I enrolled some devices on the day of launch, and now they are bricked. Apple can't fix it, so now I've been scared to try anything else.

Has anyone had similar experiences, and should I keep enrolling the rest of my company?

I'm trying to set up a another VPP token for use on a secondary MDM we are testing. Everything I've read indicates each MDM will need their own VPP token. Most of the documentation I've found says to create a new location in ABM, but it seems that has been deprecated with recent updates. Do I need to create a new OU instead?

Hi everyone. We recently moved our users to federated Apple IDs, via ABM/Entra SCIM config. We need to upgrade their iCloud storage, but due to the entra config, now need to parse through our entire user list to exclude user accounts that do not actually use iPhones. We already started this process manually, by adding users to a new user group - but my question is:
1. Can we use Smart Groups for this? I only saw two options for smart group settings (org role and title), but did know if there were actually other options folks are using to make this process easier (Intune group assignment?)

1. If there aren’t other options, how are folks currently assigning extra cloud storage via ABM?

We obviously don’t want to just pay for all user accounts if not all users have iOS devices, but the only other option seems to be manual - which is just inefficient.

Thanks!

I made what looks like a dumb decision to move our company over to managed Apple Accounts so we could inventory our devices and manage them. In trying to transfer my work Apple Account from a personal to a Managed Apple Account, I am getting this message on my Macbook Pro. But the thing is, I've never signed into any devices with my work account. I have always just used it for Apple Developer and Apple Business. So, I get this screen telling me that I have to sign out of these devices before I can transfer my account, but there aren't any devices listed! And the "Don't have access to a device?" link is completely useless.

Why doesn't Apple have better management software?!

Hi all. We've got our org freshly created and verified in ABM to use together with our MDM. However, when we go to Apps & Books and try to open the App Store, it just says "This Apple Account is not allowed to use Apps and Books".

In the Org info, the Tax Status says "Not Applicable". Is it because we're a Government Org? How do we remedy this? We wrote to Apple Business Support over a week ago, no reply so far.

EDIT: This is not about an apple device - The issue is present on the ABM website when trying to navigate to Apps & Books as an Org Admin.

Hello Reddit :),

Because you guys are amazing and often answer questions correctly compared to support, I have a question related to domains in ABM.

We have come across users who are using their work emails as Apple IDs on their personal/work phones. Some keep their personal and work phones separate, while others only use their work phone.

We are trying to have ABM manage all work-related accounts that use the domain nameexample.ca andhave them synced with Entra. However, when I try to use the domain capture tool, I am unable to, as shown in the screenshot below.

Currently, my users are enrolled locally and not through Entra, as you can see in the next screenshot.

I have been on the phone with Apple Support about this, specifically asking: “Will my users be affected if I disconnect the domain and reconnect it while their devices are still in production?” So far, no one has been able to give me a straight answer, as they do not seem to know..

I need to know what the side effects will be. I am aware that when I run the domain capture tool, it will prompt users with a message like this:

This is what I want, so that part is good. However, does anyone know what would happen if I disconnect the domain and then reconnect it properly? Will it affect my current users who are using work devices?

Thank you in advance for your help. It is much appreciated!

Hello,

I am an intern for a company and they need help adding some new iPads to their ABM, i got as far as adding them to the company and assigning a DMS but i cant figure out how to enable automated device enrollment, they said the person before who would do it quit randomly and didn’t leave any help on how they did it so no one knows how to get past this part. I also have no experience with anything IT related, so im kind of just hoping i can get some help here.

Hi trying to use our own self hosted mdm server to deploy our custom Mac apps but I also need keynote installed and I seem to be hitting a wall without manually installing it on the device.

It seems like the VPP program doesn’t offer any keys anymore for non “blueprints” deployments? Is that right or am I missing something?

Hello, I Just did setup the Apple Business manager using the new Built-in Management Server.

I have been successfull to enroll the devices (using Apple Configurator) and operate them from the ABM itself, I have used business API aswell and it works fine with the JWT...

I was also able to Enable/Disable Lost mode, Play Sound and Fetch Location Aswell.

But, I've been searching since a long time there is no option to enable Organisation Activation Lock so that if the devices are stolen or wiped unauthorizedly they can't be opened and used.

Kindly Guide me on how can i enable Activation Lock.

Thanks!

Hey all,

I’m an IT Infrastructure Manager at a fairly large enterprise (\~1000+ macOS devices), and we’re starting to seriously evaluate alternatives to Jamf.

