How to Provision Apple Devices using Apple Business Manager and MDM

Introduction

Manually unboxing and configuring Macs, iPads, and iPhones for new employees is an outdated, unscalable practice. Modern IT organizations use a combination of Apple Business Manager (ABM) and a Mobile Device Management (MDM) solution (such as Jamf, Intune, or Kandji) to achieve “zero-touch deployment.” This means a shrink-wrapped Apple device can be shipped directly to an employee’s home, and upon powering it on, it automatically configures itself with the correct corporate policies, apps, and security settings. This guide explains how the workflow operates.

What is Apple Business Manager?

Apple Business Manager is a free web-based portal for IT administrators. It acts as a central repository that links your corporate purchasing to your MDM. When you buy devices directly from Apple or an authorized enterprise reseller, the hardware serial numbers are automatically deposited into your ABM portal. ABM is not an MDM; it simply tells the device which MDM it belongs to when it first connects to the internet.

Step 1: Link ABM to Your MDM

To enable zero-touch deployment, you must establish a trust relationship between ABM and your MDM server using Automated Device Enrollment (formerly DEP).

1. Log in to Apple Business Manager.
2. Navigate to Settings > Device Management Settings and click Add MDM Server.
3. You will be prompted to upload a public key certificate generated by your MDM.
4. After uploading, ABM will provide a Server Token.
5. Upload this Server Token into your MDM’s configuration panel. This establishes the secure link.

Step 2: Assign Devices in ABM

When you purchase new devices, they appear in ABM. You must assign them to the MDM server you just linked.

1. In ABM, click on Devices.
2. Select the new devices (you can search by order number).
3. Click Edit Device Management and select your MDM server from the dropdown list.
4. Click Assign.

Step 3: Configure the Enrollment Profile in the MDM

Now that the MDM knows the serial numbers of the incoming devices, you must define the user experience during the macOS Setup Assistant.

1. In your MDM console, navigate to your Automated Device Enrollment settings.
2. Create a new Enrollment Profile (often called a PreStage Enrollment).
3. Configure the profile to require authentication (typically tying into Azure AD, Okta, or Google Workspace).
4. Select which Setup Assistant screens to skip (e.g., skip Apple ID setup, Siri, and Screen Time prompts to streamline the process).
5. Set the profile to automatically create a local administrator account for IT, while making the end-user a standard user.
6. Assign this profile to the serial numbers synced from ABM.

Step 4: The Zero-Touch Experience

The device is shipped to the end-user. The user powers it on and connects to Wi-Fi. The device contacts Apple’s activation servers, realizes it belongs to your organization (via ABM), and is immediately redirected to your MDM. The user is presented with a mandatory corporate login screen. Once authenticated, the MDM pushes down Wi-Fi payloads, VPN profiles, security software, and productivity apps, rendering the device fully compliant and ready for work within minutes.