8 ms·

I recently tried setting Apple Business Manager for our ≈20 people SME. The first step was "Domain Lock/Capture" which takes over all Apple accounts for a spec

• geoffharcourt 7mo ago
  The domain lock process was an absolute fiasco at our company. I think this could work if you did this at the time your company launched, but the moment you have employees who have Apple IDs tied to their work email that aren't from the Business Essentials system you are stuck in an impossible-to-mange place. There are several cheap MDM solutions for Apple devices that I would rather pay for than be dependent on this. (We've used SimpleMDM and love them.)
  • cocoflunchy 7mo ago
    I'm currently in that hellish process too... I don't know how to get out of it. Did you know that your employees will be forbidden from downloading from the App store once you launched that migration? It's a nightmare
    • FireBeyond 7mo ago
      Apple and MDM has always been a shit show. In the days as recently as Ventura (last time I tried it), MDM bypass was as simple as "null route 4 DNS entries during install process, remove null routing after install complete, and never be bothered by it again". This is on Apple Silicon. With no workarounds or anything, upgrades work all the way up to Tahoe. Like really Apple, that's your device "locking"? I could test activate my work Mac with my personal Apple ID while doing this, no alarm bells, nothing, effectively "It's your laptop now".
      • IrishTechie 7mo ago
        The baffling thing is that iOS+MDM has been fantastic over the years. macOS is a completely different beast though.
        • jamiecurle 7mo ago
          MacOS used to be excellent for a short period of time when Fleetsmith existed. Then Apple purchased Fleetsmith around 2020 and killed the product not long after. Fortunately around the same time, JamF ended the practice of the mandatory Jamf JumpStart (£5K fee), which finally made Jamf a feasible option for the company I was in at the time.
          • wolvoleo 7mo ago
            True, I remember looking at jamf at one point and the mandatory consulting was so annoying because we already had it dialled in on the free trial. In the end we just made do with intune. It's a lot less capable for Mac but these days you can get by with it.
            • bzmrgonz 7mo ago
              hopefully there's no kill switch for macs on intune, if not, the threat of wiping machines with one click is real, just ask stryker; https://www.cybersecuritydive.com/news/stryker-attack-device-management-microsoft-iran/814816/ https://www.cybersecuritydive.com/news/stryker-attack-device...
              • wolvoleo 7mo ago
                Of course there is a kill switch. This is one of the key features of an MDM/endpoint manager. You won't be able to sell one without it. It's also built in to apple's management protocol (which most endpoint management systems leverage) and in activesync. You just have to secure it properly. Have limits to how many one admin can wipe etc. But trust me every company with managed IT assets has this capability. Often even in BOYD scenarios! Stryker just failed to secure access to it properly and to set sensible limits. However, the feature isn't very effective in the field. It's very unlikely for an attacker to be smart enough to bypass the password on a stolen Mac which is needed to connect it to WiFi, yet at the same time be dumb enough to connect it to the unfiltered internet so it can receive the wipe command. The overlap between these sets of people is almost zero. We do fire a wipe at every stolen computer but I doubt it ever actually happens. If it ever happens it'll be a total end user fail (like writing the password on a post-it with the laptop) Either you will lose it to a common thief who won't be able to breach the login (99% of cases), or to a really targeted adversary who has cellebrite or something similar and won't connect it to the internet ever again. This is still the most risky scenario because if someone like that steals it, there's bound to be something really valuable on it. In practice this is something more suited to mobile devices.
    • wpm 7mo ago
      Well yeah, the idea is that if you have ABM, you have an MDM you can use to purchase licenses for them and install the apps with the MDM.
      • IrishTechie 7mo ago
        It can be done that way, but it is definitely not the norm. Businesses will generally “purchase” (many for €0) apps in ABM that are to be used for business purposes and push those to devices, the user can then use an Apple ID to download any other apps they want for personal use.
        • ndespres 7mo ago
          If they’re using Managed Apple IDs they will have no access at all to the app store and won’t be able to download their own apps anymore. IT department will have to buy and assign any apps that anyone needs, even the $0 ones that only 1 person needs.
          • lynx97 7mo ago
            If my employer did that to me, I would seriously consider sueing them.
            • jazzyjackson 7mo ago
              You’ve never been issued a work computer that’s not yours to fuck around with?
