivity.
• The admin can install, update and also remove system configurations.

• Troubleshooting system issues and user account problems, becomes easy and quick. In case of forgotten password, the admin can assist the users by resetting the password.
• User accounts can be added and removed as and when required. For instance, the user account of the employee who leaves the organization can be removed from the corporate device and a new account created, before handing over the device to the next employee.

To configure a local admin account, enable Mac Account Settings and provide the required fields the details of which have been given below.

Click Create. Now, the configurations and settings get applied to the devices.

Syncing Devices

After creating the ABM profile and applying it to devices, you can choose to Sync Devices by navigating to Enrollment-> Apple -> Apple Enrollment (ABM/ASM). On syncing, all devices get automatically listed on the DC console.

Only when the devices are activated by the users, the enrollment process is complete and the devices are listed under Enrollment-> Devices.

Assign Users to Devices

You can assign all the devices to individual users manually by navigating to agent and then on ABM/DEP to Devices.The alternate and easier option is to add users through a CSV file. You can also automate user assignment if you are using on-premises DC version. Automated user assignment ensures the users are authenticated and self-assigned when the device is enrolled. This option must be enabled when ABM is configured or if already configured, you can enable the option from ABM settings. The only pre-requisite is, Active Directory must be configured in DC. When enrolling the device using ABM auto-assignment, the user name to be provided on the device must be in the format: domain name\user name.

While assigning the users to devices, these devices can also be added to groups to automate the distribution of apps, profiles, and documents to devices. The devices can also be simultaneously added to multiple groups while assigning users.

Sample CSV Format

USER_NAME,EMAIL_ADDRESS,GROUP_NAME

ANDREW,andrew@zylker.com,zylker_drivers

NOTE

1. The fields User Name and Email Address are mandatory. Group Name is an optional field. Ensure the specified group name is already created in the DC server. If values are not provided, default values are taken.
2. If multiple groups are specified, the group names must be separated with a slash (/).
3. The first line of the CSV is the column header and the columns can be in any order.
4. Blank column values should be comma-separated.
5. If the column value contains a comma, it should be specified within quotes.

Remove Devices from the ABM portal

To unmanage the device, the admin must remove the device from the DC server. Once the device is removed from the DC server, the device is automatically removed from the ABM portal.

The devices that are enrolled with one ABM account cannot be enrolled in another. Therefore, these devices must be removed from the first ABM account before enrolling into another. Follow the steps given below to remove the devices from the ABM portal.

1. Log into the ABM portal and click on Device Assignments.
2. Enter either the Serial Number or Order Number of the devices. If you are trying to remove multiple devices, you can upload a CSV file with the device details.
3. Under Choose Actions select Unassign device. This unbinds the device from this ABM account.

Apple Business Manager Unassign vs Release

To remove the devices, always select Unassign device and not Release device. Release device should be used only if the device is lost or permanently damaged and will never be part of any workforce. Releasing devices is a non-reversible action and once disowned the device can never be part of an organization.