After a quick Beta this Spring, Apple recently announced General Availability for Apple Business Manager (ABM) in the US. Following on in June, they added support for 34 additional countries, with plans for coverage in a total of 65 countries by the end of Summer 2018. We’ve been receiving a high volume of questions from our customers about Apple Business Manager, which is why we recently published this overview on our community portal (requires MobileIron credentials). At MobileIron, we’re very excited about this important evolution of management capabilities, and we thought it would be fun to share the top 5 reasons you should be too!
What is Apple Business Manager?
Apple Business Manager (ABM) is an Apple-hosted cloud portal (https://business.apple.com) that allows businesses to manage the Device Enrollment Program (DEP), Volume Purchase Program (VPP), Apple IDs, and content from a central management point. It also provides granular access control with admin delegation so admins can be created with responsibility only for certain locations. All of these features are packed into a brand new, easy-to-navigate, and intuitive portal.
What Apple Business Manager doesn’t do
ABM isn’t a replacement for Unified Endpoint Management. All of the configurations and policies your organization currently deploys to devices using MobileIron will continue to be deployed using the same management servers. ABM simply augments and consolidates some of the management capabilities that customers have been using for years through the DEP and VPP portals. Once an organization upgrades to ABM, in most cases they will no longer need to use the DEP and VPP portals to manage devices assignment, apps purchases, or content.
The evolution of Apple Business Manager
According to Apple, this powerful new portal is a logical evolution of Apple School Manager, first introduced in 2016, with some important differences. ASM is a portal that allows school admins to integrate with Learning Management Systems (LMS), create Apple IDs for students and teachers, and manage DEP. Apple School Manager also helps educational staff organize schools, classes, and districts so that teachers can deliver coursework through the Classroom app and content through iBooks. It’s a powerful tool for educational institutions, and businesses have been taking notice and asking for something similar. Since the target market for ABM is so different, not all of the features available for Apple School Manager are available for Apple Business Manager (and vice-versa), but on the whole they are more alike than different.
If you are currently using DEP or VPP, you can upgrade to ABM by visiting https://business.apple.com from desktop Safari or Chrome. Once you begin what Apple refers to as the upgrade process, all of your DEP tokens will be updated and visible in the ABM portal. Note that you will need to use the “Program Agent” account to complete the upgrade process, which is the original admin credential used to create your DEP account.
VPP tokens can also be imported, but please note that the only sToken that will be imported is the one associated with the current “Program Agent” that performed the Apple Business Manager upgrade. Other VPP tokens associated with your domain should be able to be controlled by pointing them to a Location using the traditional VPP portal, but we advise a cautious approach based on our preliminary testing.
5 Reasons to start using Apple Business Manager
Delegation and roles
Companies can now assign and edit role permissions using Role Based Access Control (RBAC) to different administrators. In addition, admins can create administrators that only have jurisdiction over certain locations. Locations are created by adding a physical street address, but companies may wish to use them to help manage subsidiaries. For instance, a location could be created for a company that was just acquired, and a role could be assigned to an admin that only allows them to control VPP and DEP functionality for that subsidiary.
Apps and books (VPP)
Businesses can now create new VPP tokens (by adding Locations) and delegate admins to manage app licenses through the ABM portal. Content such as books can also be pre-purchased and distributed. When a new location is created, a new VPP sToken is automatically created, and apps or books can be purchased and associated to a Location using ABM. An additional benefit is that app licenses can now be transferred between Locations.
One note of caution: if your company had multiple VPP tokens in use before the update to ABM, you may want to continue managing them through the traditional VPP portal. As Apple consolidates VPP tokens associated with Apple ID’s in your domain, eventually all existing sTokens should be managable directly through ABM.
Default DEP servers for device types
One important new feature is the ability to select a default DEP enrollment server based on the type of Apple device. Choices include Apple TV, iPad, iPhone, iPod, and Mac. This feature will be especially welcome to admins using different UEM platforms to manage macOS and iOS devices for example. To learn more about some of MobileIron’s robust macOS management capabilities, please download our macOS white paper here.
Managed Apple IDs
With Apple Business Manager, the enterprise can now manage Apple IDs for employees that need administrative access to Apple Business Manager. The accounts are for ABM portal use only, and can’t be used for services like iCloud, the App Store, iTunes, or Apple Music. If you’d like to learn more, Apple has created an extensive article on how Managed Apple IDs can be used with ABM here.
Store credit lets you pre-purchase apps with a PO
In the past, it was sometimes challenging for companies to purchase paid VPP apps for distribution due to a credit card requirement. Now companies can purchase app and book credit the way they are used to doing, with a Purchase Order (PO). The credits purchased through a PO can subsequently be added to the ABM portal. For more information on how to purchase credits from Apple or an approved reseller, you can check out this article from Apple
Should my company take the leap?
In our testing so far, we haven’t seen any hiccups in the upgrade process to ABM. Our DEP associations experienced an extremely smooth transition to the new portal. Even on an instance with over 20 UEM/DEP token associations, services continued to flow without interruption. VPP works very well too, but if you are managing many VPP sTokens in your organization, you may need to continue to managing some of the VPP instances using the legacy VPP portal at vpp.itunes.com. MobileIron is also planning future enhancements to create an even deeper VPP integration by supporting location-based enhancements. While VPP works flawlessly today, we envision an even stronger joint solution in the future.
Customers who are currently using the old DEP portal (deploy.apple.com) will definitely want to consider making the leap to ABM as soon as possible to take advantage of the new and improved interface. ABM’s new role and location-based features are especially welcome to companies that are managing subsidiaries or have many DEP and VPP admins. Any of the reasons outlined today might be compelling for your organization, and you can feel confident that, when deployed with MobileIron, Apple Business Manager is working well!