Get fresh insights, pro tips, and thought starters–only the best of posts for you.
Towards the end of the last decade, zero-touch device management gained a lot of popularity and zero-touch deployment was a huge deal back then. Apple already had a zero-touch deployment method of its own called the Device Enrollment Program (DEP). Apple also had an app procurement and deployment service Volume Purchase Program (VPP). But in 2018, Apple decided to club these two services together to form an all-in-one deployment and provisioning service called Apple Business Manager or ABM.
ABM simplified the whole process of device management. But ABM alone was not enough to manage Apple devices. In this blog we’ll see what Apple Business Manager is, how it helps to manage Apple devices, the relationship between ABM, and Mobile Device Management (MDM) tools and much more.
Many people think that ABM is an MDM, but it couldn’t be any further from the truth. ABM indeed helps to manage devices, but it cannot perform every function required to manage Apple devices effectively. So, what is ABM? Here is the answer. ABM — now rebranded by Apple as Apple Business — is an online service provided by Apple to enroll and configure devices as well as assign them to users in an organization. You can also buy and distribute apps to devices in bulk using ABM. As the name suggests, ABM is perfect for businesses that provide Apple devices as work devices.
ABM is certainly not a replacement for MDMs, but it does simplify certain aspects of device management. As mentioned above, deployment is an area where Apple Business Manager can help organizations the most. Once your organizational ABM account is set up, you can automate the device enrollment into mobility management tools.
Apple devices bought directly from Apple, or any authorized reseller will be automatically added to the ABM portal once the customer ID or reseller number is registered in the ABM portal and from there you can set up an MDM server so that the devices will be automatically enrolled in the mobility management solution of your choice. Just like with VPP — now referred to as Apps and Books in the console — you can buy app licenses and books from App Store in bulk and distribute them to organizational devices.
Apple adds devices to your ABM portal by keeping track of device purchases made by your organization using authorized channels. You have to add your Apple Customer Number and/or also the authorized reseller’s Reseller number if you purchased the devices from them. The reseller has to verify your Organization ID and if the details are okay, the devices will be added to the ABM portal.
Apart from these two major features, you can create and control Managed Apple Accounts (formerly known as Managed Apple IDs) using ABM. These corporate IDs can help separate work data from personal data and secure sensitive information on organizational devices as well as personal devices. Businesses can even make use of Apple at Work’s own Single Sign-On to secure access to company apps and resources.
If you’ve been researching ABM, you’ve probably also come across Apple School Manager, or ASM. It’s easy to assume they’re the same thing with different names.
They’re not entirely.
ASM is Apple’s education-focused counterpart to ABM. Both run on the same underlying framework — Automated Device Enrollment, Apps and Books, and Managed Apple Accounts all work the same way in either portal.
The difference lies in who each one is built for.
ASM adds tools specifically designed for classrooms. This includes Student Information System (SIS) integration, class-based user grouping, and shared iPad support for multiple students using the same device throughout the day.
ABM, on the other hand, is built for the standard enterprise use case — one device, one employee, no classroom rostering required.
So, which one should your organization enroll in?
If you’re a school, district, or educational institution, ASM is the right choice. It gives you everything ABM offers, plus the education-specific workflows you’ll actually need.
If you’re a business managing employee devices, ABM is the one to use.
Either way, the relationship with MDM stays the same. Whether you’re syncing ASM or ABM to Hexnode, the enrollment, supervision, and app distribution processes work identically. The portal just decides which extra tools sit on top.
Before you can start deploying devices using ABM you have to set up an ABM account and enroll your organization in the ABM portal. Once that is done, you are ready to deploy devices to users, enroll them in MDMs and deploy apps and books in devices. Here is what you need to enroll your organization in ABM:
There are a few prerequisites for the initial administrator account and the verification contact. The work email address of the admin should not be associated with iTunes, iCloud, or any other Apple service before and after the initial setup. The person in possession of the verification contact details should be authorized to sign the agreement and terms of Apple Business Manager on behalf of the organization. Last but not least, the admin account holder and verification contact should not be the same person.
Once you have all the details mentioned in the section above, you can follow the steps below:
Since both have a few similarities, people might think ABM and MDM are interchangeable. But Apple Business Manager is not a replacement for MDM nor is MDM a replacement for ABM. MDM and ABM work best when they are together. As I mentioned earlier, it is possible to connect MDM servers to the ABM portal so that, you can assign devices to the MDM server. This way, devices will be enrolled in the MDM as soon as it is switched on and connected to the internet.
So how does this connection actually get made behind the scenes?
It comes down to two things: a public key certificate and a server token.
Here’s how the handshake works.
First, your MDM generates a public key certificate. You upload this certificate to your ABM account under the MDM server settings.
In return, ABM gives you a server token. This token is what you upload back into your MDM console — in Hexnode’s case, under Admin > Apple Business/School Manager.