              • deleted 7mo ago
                [deleted]
              • ghaff 7mo ago
                I haven’t. Did have issued laptops that were company managed but I basically didn’t use and, in any case, I like many others reinstalled a clean operating system image and did my own support.
    • geoffharcourt 7mo ago
      I did not. If I had known what would happen when we tried this we would have skipped the process entirely. Our staff (roughly 125) was so confused and it wasted a lot of time communicating about it, then trying to roll it back, etc.
    • TheNewsIsHere 6mo ago
      The Domain Capture process cannot be canceled once it’s started. It’s also not required, unless by your company policy. The point is to make sure there’s not a mess on the other end when you enforce SSO for MAIDs. Apple’s documentation for ABM and ABE is atrocious, but they do manage to document a bunch of footguns, just poorly and in seemingly bizarre places. For example, ABE doesn’t support MDM migration (either as source or destination), despite the fact that the feature launched with macOS/iOS/iPadOS 26 and is supported by other MDM solutions. And you cannot push custom config profiles with ABE which declare a non-Apple preference domain. Utter nonsense. If you’re using the full ABM-with-ADE and MDM stack, it’s expected that you push apps to employees. You can also use Munki to make apps available to users. You can just push only Munki via MDM if you want, and let it manage app installs and self service installs for you. There are caveats.
  • wil421 7mo ago
    How does a company allow personal Apple IDs?
    • pottertheotter 7mo ago
      I think the idea is that it happens before they lock the domain as a business. Before that, if you have an email address you can create a personal account with it.
      • jamiecurle 7mo ago
        yes, that's exactly how it happens.
    • rescbr 7mo ago
      Employee needs to download Microsoft Remote Desktop (sorry, Windows App) that is only distributed through App Store. Employee does not trust the company having access to everything else in their personal iCloud account - photos, mails, messages, calendar, reminders, etc. Employee registers a new Apple ID with company email, as it would be only used for downloading one single app.
      • wil421 7mo ago
        Got it. It’s registering with the company email first, not their personal one.
  • pottertheotter 7mo ago
    > I think this could work if you did this at the time your company launched, but the moment you have employees who have Apple IDs tied to their work email that aren't from the Business Essentials system you are stuck in an impossible-to-mange place. I had the same thing happen but with Microsoft. A friend and I had started a small consulting business and were using Google Workspace, but I needed a Microsoft account to interact with a client. I made one with my business email. None of us knew any better, but I couldn’t connect with our client’s Microsoft setup because it was a personal account. So I went to set up a business account. It was a whole fiasco and the only way I could really fix it was create an alias and use that for Microsoft.
  • yabutlivnWoods 7mo ago
    > I think this could work if you did this at the time your company launched This should not be a surprise. Greenfield services have not existed long enough to resolve edge cases that inevitably arise while integrating existing operating models already in use.
    • geoffharcourt 7mo ago
      The broken part of this process (domain claim) has existed for several years as part of ABE, it isn't new.
      • yabutlivnWoods 6mo ago
        My point was trying to fit a new company with no barnacles into an existing process model will always be easier than retrofitting an existing company model full of edge cases the service never had to engineer around Not really sure why you made that point only to wave it away later saying it's always been broken regardless
  • AdamN 7mo ago
    That's why Enterprise vendors try so hard to get startups using their stuff. Lock-in is so strong. I can't imagine having a working system at a 100 person company and then trying to migrate to something else unless the current situation was truly awful.
  • SoftTalker 7mo ago
    > the moment you have employees who have Apple IDs tied to their work email that aren't from the Business Essentials system you are stuck in an impossible-to-mange place So give all the employees an email alias they can use to create a new Apple ID for this purpose?
• cj 7mo ago
  We use Apple Business Manager. Locking a domain is not a requirement if you're just doing basic MDM, I'm pretty sure. (I also had a negative experience with it, so we didn't use it and everyone just uses their personal apple IDs). Is it no longer possible to skip this step in setting up the account?
  • gregoriol 7mo ago
    In any serious business, you don't want people to use their personal Apple IDs: that could lock their company provided devices for ever when they leave, you also don't want to buy them apps that you won't be able to re-use when they leave, ...
