diff --git a/articles/6-business-benefits-of-apple-mdm-explained.md b/articles/6-business-benefits-of-apple-mdm-explained.md index 7093d370e6d..46dbcd75964 100644 --- a/articles/6-business-benefits-of-apple-mdm-explained.md +++ b/articles/6-business-benefits-of-apple-mdm-explained.md @@ -1,6 +1,6 @@ # 6 business benefits of Apple MDM, explained -The Apple [Mobile Device Management](https://support.apple.com/guide/deployment/intro-to-apple-platform-deployment-dep2c1b2a43a/web) (MDM) protocol provides remote management capabilities organizations need to configure and secure Apple devices like Macs, iPhones, iPads, Apple TV and even Apple Watch. Combined with Apple Business Manager or Apple School Manager (ABM / ASM) organizations can achieve scalable zero-touch enrollment, automated provisioning and comprehensive security enforcement resulting in fast, simplified device deployment across distributed workforces. +The Apple [Mobile Device Management](https://support.apple.com/guide/deployment/intro-to-apple-platform-deployment-dep2c1b2a43a/web) (MDM) protocol provides remote management capabilities organizations need to configure and secure Apple devices like Macs, iPhones, iPads, Apple TV and even Apple Watch. Combined with Apple Business or Apple School Manager (AB / ASM) organizations can achieve scalable zero-touch enrollment, automated provisioning and comprehensive security enforcement resulting in fast, simplified device deployment across distributed workforces. ## What is Apple Mobile Device Management (MDM)? @@ -117,7 +117,7 @@ Employees think about their work rather than fighting with the device that been ## Getting started with Apple MDM -[Fleet](https://fleetdm.com/device-management) provides enterprise-grade MDM with API-first architecture, real-time device reporting, and cross-platform support for Mac, Windows, and Linux. It also integrates with Apple Business Manager for zero-touch deployment while maintaining complete data transparency. [Schedule a demo](https://fleetdm.com/contact) to see how open device management works without vendor lock-in. +[Fleet](https://fleetdm.com/device-management) provides enterprise-grade MDM with API-first architecture, real-time device reporting, and cross-platform support for Mac, Windows, and Linux. It also integrates with Apple Business for zero-touch deployment while maintaining complete data transparency. [Schedule a demo](https://fleetdm.com/contact) to see how open device management works without vendor lock-in. diff --git a/articles/apple-device-enrollment-program.md b/articles/apple-device-enrollment-program.md index bcbf0b0847f..1fedd98e563 100644 --- a/articles/apple-device-enrollment-program.md +++ b/articles/apple-device-enrollment-program.md @@ -6,7 +6,7 @@ This article covers how ADE works, which devices qualify, security controls, and ## Automated Device Enrollment overview -ADE links devices purchased through authorized channels to your organization in Apple Business Manager (ABM) before they reach employees, allowing them to ship directly to end users. When users power on their devices for the first time and connect to the internet, automatic MDM enrollment begins. Users complete Setup Assistant screens while device configuration applies from your [MDM server](https://fleetdm.com/device-management) in the background. +ADE links devices purchased through authorized channels to your organization in Apple Business (AB) before they reach employees, allowing them to ship directly to end users. When users power on their devices for the first time and connect to the internet, automatic MDM enrollment begins. Users complete Setup Assistant screens while device configuration applies from your [MDM server](https://fleetdm.com/device-management) in the background. Apple originally launched this capability in 2014 as the Device Enrollment Program and rebranded it to Automated Device Enrollment (ADE) in December 2019 alongside the launch of ABM. The underlying technology remained the same, but the new name better describes what the system actually does. @@ -79,7 +79,7 @@ ADE is an enrollment mechanism configured through ABM, not a complete management When evaluating MDM vendors for ADE compatibility, you need to verify several technical requirements. Check that the platform supports Apple Push Notification certificate management with annual renewal processes, offers Setup Assistant customization options that let you control the enrollment experience, and can handle multiple MDM servers if your organization needs different management systems for different regions or business units. -When migrating from one management service to another, if your devices are on older versions of Apple operating systems they may need to be completely erased to re-enroll. If possible, admins should ensure all devices are on the latest Apple OS version. [Managed Device Migration](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web) announced at [WWDC 2025](https://fleetdm.com/announcements/mdm-just-got-better) allows computers and mobile devices to be migrated without erasing simply by moving device records from one virtual MDM server to another in Apple Business manager. Limited tests of migration