Once both sides recognize each other, devices assigned to that server token will automatically enroll into your MDM the moment they’re activated.
There’s a catch worth knowing about, though.
This server token isn’t permanent. It expires annually, and if it lapses, new devices will stop auto-enrolling until you renew it. This is one of the most common reasons zero-touch enrollment suddenly “breaks” for IT teams.
A good practice is to set a calendar reminder a few weeks before expiry, so you can download and upload a fresh token without any disruption to your device rollout.
Once this token exchange is set up correctly, you won’t need to touch it again until renewal time. Everything else — assigning devices, syncing accounts, pushing configurations — happens automatically from there.
But I can enroll my Apple devices in an MDM even without ABM, then why should I use it? This is a question at least some people will have. For starters, if you enroll your devices using ABM, there won’t be a need to manually set up the device. The device will be all set to use right after it is switched on. Apart from that, you can supervise the Apple device when it is enrolled using ABM. Supervision opens up a lot of possibilities for MDMs in terms of device management.
Any device management features that your ABM portal is unable to provide can be configured via an MDM. Also, you can monitor devices in real-time and create reports on devices and users to make sure that everything is going smoothly. You can also meet regulatory compliance standards using an MDM like Hexnode. Last but not least, MDM can mitigate the consequences of lost or stolen devices much more efficiently.
While researching ABM, you may have also come across Apple Business Essentials, or ABE.
It’s worth clearing up where this fits in.
ABE is Apple’s own subscription bundle built for small businesses. It combines a lightweight built-in MDM, iCloud storage, and AppleCare+ support, all in one package starting at a few dollars per device, per month.
On paper, it sounds like it could replace the ABM-plus-third-party-MDM approach entirely.
In practice, it’s designed for a specific, limited use case.
ABE works well if you’re a small team with fewer than a few hundred devices and fairly simple management needs. But it isn’t built to scale.
Once your organization grows past that ceiling, or needs deeper controls like granular app blocklisting, advanced compliance reporting, or cross-platform management for Windows and Android alongside Apple devices, ABE’s built-in MDM starts to show its limits.
This is exactly where pairing ABM with a dedicated UEM platform like Hexnode makes more sense from day one.
You get everything ABM offers for deployment and provisioning, without being boxed into a single-vendor, Apple-only ecosystem as your fleet expands.
So, if you’re a growing business, or already managing a mix of device types, skip ABE and go straight to ABM plus a proper MDM. It’ll save you a painful migration down the line.
Okay, now you are equipped with the information on what Apple Business Manager is, how to set it up, and why ABM works well together with an MDM solution. But which MDM is the best? Well, if you haven’t already made up your mind, here is why you should consider Hexnode.
Learn about all the different features available in ABM and ASM and the benefits of pairing these platforms with a UEM solution like Hexnode.
Download the white paperJust like any other MDM that supports Apple devices, Hexnode also offers integration with ABM enabling seamless and easy device deployment. Apart from taking advantage of Apple Business Manager’s features, Hexnode offers a lot more. Here are some of the key things Hexnode offers in terms of Apple device management:
Existing enrolled devices are not affected and continue to function normally under your MDM. The expired token only blocks new devices from being assigned and auto-enrolled through that server connection. IT admins simply need to download a fresh token from ABM and re-upload it to resume zero-touch enrollment for new hardware.
Yes, one MDM server can typically be linked to multiple ABM or ASM accounts using separate server tokens for each. This is common for organizations managing devices across different regions, subsidiaries, or reseller relationships. Each token exchange is independent, so renewing one does not impact the others.
Switching MDM providers requires generating a new public key certificate from the new MDM and uploading it to ABM to receive a fresh server token. Devices must then be reassigned to the new MDM server within the ABM portal before they can re-enroll. This process does not happen automatically and needs manual reconfiguration during migration.
No, apps and books purchased through ABM’s Apps and Books feature can be distributed without requiring employees to use a personal Apple ID. Managed Apple Accounts can be used instead to keep corporate app licensing separate from personal accounts. This also allows licenses to be reclaimed and reassigned when an employee leaves or a device is retired.
No, Apple devices can be enrolled in an MDM without ABM, but this requires manual setup and doesn’t support zero-touch deployment or supervision. ABM is what enables devices to auto-enroll and apply configurations the moment they’re activated. Without it, IT admins must configure each device individually before handing it to the end user.
While Apple Business Manager offers streamlined device deployment and management, it is not a direct replacement for Mobile Device Management (MDM). ABM excels when used together with an MDM solution, forging a solid combination that maximises management and efficiency. By integrating Hexnode with Apple Business Manager, you harness the power of both tools, enabling seamless device management, enhanced security, and comprehensive oversight. Take advantage of the ABM and MDM partnership to maximize the effectiveness of your device management strategy and boost productivity throughout your company.
Sign up for a free trial and explore how Hexnode can help you get the most out of Apple Business Manager.
Sign Up!