    • cj 7mo ago
      > that could lock their company provided devices for ever when they leave MDMs like JamF offer override codes to disable activation lock. Hasn’t been an issue in my experience.
• quietsegfault 7mo ago
  This was my experience switching from GMail to Apple’s mail service. I switched back after a few days.
  • givinguflac 7mo ago
    Genuinely curious, what were the Apple mail service issues for you? I hate gmail and have had zero issues with my @Mac.com email in 20+ years, that I’ve noticed. Thanks
    • quietsegfault 7mo ago
      Lots and lots of missing messages. That was the big one. Anything from a SaaS just never arrived, like tickets, notifications, etc. I had random IMAP authentication failures too.
    • xp84 7mo ago
      Do you find that iCloud email can correctly handle both “true spam” (meaning the nonsense garbage kind) and “promotional email” effectively?
• true_religion 7mo ago
  AFAIK, it works with subdomains, so you can use something like employees.example.com as your domain, and capture over that.
  • slyn 7mo ago
    The org I work for just makes alias's - @ourbrandmdm.com for ABM that forward to their @ourbrand.com emails.
• razakel 7mo ago
  I gave up when it wanted a Dun and Bradstreet number (whoever they are) and the website to get one didn't work.
  • dlg 7mo ago
    I have had the misfortune of having to get D&B numbers (for various Apple things). I believe is the source for lead lists where you start to get dozens to text and phone spam calls per day. Do not pay hundreds of dollars for this if you can at all avoid it.
    • keerthiko 7mo ago
      Definitely avoid unless you are distributing a consumer application through the dominant app stores (App Store and Google Play) ~globally, in which case you may not be able to avoid (or avoiding will be just as much work). Google and Apple require it for lots of mobile apps targeting certain consumer segments because some countries (eg: Brazil, IIRC? don't quote me on that) have chosen to use D&B as a qualified unique identifier of business legitimacy and it requires exposing personal information of your company's leadership to them.
  • yolo3000 7mo ago
    Afaik every company has a DNB number. It's a credit risk company which sources company data from every country.
  • bitwize 7mo ago
    Dun & Bradstreet is a business credit agency. Having a D-U-N-S number, which they issue, is like table stakes for being taken seriously as a business.
    • deleted 7mo ago
      [deleted]
    • deleted 7mo ago
      [deleted]
    • 6mo ago
• SoleilAbsolu 7mo ago
  FWIW, my experience doing this process for a ~130 person org last year was pretty painless compared to other Domain Claims I've initiated for other SAAS vendors (Docusign in particular), and MDM nightmares (expired JAMF certificates, I'm looking at you). We had to do it as ppl had made personal Apple accounts using our domain, meaning if they logged in with such an account and left, their iPhone magically transformed into an expensive, elegant paperweight. Due to a setting in our previous MDM we were unable to migrate data cleanly using Apple Biz Manager without committing to use ABM as our MDM (we couldn't) so we told people to "move it yourself following these detailed instructions, otherwise it can't be migrated." Regarding personal data like health on company-managed devices, I certainly don't share that type of info with my employer, and make it clear to staff that it's not our responsibility to migrate such data.
  • deleted 7mo ago
    [deleted]
  • bzmrgonz 7mo ago
    Can you expand on this, specifically how it compares with jamf? It is a direct competitor to jamf right? Essentially Apple vying to eat their lunch right?
• czscout 7mo ago
  Yes, as an IT professional at a company where a few people have insisted on using Macs, the ABM workflow is by far the most frustrating, half baked product I've had the displeasure of using. People love to complain about Entra/Azure AD, but ABM is another level of obtuse.
  • pseufaux 7mo ago
    What's bad is that it's so much better than it used to be and still this bad.
• jillesvangurp 7mo ago
  Same here, I never even got in. I never managed to get in. My account is good enough to take my money for other things but somehow I can't manage to onboard into the damn thing so that I can actually manage devices for my company. I just gave up in the end. Couldn't get it done. I'll try again next month see how far I get with this. This needs to be way simpler than it currently is. Hopefully they fixed a few things there.
• jiveturkey 7mo ago
  you only need to do the domain lock part if you plan to use MAIDs. For 20 people you probably didn't need to do that, at least not at the same time as the rest. You can do it as a later step, not the first step.
