Apple Business: A 2026 Guide for IT Admins

Apple Business (Formerly Apple Business Manager) is the unified platform IT teams use to enroll devices, distribute apps, manage identities, and connect to MDM solutions across their entire Apple fleet. If you're managing more than a handful of Macs, iPhones, or iPads, this platform is the foundation everything else runs on.

This guide covers the full scope of Apple Business: what changed with the 2026 consolidation, how to configure each major capability, and how to integrate it with a professional MDM to get full enterprise control.

What Is Apple Business (and What Changed in 2026)?

Apple Business is the result of Apple consolidating three previously separate services into one:

• Apple Business Manager (ABM): Device enrollment, app and book purchasing, and MDM server assignment
• Apple Business Essentials (ABE): Apple's own lightweight MDM product targeting small businesses
• Apple Business Connect: Brand identity management for Apple Maps, Siri, and Wallet

Instead of managing separate portals and credentials for each service, IT admins now work from a single Apple Business dashboard. The underlying capabilities are unchanged, but the organizational structure is cleaner. You'll still configure Automated Device Enrollment (ADE), Volume Purchase Program (VPP) licenses, and Managed Apple IDs from the same place you always did. The difference is that brand listings and device management subscription tiers are now visible in the same interface.

For enterprises already using ABM with a third-party MDM, the functional workflow is nearly identical. The consolidation matters most for smaller organizations that were splitting time across portals, and for any team that needs to manage brand presence alongside fleet management.

Apple Business Setup: Prerequisites and Initial Configuration

Before you can enroll a single device, you need to get the Apple Business account itself established. This is a one-time process, but getting it right matters because errors here affect every downstream workflow.

Requirements before you start:

• A D-U-N-S number for your organization (free, but takes up to 5 business days to verify)
• A domain you control and can verify ownership of
• An Apple ID that does NOT have two-factor authentication tied to a personal device you might lose access to (create a dedicated admin Apple ID)
• Legal authority to agree to Apple's terms on behalf of your organization

Initial setup sequence:

1. Go to business.apple.com and click "Enroll Now"

2. Enter your D-U-N-S number and organization details

3. Verify your domain by adding a DNS TXT record Apple provides

4. Apple reviews your enrollment (typically 1-3 business days)

5. Once approved, sign in and assign your first administrator account

After your account is active, the first configuration tasks are setting up your MDM server connection, creating Managed Apple ID domains, and enrolling your first devices. The order matters: connect your MDM before you try to assign devices, otherwise you'll have devices in ABM with nowhere to push profiles to.

Automated Device Enrollment and Zero-Touch Deployment

Automated Device Enrollment (ADE) is the feature most IT teams use Apple Business for first. When a device purchased through an authorized Apple reseller or directly from Apple is associated with your Apple Business account, it becomes supervised automatically during Setup Assistant. No IT hands on keyboard required.

To understand the full mechanics of how this works within a broader device management framework, the article on what is zero touch deployment is worth reading alongside this guide.

How ADE works in practice:

1. A new MacBook ships to an employee's home address

2. The employee powers it on and connects to Wi-Fi

3. Setup Assistant contacts Apple's servers, which recognize the serial number as belonging to your organization

4. The device contacts your MDM server and downloads the enrollment profile

5. MDM profiles, certificates, and configurations push automatically

6. The employee completes a shortened Setup Assistant flow (you control which screens appear) and lands on a fully configured desktop

The key technical requirement is that your MDM server must be registered as an MDM server within Apple Business and assigned to the device (or device group) before the device is activated. Devices purchased through carriers or retail don't appear in Apple Business by default. You'll need to work with your reseller to ensure they're submitting serial numbers to Apple's Reseller portal, or use Apple Configurator 2 for devices that arrived outside the normal procurement chain.

Supervision status matters. ADE-enrolled devices are supervised by default. Supervised status unlocks a significantly larger set of MDM commands and restrictions, including the ability to silently install apps, enforce screen time policies, prevent device removal from MDM, and enable Single App Mode. Any device that isn't supervised will have meaningful gaps in what your MDM can control.

Managed Apple IDs: Configuration and Identity Federation

Managed Apple IDs (also called Managed Apple Accounts in current Apple documentation) are Apple IDs that your organization owns and controls. They're separate from employees' personal Apple IDs and give you the ability to revoke access when someone leaves, reset passwords without employee cooperation, and enforce usage policies.