behavior on test devices before comitting to your entire fleet will determine if OS updates are needed. +When migrating from one management service to another, if your devices are on older versions of Apple operating systems they may need to be completely erased to re-enroll. If possible, admins should ensure all devices are on the latest Apple OS version. [Managed Device Migration](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web) announced at [WWDC 2025](https://fleetdm.com/announcements/mdm-just-got-better) allows computers and mobile devices to be migrated without erasing simply by moving device records from one virtual MDM server to another in Apple Business. Limited tests of migration behavior on test devices before comitting to your entire fleet will determine if OS updates are needed. Cross-platform capabilities also matter if you manage more than just Apple devices. Organizations with mixed device environments benefit from MDM platforms that handle Mac, Windows, and [Linux](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet) from a single console rather than juggling separate management tools. [Fleet](http://fleetdm.com) supports ADE enrollment for Mac, iPhone, and iPad devices while also managing Windows and Linux endpoints. Its open-source model provides complete code transparency so you can verify exactly how devices are managed, and self-hosting options let you maintain full control over where device data lives. @@ -89,13 +89,13 @@ Setting up ADE requires some upfront preparation to ensure smooth deployment. Yo You should start by confirming you have these essential prerequisites in place: -* Apple Business Manager account with D-U-N-S number and domain verification +* Apple Business account with D-U-N-S number and domain verification * [MDM vendor](http://fleetdm.com) supporting ADE enrollment and APNs certificate management * Authorized reseller relationships for automatic device registration * Network infrastructure permitting connections to Apple servers without SSL/TLS inspection * Certificate renewal procedures using the same Apple ID for annual APNs renewal -Beyond technical infrastructure, configuration planning determines how users experience enrollment. You need to define enrollment profiles that specify which Setup Assistant screens users see during initial setup, establish device naming conventions that make sense for your IT team, and create department-specific configurations for different user groups. Make sure to assign these profiles in Apple Business Manager before distributing devices so enrollment happens smoothly without last-minute troubleshooting. +Beyond technical infrastructure, configuration planning determines how users experience enrollment. You need to define enrollment profiles that specify which Setup Assistant screens users see during initial setup, establish device naming conventions that make sense for your IT team, and create department-specific configurations for different user groups. Make sure to assign these profiles in Apple Business before distributing devices so enrollment happens smoothly without last-minute troubleshooting. ## Conclusion diff --git a/articles/apple-mdm-setup.md b/articles/apple-mdm-setup.md index ad32bcdb71f..9d859ec102c 100644 --- a/articles/apple-mdm-setup.md +++ b/articles/apple-mdm-setup.md @@ -2,63 +2,75 @@ To turn on macOS, iOS, and iPadOS MDM features, follow the instructions on this page to connect Fleet to Apple Push Notification service (APNs). -To use automatic enrollment (aka zero-touch) features on macOS, iOS, and iPadOS, follow instructions to connect Fleet with Apple Business Manager (ABM). +To use automatic enrollment (aka zero-touch) features on macOS, iOS, and iPadOS, follow instructions to connect Fleet with Apple Business (AB). To turn on Windows MDM features, head to this [Windows MDM setup article](https://fleetdm.com/guides/windows-mdm-setup). ## Turn on Apple MDM -Apple uses APNs to authenticate and manage interactions between Fleet and hosts. - -To connect Fleet to APNs or renew APNs, head to the **Settings > Integrations > Mobile device management (MDM)** page. - -Then select **Turn on** under the Apple (macOS, iOS, iPadOS) MDM section. +Apple uses Apple Push Notification service (APNs) APNs to authenticate and manage interactions between Fleet and hosts. > Apple requires that APNs certificates are renewed annually. > - The recommended approach is to use a shared admin account to generate the CSR ensuring it can be renewed regardless of individual availability. -> - If your certificate expires, you must turn MDM off and back on for all macOS hosts. Until then, configuration profile changes and other MDM commands will remain stuck in “Pending.” -> - Be sure to use the same Apple ID from year-to-year. If you don't, you will have to turn MDM off and back on for all macOS hosts. +> - If your certificate expires, you must turn MDM off and back on for all Apple hosts. Until then, configuration profile changes and other MDM commands will remain stuck in “Pending.” +> - Be sure to use the same Apple Account from year-to-year. If you don't, you will have to turn MDM off and back on for all Apple hosts. -## Apple Business