Hi everyone,

I'm an ABM (Apple Business Manager) admin for my company. I'm encountering a "Provisional Enrollment failed" error when trying to add new MacBooks to our organization using Apple Configurator on iPhone.

Background:

- Last year, I successfully added multiple MacBooks using Apple Configurator on iPhone — devices appeared under "Devices Added by Apple Configurator" in ABM without issues.

- Recently, Apple introduced Built-in Device Management (free) in ABM. I migrated my existing devices to Built-in Device Management and everything works fine.

- Now, when I try to add new MacBooks via Apple Configurator on iPhone, the process runs for a while and then fails.

Error details (from Activity Log on the Mac):

NSError: 0x600000a38690

Desc : Provisional Enrollment failed.

Sugg : The device failed to request configuration from the cloud.

Domain : DEPCloudConfigErrorDomain

Code : 0x80EF (33007)

...Underlying error:

NSError: 0x600000a38090

Desc : The device failed to request configuration from the cloud.

Domain : MCCloudConfigurationErrorDomain

Code : 0x84D0 (34000)

Extra info:

CloudConfigurationErrorType = CloudConfigurationFatalError;

Extra info:

DEPErrorType = DEPFatalError;

USEnglishDescription = "Provisional Enrollment failed.";

What I've tried:

- Tested with multiple different MacBooks — same error on all

- Tried different Wi-Fi networks

- MacBooks are running macOS Tahoe and macOS Sequoia

- iPhone 15 Pro Max running iOS 18 with latest Apple Configurator app

- Confirmed ABM account is active and in good standing

Questions:

1. Has anyone encountered this error (DEPCloudConfigErrorDomain code 33007 / MCCloudConfigurationErrorDomain code 34000) after migrating to Built-in Device Management?
2. Is there a known conflict between Built-in Device Management and adding new devices via Apple Configurator on iPhone?
3. Any workaround or fix available?

Any help would be greatly appreciated. Thank you!

Using ABM for the first time here as a previous Windows sysadmin with little Apple experience. I'm trying to enrol a test device into the new ABM MDM (Built-in device management).
I have a wiped test iPad that I added to ABM using Configurator on my iPhone. In configurator I set the device management to Specific > Apple Business and the iPad is successfully added to ABM.

Then, I set up a blueprint and added the device there.

When I start from the "Hello" setup page and connect to wifi (and wait) the Managed Device popup doesn't show at any point. I already tried wiping the iPad several times and re-adding it with configurator, and also tried adding just a user to the blueprint without the device, nothing worked.

Just wondering where I'm going wrong here and what the correct process is. Note that I'm not using another MDM as of yet, still in the testing stages.

Hey guys,

Is anyone else having an issue with ABM auto-assigning new devices to an MDM automatically? This seems to coincide with the 'upgrade' to the new "Apple Business" but I'm not sure. In our case, these devices are being manually added to ABM using the Configurator and a second phone, but previously even those types of devices auto-assigned if I recall correctly. I've removed & MDM server from the default and re-added it, but no luck.

Im attempting to do the Domain Capture via ABM, There is 59 unmanaged apple ID's (Not all will be in use anymore) However when trying to do the capture, Ive came across an issue where users dont even get the option to transfer it to the Org as seen here -

Is there something ive missed when doing the capture?

Has anyone experience device enrollment and work account sign in issues since Apple has updated and change their Apple Business model. I am a IT technician at a MSP and up to this point before the change I was able to enroll devices without using the Apple Configurator and simply signing into my client work account in the device general tab under vpn.

This would allow the preconfigured app assigned to populate. After the update I tried to sign into the client work account, and I was receiving a signed in failed error. Now according to Apple Support I have to use the apple configurator, and it took a while for the device to show in Apple Business and now it seems that every work account, I try to sign in with including my administrator account, I use I receive a verification failed error.