For organizations running fewer than 50 devices, creating Managed Apple IDs manually is feasible. At enterprise scale, you federate your identity provider (IdP) with Apple Business so accounts are created and deprovisioned automatically.

Supported identity federation methods:

• Google Workspace: Native federation built into the Apple Business console. Google Workspace users get Managed Apple IDs that mirror their Google accounts.
• Microsoft Entra ID (formerly Azure AD): Federation via SCIM provisioning. Users are pushed from Entra ID to Apple Business automatically when you configure the connector.
• Other SAML 2.0 IdPs: Apple supports federated authentication with any SAML 2.0-compliant IdP, though setup is more manual than the Google and Microsoft native integrations.

Platform SSO is a related but distinct capability worth configuring alongside Managed Apple IDs. With Platform SSO, macOS uses the device's MDM enrollment to authenticate users to your IdP at login, eliminating the need for a separate local password. This requires macOS 13 (Ventura) or later and an MDM that supports the ExtensibleSingleSignOn payload. When configured correctly, an employee's Entra ID or Okta credentials become their Mac login credentials, and Kerberos tickets for on-premise resources are issued automatically.

What Managed Apple IDs cannot do:

• Purchase apps from the App Store personally (purchasing is handled through VPP at the org level)
• Use iCloud Family Sharing
• Access certain Apple services that require a personal Apple ID (Apple Pay, personal iCloud storage beyond what the org provides)

For BYOD deployments, Managed Apple IDs work differently. In User Enrollment mode, the employee's personal Apple ID remains active for personal data, while a Managed Apple ID handles corporate data in apps. The MDM can only see and manage the corporate partition. For a detailed look at how to structure BYOD policies, see the guide on BYOD device management.

App Distribution via Volume Purchase Program

Volume Purchase Program (VPP) is the mechanism Apple Business uses to purchase and distribute apps and books at scale. Instead of employees buying apps with personal Apple IDs and submitting reimbursement requests, IT buys licenses centrally and assigns them to devices or users.

Two assignment models:

• Device-based assignment: The app is installed on a specific device regardless of which Apple ID (if any) is signed in. Best for shared devices, kiosks, and any workflow where the app is tied to the hardware.
• User-based assignment: The license is assigned to a Managed Apple ID. The user can install the app on up to 5 devices associated with their Managed Apple ID. Better for personal productivity apps that follow the employee.

How to set up VPP distribution through your MDM:

1. In Apple Business, go to Apps and Books and purchase the required number of licenses

2. Copy the VPP token from the Content Tokens section of Apple Business

3. Upload the token to your MDM server

4. Assign apps to device groups or user groups in your MDM

5. The MDM pushes installation commands; no App Store interaction required from the user

Licenses are revocable. When an employee leaves, you can reclaim their VPP licenses and reassign them within minutes. This is a meaningful cost control mechanism for expensive per-seat enterprise apps.

For internally developed apps, Apple Business supports Custom Apps, which allows your organization to distribute proprietary apps without putting them on the public App Store. Your development team submits through App Store Connect, and you distribute exclusively to your organization. This also works for B2B app distribution where a vendor builds an app specifically for your organization.

Roles and Access Control in Apple Business

Apple Business uses a role-based access model. Getting this right prevents situations where a junior IT staff member can accidentally unassign devices from MDM or where a manager can see device details they shouldn't.

Built-in roles:

Administrator accounts should be tightly controlled. Best practice is to have no more than two or three Administrator accounts, all tied to role-specific Managed Apple IDs rather than personal accounts. Every other IT staff member should have only the role they need. This is directly relevant to SOC 2 and ISO 27001 compliance, which require least-privilege access controls for administrative systems.

One practical consideration: if your only Administrator account becomes inaccessible (the person left, the Managed Apple ID was deleted by mistake), recovering access requires contacting Apple Support and providing organization verification. This takes time. Maintain at least two Administrator accounts owned by the IT organization, not individuals.

Integrating Apple Business with Your MDM

Apple Business handles device enrollment and content purchasing. It does not enforce policies, monitor compliance, or remediate security issues. That's your MDM's job. The two work together, with Apple Business as the enrollment authority and your MDM as the policy engine.

If you want to understand the full scope of what device management covers beyond enrollment, the overview of how device management works provides useful context.

