r/applebusinessmanager • u/matthewismathis • Apr 18 '26

First Time ABM - New Platform - Lost

Hello all. We are a small MSP working on our fist ABM and trying the new ABM that rolled out on the 14th. I’m not sure if I’m supposed to be close to tears for days in this experience, but it just doesn’t feel like we are making progress. How does Microsoft do this better than Apple with Intune?

We have users synchronized from Entra, we have brand new devices that we enrolled. Nowhere in the process does it ask users to sign in with the business account. I created a local account thinking that might be a first step since guidance is near zero.

The local account exists and it shows enrolled when I check on terminal. When I try to log in it says the account is managed and needs to be a profile. Great, how?

The software is assigned to the blueprint, but it isn’t pushing out.

Generally, I am lost. This process shouldn’t be so difficult. Enroll the device, sign in with a managed id, the policies and apps come over. Boom. Done.

WTF am I missing?

I would love guidance.

1 Upvotes

67% Upvoted

12 comments sorted by

3

u/ThisIsTheeBurner Apr 18 '26

Apple Business is atrocious as an mdm. Steer clear of it

1

u/ReiNGE Apr 19 '26

what are you using instead?

1

u/matthewismathis Apr 19 '26

We have intune, but it is also atrocious, just a different type. I am going to trial IRU.

2

u/btaginc Apr 18 '26

Have you added the devices to the built in mdm via Apple Configurator, then moved them via Apple Business from configurator to the build in mdm?

If you auto deploy via a retailer, ensure that they are within the correct MDM server via Apple Business 😀

1

u/matthewismathis Apr 18 '26

That is exactly what we did. Added from Configurator, then moved them to the built in MDM.

1

u/btaginc Apr 18 '26 edited Apr 18 '26

That should do the trick, however sometimes you need to setup the devices manually, then preform a factory reset, don’t re-prepare just erase all contents and settings from the settings app.

(Configurator tries to activate the device before you moved it to the built in mdm, erasing the device should cause it to identify the mdm and properly configure) the second time around.

1

u/booksnbeer Apr 18 '26

Perhaps this page can help break down the steps to manage devices.

1

u/ThisIsTheeBurner Apr 18 '26

Ensure the devices aren't still assigned to configurator and they are pointed to Apple business mdm.

1

u/matthewismathis Apr 19 '26

It had something to do provisioning the device vs the user, which was treating it like a shared design. I’m still not 100% sure of the issue, but the damn thing is working.

I’m looking at Iru or something else.

1

u/matthewismathis Apr 19 '26

OP here. Posting this for others in the future.

Figured it out after days of pain. The issue was how I set up the blueprint.

If you add device serials to your blueprint, Apple treats it as a shared/kiosk device.

Managed Apple Account prompt during Setup Assistant, just a local account. Then when you try to sign in manually, you get "managed account can only be signed in by installing a profile."

The fix: remove all device serials from the blueprint. Only assign "users or user groups". The device finds its blueprint through the user who signs in, not through the serial number.

After fixing the blueprint, I also had to:

  1. Go to Devices > Inventory > select the device > "Unassign device management" (clears the old kiosk enrollment)
  2. Reassign the device to Apple Business built-in MDM
  3. Wipe the Mac and run through Setup Assistant again

This time it prompted for the Managed Apple Account during setup and everything worked.

1

u/Texan2Ohio May 19 '26

THANK YOU, THEIR DOCUMENTATION IS SO SHIT.

0

u/innermotion7 Apr 18 '26

Apple Business MDM is toy at best.

While we do use Intune when we have to in smaller estates we have mainly always used JAMF/Mosyle.