Whether you have 10 devices or 10,000, it’s easier than ever to integrate, manage, deploy and secure your Apple devices. With Apple Business Manager, devices can be distributed directly to employees and used straight
out of the box, all without manual configuration.
iPhone, iPad, Mac and Apple TV fit into your existing corporate infrastructure. Apple makes it easy for IT teams to administer devices, manage configurations, distribute apps and content, and secure corporate data. And with flexible deployment models, IT can get employees up and running faster than ever with the best tools for their jobs.
Apple Business Manager is a web-based portal helping IT administrators deploy iPhone, iPad, Mac and Apple TV. They can easily provide employees with access to Apple services; set up device enrolment; and distribute apps, books and customised apps — all from one place.
Enrol devices to be set up automatically with mobile device management (MDM). Streamline and customise the setup process for employees.
Easily buy apps and books for employees. And now distribute customised apps within your organisation.
Create Managed Apple IDs for employees and assign privileges for additional users on your IT team.
Apple makes it easy to choose the right deployment option to meet the needs of your organisation. Protect company information while maintaining privacy for employees who bring their own device to work with User Enrolment. IT can establish a higher level of control on organisation-owned devices with supervision and Device Enrolment.
Private and secure for bring your own device (BYOD).
User Enrolment allows employees to protect their privacy while IT keeps corporate data safe. Behind the scenes, a separate volume keeps managed data cryptographically separated.
IT can manage a subset of configurations and policies while restricting certain management tasks such as remotely wiping a device or collecting personal information.
Employees bringing their own device to work can use their existing Apple ID alongside a Managed Apple ID for corporate data. All data is kept separate and private.
When a personal device is enrolled with User Enrolment, MDM is limited to certain management functions.
Configure accounts
Configure per-app VPN
Install and configure apps
Require a passcode
Enforce certain restrictions
Access an inventory of
work apps
Remove work data only
Access personal information
Access an inventory of personal apps
Remove any personal data
Collect any logs on the device
Take over personal apps
Require a complex passcode
Remotely wipe the entire device
Access the device’s location
IT can automatically provision devices into MDM during setup — straight out of the box. IT can also customise the onboarding experience to streamline the process for employees.
By using supervision, IT can use controls not available for other deployment models, including additional security configurations, non-removable MDM and software update management.
Provide devices to employees for their daily use, share devices among employees
for common tasks, or configure devices for a specific purpose that are locked to a single app.
When an Apple device is supervised, IT has a higher level of control to configure settings and apply restrictions.
Configure accounts
Configure global proxies
Install, configure and remove apps
Require a complex passcode
Enforce all restrictions
Access an inventory of all apps
Remotely erase the entire device
Manage software updates
Remove system apps
Modify the wallpaper
Lock the device to a single app
Bypass Activation Lock
Force Wi-Fi on
Place the device in Lost Mode
All Apple devices have a built-in, secure management framework, enabling IT to configure settings, manage devices and set up security features remotely over the air. IT can easily create profiles to ensure employees have everything they need to be secure and productive. Apple devices enable IT to manage with a light touch without having to lock down features or disable functionality, and still keep company data protected.
With the secure management framework in iOS, iPadOS, macOS and tvOS, IT can configure and update settings, deploy applications, monitor compliance, query devices and remotely wipe corporate data. The framework supports organisation‑owned and employee‑owned devices.
MDM supports configuration for apps, accounts and data on each device. This includes integrated features such as password and policy enforcement. Controls remain transparent to employees while ensuring their personal information stays private. And IT maintains necessary oversight without disrupting the productivity employees need to succeed.
Whether your business uses a cloud-based or on‑premises server, MDM solutions are available from a wide range of vendors with a variety of features and pricing for ultimate flexibility. And each solution uses the Apple management framework in iOS, iPadOS, tvOS and macOS to manage features and settings for each platform.
IT can delay over‑the‑air updates for supervised iOS, iPadOS, macOS and tvOS devices. This gives IT time and flexibility to complete a thorough certification. Once IT certifies a version of each release, they can decide what version users should download and install. Then IT can directly push the update to all employees to ensure they have the latest security features on all their devices.
Personal information is always private. Regardless of enrolment method.