Manager (ABM) +How to connect Fleet to APNs: -> Available in Fleet Premium +1. In Fleet, navigate to the **Settings > Integrations > MDM** page. +2. Select **Turn on** for Apple (macOS, iOS, iPadOS) MDM. +3. Select **Download CSR** to download a certificate signing request (CSR) for Apple Push Notification service (APNs). +4. Sign in to [Apple Push Certificates Portal](https://identity.apple.com/pushcert/). If you don't have an Apple Account, create one. +5. In Apple Push Certificates Portal, select **Create a Certificate**, upload your CSR, and download your APNs certificate. +6. Upload APNs certificate (.pem file) in Fleet. + +### Renew APNs -Connect Fleet to your ABM to allow automatic enrollment for company-owned and [Account-driven User Enrollment](https://fleetdm.com/guides/enroll-personal-byod-ios-ipad-hosts-with-managed-apple-account) for personal (BYOD) macOS, iOS, and iPadOS hosts. +1. In Fleet, navigate to the **Settings > Integrations > MDM** page. +2. Select **Edit** next to **Apple MDM turned on**. +3. Select **Renew certificate** and then select **Download CSR** to download a certificate signing request (CSR) for Apple Push Notification service (APNs). +5. Sign in to [Apple Push Certificates Portal](https://identity.apple.com/pushcert/). +6. In Apple Push Certificates Portal, select **Renew** next to your certificate. Make sure that the certificate's **Common Name (CN)** matches the one presented in Fleet. If you choose a different certificate, you must turn MDM off and back on for all Apple hosts. +7. Upload your CSR and download new APNs certificate. +8. Upload APNs certificate (.pem file) in Fleet. + +## Apple Business (AB) + +> Available in Fleet Premium -### To connect Fleet to ABM, you have to add an ABM token to Fleet. To add an ABM token: +Connect Fleet to your AB to allow automatic enrollment for company-owned and [Account-driven User Enrollment](https://fleetdm.com/guides/enroll-personal-byod-ios-ipad-hosts-with-managed-apple-account) for personal (BYOD) macOS, iOS, and iPadOS hosts. -1. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page. -2. Under **Automatic enrollment**, select **Add ABM**, and then follow the instructions in the modal to upload an ABM token to Fleet. +1. In Fleet, navigate to the **Settings > Integrations > MDM** page. +2. Under **Apple Business (AB)**, select **Add AB**. +3. Select **Download public key** to download a public key for AB. +4. Sign in to [Apple Business](https://business.apple.com). If your organization doesn't have an account, create one. +5. Select **Devices > Management** and select **Add** at the bottom of list. +7. Enter a name for the server such as "Fleet" and upload the public key downloaded in step 3 and select **Next**. +8. Download the service token and select **Done**. +9. In the **Default Device Assignment** section, assign the newly created server as the default for your Macs, iPhones, and iPads. Then select **Save**. +10. In Fleet, upload the service token (.p7m file) downloaded in step 8. -When one of your uploaded ABM tokens has expired or is within 30 days of expiring, you will see a warning banner at the top of page reminding you to renew your token. +macOS, iOS, and iPadOS hosts listed in AB and assigned to a Fleet will sync to Fleet and appear in the Hosts view with the **MDM status** label set to "Pending". -### To renew an ABM token: +When one of your uploaded AB tokens has expired or is within 30 days of expiring, you will see a warning banner at the top of page reminding you to renew your token. -1. Sign in to [Apple Business Manager](https://business.apple.com/) -2. Select your **account name** at the bottom left of the screen, then select **Preferences**. -3. In the **Your MDM Servers** section, select your Fleet server, then select **Download Token** at the top. -4. In Fleet, navigate to the **Settings > Integrations > Mobile device management (MDM)** page. -5. Under **Automatic enrollment**: - - Select **Edit**, and then find the token that you want to renew. - - Select the **Actions** dropdown for the token and then select **Renew**. -> **Note:** Token status is indicated in the **Renew date** column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. -6. Upload the downloaded token (.p7m file). - -### After connecting Fleet to ABM, set Fleet to be the MDM for all Macs: +### Renew AB: -1. Log in to [Apple Business Manager](https://business.apple.com) -2. Select your profile icon in the bottom left -3. Select **Preferences** -4. Select **MDM Server Assignment** and select **Edit** next to **Default Server Assignment**. -5. Switch **Mac**, **iPhone**, and **iPad** to Fleet. +> Token status is indicated in the **Renew date** column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. -macOS, iOS, and iPadOS hosts listed in ABM and associated to a Fleet instance with MDM enabled will sync to Fleet and appear in the Hosts view with the **MDM status** label set to "Pending". +1. Sign in to [Apple Business](https://business.apple.com/). +2. Select **Devices > Management** and select your MDM server. +3. Select the three dots and select **Download Token**. +4. In Fleet, navigate to the **Settings > Integrations > MDM** page. +5. Under **Apple Business (AB)** select **Edit** next to **Company-owned (ADE) and personal (BYOD) enrollment...