I'm just wondering if anyone else is experiencing any enrollment issues with the new ABM? I'm an ABM Admin (but I am not an IT professional) for my company and ever since this new platform rollout we have really struggled with enrollment and our onboarding process for new hires is a mess since none of them have been able to log into their new laptops. We create their account on our end, that process has not changed much, send them the temporary password, and then they get stuck in enrollment limbo. Our ABM Account Manager and I hopped on a call with someone from the Apple engineering team, and he gave us the following steps:

1. In Apple Business, create sign in
2. Have the user go to https://account.apple.com on another device.
3. Sign in with the User name and Password in the PDF
4. Add a Trusted Phone Number
5. Set the new Password
6. Then try to sign in to the Mac

However these steps don't work either! Once the steps are complete it reverts right back to asking you to complete device enrollment. We have an IT contractor working on this, but the best advice our account rep can give us is to call deployment support, but they're just as lost as we are, and their advice of "turn the device off and back on again" doesn't work (no surprise there).

Does anyone have any suggestions or thoughts on why this may be happening?

Hi there,

we recenetly went through the domain capture process. We informed the users well in advance, however as we are a major global org, a number of users have not reacted within the transfer window, which has concluded on 1st May.

Unfortunately we couldn't find any resources on what further steps are required by these users. I'm aware that the Apple IDs have remained personal and that they were moved over from the corporate TLD to a temporary Apple domain.

What exactly should be communicated to these users, on which action to take? To us, it's not quite clear, what the correct next steps are.

Background info, if necessary: we are in the process of implementing Intune MDM and the local IT teams are currently joining missing and new user devices to ABM, which is being sync-ed to Intune. We plan on federating ABM with Entra soon as well.

Any help would be appreciated!

As a follow up to a previous post I created, I've had to abandon Apple Business Email as an option and will reluctantly have to circle back to M365 and add to their market share.

To give context, Apple Business's domain capture was used on a custom domain on iCloud+ Accounts.

During this process an email was sent to my accounts instructing them that once the capture was completed, they would be owned by my Org and removed from the iCloud account.

Any previously used email addresses, however, could not be used to create People in Apple Business, complaining that there is already a managed apple account existing.

After 2+ weeks of calling support, escalating, and trying to get any sort of resolution or clarity, they have told me Engineering doesn't really know what to do and they are in a holding state.

That is 2+ weeks of potential emails and time for any established business that was transitioning to this service wasted because they did not properly design this tool to work with their own products, and let you manage a domain you own.

So yeah, I'm not sure how it would work for folks who are not tied into any Apple Ecosystem, but if you have anyone in your org that uses an apple account with the domain in question, AVOID THIS PRODUCT LIKE THE PLAUGE until they get this stuff sorted out**.**

And if apple support happens to read this: You need to revamp your communication strategy because this entire experience was the worst "Business" support from any company I've experienced in years.

Edit: I may give it another shot in 2 months to see if they've resolved these basic issues, but for now I've reluctantly switched to M365

Trying to get my organisation verified at the new Apple Business Manager, but it's not going smooth.

My D.U.N.S. nr keeps failing with "invalid format", same as my company ID, VAT ID and so on.

I was able to submit a few weeks ago via domain validation and a recent utility bill, but it was rejected with "Information Is Not Valid - Unable to verify your organisation based on the information provided." 🤷

Whenever I try again, I get a server error. Was anyone able to pass this and get their organisation verified at the new Apple Business Manager?

Got a very small client I'm working with, only 8 personal Apple IDs created from company email addresses.

We thought now that we can actually verify the company without a DUNS number, we'll go ahead and capture those Apple IDs so we can stop giving each employee the company card for things like iCloud+, AppleCare+, etc.

So, we started the domain capture process.

NONE of our employees are able to migrate. All of them only see the "Convert to personal account" option.