Every Apple product is designed with privacy in mind. On-device processing is used whenever possible. The collection and use of data is limited. And everything is designed to provide users with transparency and controls for their data.
The MDM protocol allows IT to interact with an Apple device but limits the exposure of certain information and settings. Regardless of deployment model, the MDM framework can never access personal information such as email,
messages, browser history and device location.
iOS, iPadOS and macOS make it easier than ever for IT to integrate with your organisation’s directory service or cloud identity provider. IT can now link Apple Business Manager to Microsoft Azure Active Directory, making it seamless for employees to access Apple services with a Managed Apple ID.
Managed Apple IDs are created, owned and managed by the organisation and are designed for BYOD and organisation-owned devices. Organisations can use Apple Business Manager to automatically create Managed Apple IDs for employees. This enables employees to collaborate with Apple apps and services as well as access corporate data in managed apps that use iCloud Drive. Managed Apple IDs can also
be used alongside a personal Apple ID on
employee‑owned devices when organisations
leverage User Enrolment.
The latest versions of iOS, iPadOS and macOS introduce a new system-wide extension framework for single sign-on to make it easier for employees to sign in to corporate apps and websites. The new extension framework requires support from cloud identity providers and is configurable through MDM. And for organisations using Kerberos, a first-party extension provides password management and local password sync for internal applications.
With federated authentication, IT teams can connect Apple Business Manager to Microsoft Azure Active Directory, enabling employees to use their existing user names and passwords as Managed Apple IDs. Employees can access Apple services such as iCloud Drive, Notes, Reminders and collaboration, all with their existing credentials. And Managed Apple IDs are automatically created when a user first signs in to an Apple device with their Azure AD user name and password.
To prepare for this simplified sign-in experience:
Verify that your business uses Microsoft Azure Active Directory
Determine the business domains you’d like to link to Apple Business Manager
Set up the connection to Microsoft Azure Active Directory in Apple Business Manager
Apple Business Manager makes it easy to find, buy and distribute content in volume to meet your every business need. Purchase any app available on the App Store, or use customised apps built specifically for your business either internally or by third-party developers. And when apps are distributed through MDM, IT won’t need to use redemption codes or Apple IDs to get content onto each device.
Buying apps in volume for iOS, iPadOS and macOS is even easier with Apple Business Manager. When app licences are no longer needed, they can be reassigned to another device or employee. You can also manage licences for customised apps made specifically for your business, whether they were developed internally or by third-party developers. And by purchasing Volume Credit, you can use purchase orders to buy content through your reseller.
Apps purchased through Apple Business Manager can be distributed easily through MDM to users or devices in any country where the apps are available. With Apple Business Manager, you can privately and securely distribute content to specific partners, clients and franchisees. And now you can also distribute proprietary apps to internal employees.
Once devices are set up, IT can manage and protect corporate data thanks to built-in security features and additional controls made available through MDM. Common frameworks across apps enable configuration and ongoing management of settings.
IT can enforce and monitor security policies through MDM. For example, requiring a passcode via MDM on iOS and iPadOS devices automatically enables Data Protection, providing file encryption for the device. An MDM policy can also enable FileVault encryption on a Mac to secure all data at rest. And MDM can be used to configure Wi-Fi and VPN and deploy certificates for added security.
When a device goes missing, your corporate data doesn’t have to go with it. For iOS, iPadOS and macOS devices, IT can remotely lock and erase all sensitive data to protect your company’s information. For supervised iOS and iPadOS devices, IT can enable Lost Mode to see the device’s location. IT also has the tools to manage corporate apps, which can be instantly removed from a device without erasing personal data.
MDM solutions allow device management at a granular level without the need for containers, keeping corporate data safe. With Managed Open In, IT can set restrictions to keep attachments or documents from being opened in unmanaged destinations and vice versa. And on macOS, built-in security features let IT encrypt data, protect devices from malware and enforce security settings without the need for third-party tools.
Thanks to a common framework and controlled ecosystem, apps on Apple platforms are secure by design. Our developer programs verify the identity of every developer, and apps are verified by the system before they are launched on the App Store. Apple provides developers with frameworks for features such as signing, app extensions, entitlements and sandboxing to provide even greater levels of security.