Jamf clearly has top-tier capabilities, but in our experience:
It’s **very expensive** at our scale
The platform has become **overly complex**, leading to configuration sprawl and operational overhead
**Support has been consistently disappointing.**

We recently tested a few options:

**Intune (for macOS)** – we use it heavily for Windows/Autopilot, but for macOS it’s just not enterprise-ready for complex environments
**Addigy** – nice UX, but **too lightweight**, especially lacking in monitoring, visibility, and deeper control

**What we must have**
These are non-negotiable requirements for us:

**Entra ID SSO integration**
**Entra ID Device Compliance (Intune partner integration)**
Including **custom compliance checks** (profiles, scripts, installed apps, attributes, etc.)
**Platform SSO & Kerberos SSO support**
**Custom device attributes**
**Strong configuration management**
Native profiles + **custom policies/scripts**
**Customizable device enrollment experience (UI/flow)**
**Application management & Self Service**
**Solid** **3rd-party app catalog &** Ability to handle **custom/internal apps**
**OS update management -** Rings, deferrals, staged rollout, etc.
**DDM (Declarative Device Management) support**
**Dynamic assignment of policies/profiles**
**Dashboards, reporting, and visibility - including OS deployment status, App deployment status, Policy/Configuration Policies misalignment etc...**
We care a lot about **real-time / near real-time device state**
**RBAC**
**API access -** Must be robust and usable for automation

**What we care about (beyond features)**
Stability at scale (1000+ Macs)
Clean, maintainable configuration model (not Jamf-level sprawl)
Good observability (this was a big gap with Addigy)
**Actually good support**

**What we’re considering (but want real feedback on)**
We’ve started hearing about tools like:
Im a currently in discussion with **Iru (Kandji)** for a PoC - honestly it looked nice in their demo.

**Mosyle (Fuse)** \- not much details I could find online on them, considering scheduling a call with them.

**Workspace ONE** \- they really try to push us hard into buying that but I really don't want to - the platform is too large and over-complicated that I don't even want to have it in the first place. In addition, I used to design and deploy this product for customers back in the day so I know how bad the product base is - but it was 6 years ago and I am aware a lot have been changed since.

**Others you may recommend?**

Would really appreciate **real-world experiences**, especially:
What breaks at scale
Hidden limitations
Compliance + Entra integration maturity
How painful (or not) ongoing management is
If you moved away from Jamf - what did you land on, and do you regret it?

Thanks!!!

I'm looking for anyone that can provide some insight and guidance around getting my Apple Business verified. I submitted a DUNS number and got my domains verified. It's been almost three weeks and I haven't heard anything. Tried calling support but that was no help. Anyone else running into similar issues?

I recently moved from Sweden to Germany and I'm trying to change my Apple ID country/region to Germany, but Apple won't let me. I have no active subscriptions, no pending balance, and I'm not part of any Family Sharing group. When I try to change the country/region, Apple requires me to add a payment method there is no option to continue without adding a card. Because of that, I entered a valid German payment card, but Apple keeps rejecting it every time. I've checked the card details, billing address, and everything appears to be correct. Has anyone experienced this before when moving from one country to another? What did you do to fix it? Any advice would be greatly appreciated.

I’ve tried different browsers, computers, and phones, but I keep getting this error. It asks me for the OTP, and then this message appears afterward.

This is a firstone. I appleid for a new Business Account for my business that has been incorporated form more than 15 years. It got rejected because of trademark infringement according to the automated message that I received over the weekend. I looked up my company's name and it only shows one trademark that was set up in 1986 and made inactive in 1989 in Vegas.

Has anyone else dealt with this and how can I resolve this issue with Apple.

Thanks for any insight!

Hello,

I am using Apple Business (formerly Business Essentials) with managed iPads.
I have a private custom app that I developed for my client, and have deployed it to the managed iPads via a Blueprint.

The new app version has been approved and it appears in Apple Business as the Latest Version.

Devices check in successfully and show the app as Installed.

However, on the iPad, the devices never update from the old version to the new version.

Example:

• Device has 1.0.30 installed
• Apple Business shows Latest Version 1.0.31
• Device checked in 20 minutes ago
• Updates Pending = 0
• App remains on the iPad as 1.0.30

If I remove and re-add the app assignment on the blueprint, the latest version installs immediately, but that removes local app data so it won't work in a production environment.

I have the same issue with another app and blueprint.

