Apple Business Manager: what's actually involved

A practice manager at a Calgary dental group asks how long it takes to set up Apple Business Manager. The honest answer is between two days and two months, depending on what “set up” actually means. Apple’s part takes hours. The decisions and integrations around it are the project.

This is a map of what Apple Business Manager (ABM) rollout actually involves at a business. Not a step-by-step how-to. The decisions and the people the project touches.

What ABM actually is

ABM is a free Apple service that gives an organisation a tenant for managing Apple devices, Managed Apple Accounts, and content distribution. The tenant by itself does not configure or control devices. What it does is define the institutional relationship between the organisation and Apple.

Three things flow out of that institutional relationship.

Automated device enrollment. Devices purchased through an Apple Authorized Reseller in the organisation’s name appear in the ABM tenant automatically. When the device boots for the first time and reaches the internet, Apple hands it to the organisation’s Mobile Device Management (MDM) without manual intervention.

Managed Apple Accounts. Identities that belong to the organisation, not to individual staff members. Staff sign in with these accounts to access company resources, and when they leave, the access ends without affecting their personal Apple ID.

Volume content distribution. A central way to purchase and distribute apps and books across the fleet. Useful for any organisation with more than five devices and more than one app license to manage.

What setting it up actually involves

The ABM rollout is mostly four threads of work that run in parallel.

Administrative and verification. Apple verifies the organisation through one of several accepted methods. A D-U-N-S number (free from Dun & Bradstreet) is one path and was historically the only one; it nominally takes a few business days to issue but in practice can stretch up to thirty days. Apple now accepts other business verification credentials, which are often faster for Canadian organisations that already have the documentation on hand. A verifier with admin access to the organisation’s domain confirms the identity. A primary Managed Apple Account holder is named, usually the IT lead or operations lead. This part runs on Apple’s calendar, not the organisation’s.

MDM selection and integration. Mosyle, Kandji, Jamf, SimpleMDM, or Microsoft Intune. The choice is a separate decision with its own pricing and operational considerations. Once chosen, the MDM is connected to ABM via a server token. From that point onward, the MDM controls what happens to enrolled devices.

Identity integration. Most organisations connect ABM to their existing identity provider so staff sign in with the same credentials they use elsewhere. Microsoft Entra ID, Google Workspace, and Okta all integrate. The integration is technical work but small.

Reseller relationship. The organisation establishes a relationship with one or more Apple Authorized Resellers and configures them to drop new device purchases directly into the ABM tenant. Without this, every new device needs manual enrollment, which defeats most of the point of ABM.

What the project does not do

Three things ABM is sometimes expected to do that it does not.

ABM does not replace an MDM. It hands devices to the MDM. The MDM is what manages the device. Without an MDM, ABM is a registry with no operational consequence.

ABM does not retroactively enrol every Apple device the company has bought. Devices purchased through an Apple Authorized Reseller within Apple’s eligibility window can be added retroactively. Devices purchased through retail channels usually have to be wiped and re-enrolled manually. Older devices may not be eligible at all.

ABM does not enforce a security policy on its own. Security policy lives in the MDM. ABM is the enrollment layer that gets devices to the MDM. The two work together. Neither alone is the whole picture.

The work that makes ABM useful

The setup is the smaller half of the project. The work that makes ABM useful is what gets built on top.

Role profiles in the MDM. Reception, chairside, surgical, designer, motion designer, engineer, operations. Each role defines the apps, settings, restrictions, and identity bindings the MDM applies to a device assigned to that role.

Onboarding and offboarding workflows. What happens when a new staff member arrives with a new laptop. What happens when a staff member leaves. The MDM provides the controls. The organisation defines what to do with them.

Lifecycle handling. Trade-in, refresh, redeployment, retirement. Each transition has implications for the ABM record and the MDM profile.

These are the parts that take time, and they are the parts most worth getting right. Without them, ABM is administrative paperwork. With them, ABM is the foundation that makes a managed Apple fleet possible.

When to think about this

The right time to set up Apple Business Manager is before the next Apple device purchase, before the next staff growth wave, or before the first compliance question that requires the organisation to enumerate its devices.

ABM is small to enable. The value compounds as the rest of the Apple environment is built on it. The right question to ask is not how long ABM takes to set up. It is what the organisation wants ABM to enable, and whether the surrounding work is ready to take advantage of it.