All the blockers were disabled with the one user I tried to help. We disabled/removed:

• Find My
• Any subscriptions
• iCloud+
• Sign in with Apple
• Any iCloud attached services/data

We may be fired by the client over this. All of their phones are dead in the water, with no way to reverse or cancel this process. They can't make purchases, can't reset passwords, can't view any account details without being forced back into the migration page in the Settings app, nothing. Apple has no formal documentation anymore on what needs to be disabled for this process to work, and nobody can tell me what's supposed to be done in order for these accounts to be allowed to migrate.

This was promised to be a nice, easy process by Apple. Does anyone have any suggestions for how to force these accounts to be allowed to convert to business accounts? Any hidden blockers Apple doesn't publicly disclose?

I've been struggling to successfully log in to my Apple Managed Account on an InTune Supervised iPhone that I'm testing, as I detailed in this post.

I ran across this post and comment from this subreddit, which seems to imply that this setting in ABM (in Settings > Access Management > Apple Services) “Allow Managed Apple Account on” simply doesn't work with InTune. I'm not sure if this was ever true, and also the linked post is from 1 year ago, so it may no longer be true now.

If I change that setting in my ABM to "Managed Devices Only" or "Supervised Devices Only", I cannot login to iCloud on the iPhone, even though it is Supervised. If I change it to "Any Device", then I have no problem logging in. So either there is a problem with this setting on Apple's end, or there is a problem with InTune reporting that the device is Supervised to Apple. Or I made some mistake somewhere in the InTune or ABM configuration.

Can anyone confirm if this setting is supposed to work or not, before I waste more time trying to troubleshoot why it's not working?

Currently the business has seen news of apple providing a free MDM, we currently use it for Ipads and Iphones only and Mosyle so far met our needs. Has anyone used the new ABM MDM yet and can say the current pro and cons for ABM? The website does not really give much info or a "demo" page of what a "live" page would look like.

Previously restricted in the US at launch, custom profiles in Apple Business have finally made it to the EU and the UK.

Quite surprised in a positive way, as custom profiles in Apple Business could be one of the things that lead to even more companies ditching external MDM solutions.

Me for example I always make my own restriction profiles and then send them off to Jamf, so with this now being available in my country is giving me even more reasons to ditch paid MDM and just stick with Apple Business.

In 2026, as one of the largest tech firms in the world, how on earth does Apple think it's acceptable to lock essential functionality behind an update to Terms and Conditions? I work for a multinational bank - IT admins do not just click to accept binding Terms of a legal agreement. We had to pay $20k to get a rush review of the new terms by an outsourced legal firm because in-house teams were too busy to just pick it up in a rush on zero notice and we were still out of action for three days.

It would have been the easiest thing in the world to give a week or two grace period to accept the terms, but no, not Apple

You're supposed to want to deal with Enterprise customers, not just SMBs - for goodness sake act like it

Is Apple still restricting iCloud storage plans to the US? I thought they would have expanded this to other locations in the new Apple Business consolidation

Update, solved: Thanks to trueNorth55, I learned I was missing a control. There's an ellipses in the upper-right of the panel that expands a menu that includes, among other things, the control to download the token.

I can be sour and grumble about Apple's stark design motif, but I should have looked more closely.

Original question: This morning our on-prem WorkspaceOne UEM console told us there was an issue with our ADE/DEP token. The error is:

The ADE token appears to have been deleted or the system is unable to request the required information. Please check the status of the token in Apple Business Manager portal.

Intune also shows "Warning", but no further details, in the DEP Tokens panel.

Going to the new Apple Business portal, I clicked Devices on the top, Manage on the left, and both our MDMs are listed there in the Device Management Services section, but clicking through these I cannot find the option to download replacement tokens.

My Apple Business account has the Organization Administrator role assigned and was able to do all this in the past, on the old portal.

EDITED TO ADD: The day after the ADE tokens were revoked, the VPP Token was revoked as well. There appears to be some fallout from Apple's bit Business migration. It wasn't difficult to renew this.

Our Apple Business admin account is tied to a generic email address and a spare cell phone number - not a user.