The technical integration flow:

1. Register your MDM server in Apple Business (Settings > MDM Servers > Add MDM Server)

2. Download the MDM public key from your MDM vendor and upload it to Apple Business

3. Download the Apple-signed MDM server token from Apple Business and upload it to your MDM

4. Set default MDM server assignments by device type (Mac, iPhone, iPad) or by device

5. Configure your MDM's ADE enrollment profile, including which Setup Assistant screens to skip

Once connected, any device that appears in Apple Business under your account can be assigned to your MDM server. Devices assigned before activation will automatically enroll during Setup Assistant. Devices already in use can be enrolled by signing in to the MDM's enrollment URL or through Apple Configurator 2.

Common integration issues and fixes:

• Device not appearing in Apple Business: The reseller hasn't submitted the serial number. Contact them with the order number and request submission to Apple School Manager or Apple Business directly.
• ADE enrollment profile not applying: The device was activated before the serial was added to Apple Business. Use Apple Configurator 2 to wipe and re-enroll.
• VPP token expired: Tokens expire annually. Set a calendar reminder to renew 30 days before expiration to avoid app distribution interruptions.
• MDM server token mismatch: If you regenerate the token in Apple Business without updating your MDM, enrollment will break. Always update both sides simultaneously.

Apple Business Essentials vs. Professional MDM: Where the Line Is

Apple Business Essentials (now integrated into Apple Business) is Apple's own lightweight MDM. It costs $2.99 to $12.99 per user per month depending on the tier and includes basic device management, iCloud storage, and AppleCare+ coverage bundled together.

For organizations with fewer than 50 Apple-only devices and minimal compliance requirements, Essentials covers the basics. For anything beyond that, you'll run into limits quickly.

Where Essentials falls short for enterprise:

• No support for complex conditional access policies
• Limited third-party security tool integration
• No cross-platform management (Windows, Android, Linux)
• Basic reporting with no custom compliance dashboards
• No API access for automation or custom workflows
• Limited script execution and patch management capabilities
• No support for advanced CIS Benchmark or NIST 800-53 compliance configurations

If your organization has a security team that needs to demonstrate compliance against a specific framework, Essentials won't give you the audit-ready reporting or the policy granularity to do it. Professional MDM solutions built specifically for enterprise Apple management fill that gap.

For teams managing mixed fleets that include Android devices, Essentials is a non-starter. You'd need a separate solution for Android regardless, making a unified cross-platform MDM the more operationally efficient choice. You can explore what that looks like in the guide on Android device management.

Enterprise-Scale Deployment Considerations

Deploying Apple Business for 50 devices and deploying it for 5,000 devices are different problems. The platform mechanics are the same, but the operational decisions compound at scale.

Multi-location and multi-region deployments:

• Use MDM server assignment rules to route devices to the correct MDM server or MDM server scope based on device type or purchase location
• For organizations in multiple countries, understand that App Store regions affect which apps are available. Some apps are not available in every App Store region. If your organization operates globally, test app availability across regions before committing to a specific app for a global rollout.
• Reseller relationships matter. Not all authorized Apple resellers integrate with Apple Business's automatic device enrollment submission. Vet your resellers before signing procurement contracts.

Device lifecycle management at scale:

Apple Business tracks devices from the moment they're purchased through your supply chain. Building on that with a complete device lifecycle management strategy means tracking not just enrollment but warranty status, configuration history, and retirement workflows.

• For retirement: MDM wipe commands sent through your MDM will erase the device and remove the MDM profile. The device remains in your Apple Business account until you manually release it.
• For transfers: If you're selling or donating devices, release them from Apple Business to remove the ADE association. A device left in Apple Business will try to enroll with your MDM when the next owner sets it up, which creates a poor experience and a potential security issue.
• For hardware tracking: Apple Business provides basic serial number and model information, but serious hardware inventory management requires pulling data from your MDM, which has access to much more granular hardware attributes.

Migrating from legacy ABM to unified Apple Business:

If your organization has been running ABM for years, the migration path is largely automatic since Apple handled the consolidation. Your existing MDM server connections, VPP tokens, and device assignments carry over. What you should audit post-consolidation:

• Confirm all MDM server tokens are current and haven't expired during the transition period
• Review Administrator role assignments, since the consolidation may have surfaced accounts you've forgotten about
• If you were using Apple Business Essentials alongside ABM, clarify internally which management tool is authoritative going forward
• For teams planning to switch MDM solutions during or after this transition, the guide on Apple MDM migration covers the sequencing in detail

Security and Compliance Integration

Apple Business provides the enrollment foundation, but it doesn't enforce security policies. That responsibility falls entirely to your MDM and your security stack.