• matt_daemon 7mo ago
  Apple's cloud software has been buggy as hell for a long time, at least for me. I'm in a family iCloud group with my parents... one day I just woke up and had all my podcasts and music replaced with my Mum's :/ Would not want this anywhere near a "business" experience
  • ezfe 7mo ago
    I'm just gonna go ahead and say that I'm not sure what happened there but either you or your mom signed in with your account on the other device. I have a lot of technical understanding with how CloudKit works and there's not a pathway for what you're describing to come out of a family group.
    • ukuina 7mo ago
      Hence, "buggy".
    • jazzyjackson 7mo ago
      Maybe Something to do with Family Purchase Sharing. I didn’t realize when I bought an audio book it would appear in my dad’s library. Kind of embarrassing. Apple’s help pages make it sound very opt in but I think there are bugs where libraries are merged by default. Some say on a quiet night you can still hear Bono singing “sexy boots”…
      • ezfe 7mo ago
        Libraries are not merged, only purchase history. It does not download to their device in any scenario automatically. A lot of people have their iTunes accounts signed in on other devices which would do what you describe, but not family sharing.
• nuodag 7mo ago
  I also organised this process at work, and it went rather well, (300ppl 10 year old), but of course no one had health data connected under the company domain, thats a crazy idea and it’s probably good apple enforces that to be deleted / moved / disentangled. It is also clearly described how to move an account that is used privately to a different domain / mail.
• deleted 7mo ago
  [deleted]
• neuroelectron 7mo ago
  >The process is also impossible to cancel. This sort of thing should probably be illegal.
• cyptus 7mo ago
  some years ago i tried this setup for a german company with a special char in its name („ä“) and failed because Apple was not able to match it against DUNS. It took months of support to get it done.
• wolvoleo 7mo ago
  It's completely impossible for a 60k employee shop too yeah. They also want you to rearrange the azure ad the way Apple wants. Also impossible for us. And we have like 20k or so users with manually created Apple IDs on their company email and every one of them has to be manually resolved. It's a joke.
• AnthonyMouse 7mo ago
  > Be warned. This is exactly what I would have expected from an Apple "business" offering. Apple's whole shtick is to take away most of your choices so that they can focus on the limited number of things they still allow you to do. Businesses need the opposite of that. Businesses will show up needing integrations with multiple existing third party (often legacy) systems with inherent complexity and then want something that allows them to manage that complexity since it can't be eliminated. It's not really possible in that context to have the experience people otherwise expect Apple to provide, and the thing Apple normally does will often make it worse by removing choices you may have needed in order to make interaction with a third party system less of a pain.
• clawoo 7mo ago
  I had a "wonderful" experience as well. I wanted to evaluate it for MDM purposes so I applied for an ABM account for a company I work for, got soft-approved, created an entirely new Apple ID (as required by the ABM), used it to log on a test device I intended to manage, then sort of forgot about it while awaiting for Apple to conclude their hard-approval for the ABM account creation. Apple was supposed to contact the business owner to verify company details and finalize the process over the next few days, but they never did. 30 days later they canceled the ABM company account and deleted all the associated users along with the Apple ID which I used to log into a testing device, which now became a fairly expensive paperweight. I had very little expectations about the experience and I was still disappointed.
  • TimByte 7mo ago
    This is the kind of failure mode that makes people nervous about tightly coupled identity + device management
• tom1337 7mo ago
  Ohh we had a similar experience with Google Cloud. Added our organization and Domain into their Auth system and suddenly all users were migrated into a (invisible / transparent) workspace and could no longer use their calendar or google drive as the workspace had no free usage like you have on a normal free tier.
• thepratt 7mo ago
  Our recent (ongoing) experience with Apple Business Manager is just as bad. With no reason or contact they've sent "we can't verify so we've disabled your account because you don't meet the requirements". We ring support and they tell us to try again with no additional information. We then get "we can't verify so we've deleted your accounts" with no information. "Amazing" "experience". This is also after they've verified us (and our DUNS number) for app signing and distribution. We already have a verified account in another service of theirs!
• TimByte 7mo ago
  Apple's clean separation model only really works if you start that way from day one
• classified 7mo ago
  Apple really seems to go out of their way to show users the middle finger.