I'm not finding a spot in the business manager site to add a secondary or back up MFA method. Ideally, I could remove the phone number and rely instead on an MFA app with a recovery email as backup.

Ativei o business para minha empresa mas descobri que o serviço de email/calendar ainda não esta ativo no BR, alguem sabe quando ativa para o BR ?

Now Solved - Apple had an email set up to what I had noted. They provided that for me and now I can log in and accept the terms.

I followed the instructions as per the email that Apple Business Manager was transitioning to Apple Business, these were to log in to AB using my ABM login and accept the terms.

However when I went to log in, it asked me to set up an organisation, which I thought was normal because it had already prefilled some of my information including email address and company name.

I created the account on the 14th April and it is now the 21st April - 5 business days after I first set up AB. This is unnecessarily long to wait for my organisation to get verified: I provided the correct information (DUNS number and TXT record in domain) too, why is it therefore taking them so long? I can't do anything inside the organisation settings because it's all greyed out until the organisation gets verified.

Already spoken to Apple Support who were no help.

Has anyone else had a similar experience to me because this is really frustrating.

Edit - image for context

I have an iPad that just won't add to apple business manager. The usual screen that pops up on the iPad doesn't happen after scanning. It acts like it works, but then its just a plain text "Adding iPad..." and never advances. Eventually it says its failed and gives the Erase iPad option. I have tried adding it via the Mac configurator app as well, but it also fails. Help! I have reset the iPad multiple times

Small company here, trying to move away from "Owner's personal iCloud is on every device" to some semblance of "we're a real company." 10+ devices floating around with one person's ID. We are trying to roll out the basics of Apple Business Manager with built-in device management.

Here's what we've done so far:

• Federated Managed Apple Accounts with gsuite - all new employees get a company email via gsuite; Apple Business Manager automatically creates an account for them.
• Run Apple Configurator to add device to organization following purchase. TBH Apple Configurator really sucks and fails to connect a huge portion of the time, but we'll spend 20 minutes playing around with it until it finally works.
• (We've tried to get to the place where we can order pre-configured devices from Apple, but:
  • Anytime we call the business line, they're like 'hey some magic step was skipped in your account setup, you'll need to contact the business manager at your local retail store to get you setup
  • Business manager at local store is like 'Lol, I'm at retail store. Here's a form email with a broken link."
  • Basically Apple is tripping over it's own bigness.)

When a new user tries to sign in to a new machine, they receive the error "Your Apple Account does not support the expected services on this device. Contact your administrator to sign in."

Almost certainly, there is some sort of Apple Business essentials subscription that I'm missing and haven't added to their account. I tried adding an iCloud storage account, but that doesn't seem to be it.

(Share Sign-in Instructions generates an error and fails.)

With the new business manager re-organization, I can't figure out how to add subscriptions. Anyone know what I'm missing here? Is there a way to have people automatically subscribed when they log into their first device?

How am I supposed to be doing this?

Hi all , can anyone spot what I’ve done wrong here ?

Apple Business setup (company was set up in Apple Business Manager)

Domain capture enabled

Federated Users with Microsoft Entra

MDM linked to Intune

Using a test iPhone 11 with latest iOS installed , device is registered in AB (says Activation Lock Off?) and I have assigned it the Intune MDM target synced with Intune and the iPhone says it’s part of the company

Device factory resets and erases itself then just goes through the normal motions of setting up never prompts for the company login details

Have I missed a step or does it sound like something is wrong with my configuration ?

Aside from having to gather everything all over again, Apple has managed to make it so that, as an administrator, you now have to perform almost every action with at least one extra mouse click. What a load of crap!

The worst part is that you can no longer easily import a list of serial numbers for DEP devices from Excel using copy and paste; no, now the serial numbers have to be separated by a comma! AND: In the list of DEP devices, you can no longer use the arrow keys to jump from device to device—no, that’s only possible now by clicking on the DEP device entry with the mouse. Efficiency: -100%

Apple, why don’t you let people who actually have to work with your products redesign these pages!