At a minimum, enterprise Apple deployments should be configured to meet the CIS Apple macOS Benchmark standards. These benchmarks specify configuration requirements across 200+ controls including Gatekeeper enforcement, FileVault encryption, firewall state, SIP status, and password policy minimums. None of these are enforced by Apple Business itself. All of them require MDM configuration profiles.

Security controls that require MDM, not just Apple Business:

• FileVault encryption enforcement and escrow key management
• Gatekeeper and XProtect policy enforcement
• Firewall configuration and application-layer controls
• Certificate deployment for internal certificate authorities
• VPN profile distribution
• Screen lock timeout and password complexity requirements
• Restriction payloads (USB, camera, AirDrop, Bluetooth controls)
• Software update enforcement and deferral windows

For organizations subject to SOC 2, HIPAA, PCI-DSS, or FedRAMP requirements, your compliance mapping needs to account for which controls Apple provides natively, which require MDM configuration, and which require additional endpoint security tooling. Apple Business alone satisfies none of these frameworks. It's a prerequisite, not a compliance solution.

How Iru Approaches Apple Business Integration

Iru is built to work with Apple Business from day one. When you connect your Apple Business account to Iru, device enrollment, app distribution, and identity data flow directly into the platform without manual data entry or token management workarounds.

The practical difference shows up in a few specific areas:

Zero-touch deployment with built-in compliance: When a device appears in Apple Business and gets assigned to Iru, you can configure it to automatically receive a Blueprint that includes security configurations mapped to CIS Benchmarks or NIST 800-53 controls. The device arrives at the employee's desk already encrypted, with the firewall enabled, the screen lock configured, and required apps installed. No IT intervention required, and the device is compliant from first boot.

Automated remediation beyond MDM profiles: Apple Business tells you a device is enrolled. Iru tells you whether it's actually compliant and can take action when it's not. If a device falls out of compliance because a user disabled FileVault or removed a required certificate, Iru can detect that and remediate it automatically, not just alert on it.

Identity federation that extends into endpoint access: Iru integrates with the same IdPs you federate through Apple Business (Entra ID, Okta, Google Workspace) and carries that identity context through to Platform SSO configuration, certificate-based authentication, and conditional access policies. You're not managing identity in Apple Business separately from managing access in your MDM. It's one workflow.

Compliance reporting that maps to frameworks: For teams that need to demonstrate compliance to auditors, Iru provides reports that map device configuration states to specific CIS Benchmark controls, not just a list of installed profiles. When an auditor asks whether all devices have FileVault enabled with escrowed recovery keys, you can show a report that answers the question directly, filtered by device group, department, or location.

Iru doesn't replace Apple Business. It works with it, the same way any professional MDM does. What changes is the depth of control, automation, and visibility you get once that Apple Business connection is established.

Choosing the Right MDM to Pair with Apple Business

Apple Business is free and mandatory for any serious Apple fleet. The decision isn't whether to use it, it's what to build on top of it.

When evaluating MDM solutions to pair with Apple Business, focus on these criteria:

Apple-first vs. cross-platform architecture: MDM vendors built originally for Windows and extended to Apple often have meaningful gaps in macOS and iOS feature support. If your fleet is predominantly Apple, an Apple-first MDM will have tighter integration with Apple's APIs and faster support for new OS features.

Compliance automation depth: Look for pre-built compliance frameworks, not just policy templates. The difference is whether the tool checks device state against a benchmark and tells you what's out of compliance, versus just letting you push profiles and hoping for the best.

Security ecosystem integration: Your MDM should integrate with your EDR, SIEM, and identity tools. Devices enrolled through Apple Business should surface in your security tooling automatically, with hardware attributes, OS version, and compliance state available for correlation.

API coverage: Enterprise deployments require automation. If you can't drive MDM actions from your IT service management (ITSM) system or trigger workflows from your IdP, you're going to be doing a lot of manual work that should be automated.

Support for advanced Apple features: Platform SSO, Declarative Device Management (DDM), return to service, and managed device attestation are newer Apple capabilities that Apple Business enables but that require MDM support to actually configure. Verify that your MDM vendor supports these features before committing.

For teams currently running Apple Business Essentials and considering moving to a professional MDM, the operational lift is lower than most expect. Your device enrollments through Apple Business remain intact. You're adding an MDM layer on top of, not replacing, the Apple Business infrastructure.

If you're ready to see how Iru integrates with Apple Business for zero-touch deployment, automated compliance, and enterprise-grade security, request a demo to walk through your specific deployment scenario with an Iru engineer.