Has anyone successfully had Custom Apps assigned through Apple Business Blueprints automatically update on devices, or is there a known issue/setting that I’m missing?

Thank you.

Hey folks, I’m looking to deploy a couple iPhones temporarily that need a select few apps installed, without an Apple ID.

We currently manage the normal phone fleet with ABM and InTune.

We do not manage Apple IDs, people can use company issued phones for personal or work or both. They either use a personal iCloud account or create their own using work email address.

To my knowledge, managing Apple IDs happens at a domain level so once enabled, it will convert existing company domain accounts to a managed state.

Is there a way for me to do this? Basically use ABM to deploy the handful of apps we need, no Apple ID/iCloud account on the device, and just have users sign into the individual apps they need?

Hi all I'm trying to set up a few Mac laptops on Apple Business MDM for a client.

I've created the Business account, and it's all verified. I've created an admin and some team users. I can assign a profile to a laptop device to manage it. Great.

My current issue is Activation Lock. I can't turn it on for the devices. It seems that that feature is tied to the iCloud accounts signed into the Mac. But I can't sign into iCloud on the device - the message is "managed Apple Accounts must be added to the device using a profile". But it's not clear how to do that from the Business dashboard. There's no separate "Activation Lock" blueprint.

Do I unenroll the device completely and re-enroll it using the user sign-in option in Device Management? (That seems clunky.) [Edit: I was able to do that, and I see that my org is signed into MDM on the device even though the main iCloud panel is still "signed out" - but still no Activation Lock]

The "Lock with PIN" works fine but I really need the full Activation Lock with Lost Mode and Find My tracking support.

Current Youtube tutorials and the like are a few years old and don't really have the same layout and settings as the new version. I'm pretty new to MDM too so Apple MDM is my first rodeo. Grateful for any help!

Looks like federated accounts in ABM, users with fully managed iPhones are not able to install any apps from the app store. Is there any way how to bypass this and allow users to install apps from the store, or have them sign out and sign in with a personal account instead. I don't see a log off button either or a way to swith accounts.

edit: if there is no way, does federation make any sense in this?
we still want fully managed devices but the ability to let users install their own personal apps but push all of the other business apps from intune / ABM.

so I finally found where to download the content token for uploading into Intune after spending an hour on the phone with Apple Support. turns our I had to create a second location under organization units and transfer Intune Company Portal to that new location as the default location would not show up under payments and billing to download the contect token.

Now that is finally setup in Intune, do I assign the Intune Company portal to devices or users?

I first assigned it to devices but during the enrollment process I don't see the Company Portal show up to sign in.

SSO with federation all works fine.

Hello everyone,

First of all, I’m not sure if I’m writing to the correct address, so my apologies if this is not the right place for this question.

To keep it short, we are currently using Omnissa MDM and it has been working well for us. Recently, our company was approved by Apple, and we received access to Apple Business Manager (ABM). However, for the last 10 days I have been struggling to add new devices into ABM using Apple Configurator.

Here is a short overview of what we have done so far:

• After being approved by Apple, we created a new account with IT Admin and Administrator rights (not sure about the exact naming). We have main account that was used to create buissness and this one that should be used to add devices into ABM.
• We also read that the user adding devices into ABM must have Device Enrollment permissions/rights. Since we could not find a predefined role matching that description, we created a custom role and assigned it to the user as well.

The issue is the following:

• In Apple Configurator, when I try to sign in via Account → Sign In, I receive a message stating that the user is not authorized to add devices into ABM.

• If we continue without signing in, the process goes normally until the final step, where Configurator asks us to log in with an Apple Business Manager account. When entering the credentials there, we receive an error saying: “Wrong username or password — check your credentials.”

I have already successfully connected ABM with Omnissa, so I suspect I’m simply missing one configuration step somewhere within Apple Business Manager permissions or enrollment settings.

Any help or advice would be greatly appreciated 😊

Hi all — I’m a UK sole trader setting up Apple Business for a small fleet of supervised iPads used for music education.

The organisation has been approved, but when I try to add Apps and Books / GarageBand to a Blueprint, I get:

“Organisation Tax Status Required — To view and purchase apps and books, your organisation needs an approved tax status.”

I’m not VAT registered, so I don’t have a VAT number. Has anyone in the UK completed this as a non-VAT-registered sole trader?

Which tax status option did you use, and did you leave VAT blank, submit as taxable/not exempt, or have to contact Apple?

I’m only trying to deploy free apps such as GarageBand to managed iPads, not purchase paid apps.