Apple Business Manager Setup Guide For Small Business
How We Set Up Apple Business Manager, Step By Step
Most small businesses buy their first Macs and iPhones the way people buy them at home: someone opens the box, signs in with a personal Apple ID and gets to work. That works until someone leaves, a laptop goes missing, or a client asks how company data on those devices is protected.
This guide walks through how we set up Apple Business Manager for our clients as an Apple Authorized Service Provider: account and domain setup, device enrollment, the link to Microsoft Intune, security policies and the upkeep that follows.
The Basics
What Apple Business Manager Does For You
Apple Business Manager (ABM) is Apple’s free portal for business devices. It proves which Macs, iPhones and iPads belong to your business, hands them to your device management tool, buys and assigns apps centrally, and creates Managed Apple Accounts for business use, with stronger controls than a personal Apple ID.
We connect it to Microsoft Intune and support your Macs and PCs together in Microsoft 365, so every device follows the same rules no matter who made it. Watch the 90-second overview.
What You Need Before You Start
A D-U-N-S Number
Apple uses it to verify your business, along with the legal authority to enroll devices for your organization.
Access To Your Domain
You add DNS records to prove you own the domain your Managed Apple Accounts will use.
A Device Management Tool
ABM needs an MDM to do the daily work. We use Microsoft Intune.
A Buying Plan
Devices bought from Apple or an authorized reseller can enroll automatically. Devices you already own enroll manually.
Account Setup
Three Decisions That Shape Every Device
The choices made in the first hour of setup affect every device you add later. We work through them in order and document each one, so the next person who manages your devices knows why things are set the way they are.
1
Create The Account
We create your account in the Apple Business Manager portal. Apple verifies the business, which usually takes 1 to 3 business days. We set your primary domain, device naming and admin structure.
2
Verify And Federate Your Domain
We add DNS records so Apple can confirm you own your domain, then connect ABM to Microsoft Entra ID. Staff sign in to Apple services with their Microsoft 365 account, with no separate Apple ID to manage.
3
Assign Admin Roles
The Organization Admin role has full access, and the Device Enrollment Manager role covers devices only. Each person gets the role their job needs.
Enrollment
How Devices Join Your Business
How a device is enrolled decides how much control your business keeps over it.
Automatic Enrollment
For new devices bought from Apple or an authorized reseller. The device is managed from the moment it is first switched on, and staff cannot remove management. This is what we use for every new company device.
Manual Enrollment
For devices your team already has. We install an enrollment profile on each one and plan it around their workday.
Several Devices At Once
When a whole team gets new devices, we line up delivery dates, prepare the settings in advance and assign each device to its person before it arrives. We start with a few, fix anything that comes up, then roll out to everyone.
Let’s face it, nobody gets excited when IT asks to enroll their phone. On a personal iPhone, the first question is often “Can you see my photos?” We answer it before we enroll anything: management covers work apps, work data and security settings, not personal photos, messages or browsing. A new company Mac is a different experience. Staff sign in with their Microsoft 365 account and watch their apps and settings arrive on their own.
Intune And Security
One Set Of Rules For Macs And PCs
Apple Business Manager decides which devices belong to your business. Intune decides what happens on them. Every managed client gets Intune, conditional access, EDR and Entra ID management as standard, and their Apple devices follow the same baseline as their PCs.
Connected To Intune
Your Macs, iPhones and iPads sit under the same apps, security settings and compliance rules as your Windows PCs, with reporting on every device.
Profiles By Role
Wi-Fi, email, security restrictions and app policies are grouped into profiles for each role, with one security standard underneath.
Tested First
Every new profile goes to a test device first. We check your key apps still work, and we can roll a change back if it causes trouble.
Identity
Managed Apple Accounts federated with Entra ID, so staff use one work sign-in with multi-factor authentication.
Device Security
FileVault encryption on every Mac, passcodes on phones and tablets, and limits on app installs and data sharing.
Data Protection
Company data stays in managed apps, with remote wipe of company data when a device is lost or someone leaves.
Apps
Apps That Stay With The Business
Staff should get the apps they need on day one, without sharing a personal Apple ID or expensing an App Store purchase.
We buy and assign apps centrally through Apple Business Manager, in collections by role. Licences stay with the business and move to the next person when someone changes roles or leaves. Custom apps for your business can be distributed privately through ABM, and we review licences regularly so you pay only for what is used.
What You Can Expect
-
Rated 5 out of 5
quick, reliable and professional
“…They helped us switch to Office 365 for all our email and document storage with back up of our files, and it’s been great. We always find them to be quick, reliable and professional, and we’re happy to have found them.”
Maria C.
Office Manager
-
Rated 5 out of 5
there to help me
“When I needed some IT assistance, Berj @ TUCU was there to help me and take care of what needed to be done in order for me to continue working and adding a more efficient manner to do so! Thank you, Berj!!”
Dawn Nelson
Ongoing
Upkeep, Handled For You
Apple changes its platforms every year, staff come and go, and devices get replaced. For our managed clients, this upkeep is part of our fully managed IT service, handled by the same in-house team that set it up.
Regular Checks
We watch enrollment and compliance, update profiles, manage app licences, and review accounts and the device list so nothing drifts.
Room To Grow
New people and new devices follow the same setup. Nothing needs to be rebuilt.
Apple Updates
We test Apple’s yearly updates before they reach your team, and adjust your settings when Apple changes how things work.
Next Steps
Our Apple Support Team
We are an Apple Authorized Service Provider and Apple Certified Consultants, with an in-house team that supports Macs and PCs together in Microsoft 365. For our managed clients, Apple Business Manager setup and support is part of our fully managed IT service. Consultations are free.
See how we helped a Mac-based client align with the NIST framework and pass an information security screening from their largest client. Read the spotlight →
Keep Reading
More Apple Resources
Apple IT Solutions
How we support Apple devices alongside the Windows PCs and Microsoft 365 your team already uses.
Mac Management
Setup, security and support for your Macs, under the same policies as the rest of your devices.
iPhone And iPad Management
Management and security for company and personal iPhones and iPads that reach work data.
Personal Devices At Work
How company data stays safe on personal phones, without taking over the device.
Apple’s Technical Requirements
Apple’s own Apple Business Manager user guide, with the current requirements.
Security Driven. People Powered.
What Would Your Team Do With Fewer IT Headaches?
1
Talk With An Owner
A relaxed call with one of our co-founders about your business, your team and what you want IT to do for you.
2
Get A Clear Proposal
If we are a fit, you get a tailored proposal and quote, with every line explained in plain English.
3
Hand Your IT To Us
Our in-house team runs your IT every day: support, security, devices and planning, so you can work with ease & security.