**, and then find the token that you want to renew. +6. Select the **Actions > Renew** for the token. +7. Upload the token (.p7m file) downloaded in step 3. ### Hosts that automatically enroll will be assigned to a default fleet. You can configure the default fleet for macOS, iOS, and iPadOS hosts: 1. Create a fleet, if you have not already, following [this guide](https://fleetdm.com/guides/fleets). -2. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page and select **Edit** under **Automatic enrollment**. -3. Select the **Actions** dropdown for the ABM token you want to update, and then select **Edit fleets**. +2. Navigate to the **Settings > Integrations > MDM** page and select **Edit** under **Apple Business (AB)**. +3. Select the **Actions** dropdown for the AB token you want to update, and then select **Edit fleets**. 4. Select the default fleet for each platform, and select **Save** to save your selections. > If no default fleet is set for a host platform (macOS, iOS, or iPadOS), then newly enrolled hosts of that platform will be placed in "Unassigned". @@ -71,17 +83,17 @@ Fleet supports manually turning on MDM for macOS hosts that are already enrolled End users can turn on MDM from their **Fleet Desktop > My device** page. -### Host is in Apple Business Manager (ABM) +### Host is in Apple Business (AB) -#### If a macOS host is listed in ABM: +#### If a macOS host is listed in AB: 1. The end user will see a **Turn on MDM** banner at the top of their **My device** page. 2. Clicking **Turn on MDM** opens a modal with a step-by-step instruction on how to turn on MDM on their host. 3. After completing the steps, the host has MDM features turned on. -### Host isn't in ABM +### Host isn't in AB -#### If the host isn’t in ABM, users can still turn on MDM: +#### If the host isn’t in AB, users can still turn on MDM: 1. On the **My device** page, the end user sees the same **Turn on MDM** banner. 2. Clicking **Turn on MDM** opens a new tab. @@ -92,49 +104,57 @@ End users can turn on MDM from their **Fleet Desktop > My device** page. > Available in Fleet Premium -### Connect Fleet to VPP to deploy [Apple App Store apps](https://fleetdm.com/guides/install-app-store-apps) to your hosts: +Connect Fleet to VPP to deploy [Apple App Store apps](https://fleetdm.com/guides/install-app-store-apps) to your hosts. -1. In Fleet, select your avatar on the far right of the main navigation menu, and then **Settings > Integrations > Mobile device management (MDM)** -2. In the **Volume Purchasing Program (VPP)** section, select **Add VPP**, and then select **Add VPP** again on the following page. Follow the directions on the modal to get your VPP token from Apple Business Manager, and then select the **Upload** button at the bottom to upload it to Fleet. +1. In Fleet, select your avatar on the far right of the main navigation menu, and then **Settings > Integrations > MDM**. +2. Under **Apple Business (AB)**, select **Add VPP** next to **Volume Purchasing Program (VPP)**. +3. Sign in to [Apple Business](https://business.apple.com). If your organization doesn't have an account, select **Sign up now**. +4. Head to **Settings > Apps & Books** and download the content token for the location you want to use. Each token is based on a location in Apple Business. +5. Upload the content token (.vpptoken file) to Fleet. +6. To assign the VPP token to a specific fleet, find the token in the table of VPP tokens. Select the **Actions** dropdown, and then select **Edit fleets**. Use the picker to select which fleet(s) this VPP token should be assigned to. -3. To assign the VPP token to a specific fleet, find the token in the table of VPP tokens. Select the **Actions** dropdown, and then select **Edit fleets**. Use the picker to select which fleet(s) this VPP token should be assigned to. +### Renew VPP: -### To renew a VPP token: +> Token status is indicated in the **Renew date** column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. -1. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page -2. Under **Volume Purchasing Program (VPP)**, select **Edit** and then find the token that you want to renew. Token status is indicated in the **Renew date** column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Select the **Actions** dropdown for the token and then select **Renew**. Follow the instructions in the modal to download a new token from Apple Business Manager and then upload the new token to Fleet. +1. Navigate to the **Settings > Integrations > MDM** page +2. Under **Apple Business (AB)**, select **Edit** next to **Volume Purchasing Program (VPP)** and then find the token that you want to renew. +3. Select the **Actions > Renew** for the token. +4. Sign in to [Apple Business](https://business.apple.com). +5. Head to **Settings > Apps & Books** and download your content token. +6. Upload the content token (.vpptoken file) to Fleet. ## Best practice -Most organizations only need one ABM token and one VPP token to manage their macOS, iOS, and iPadOS hosts. +Most organizations only need one AB token and one VPP token to manage their macOS, iOS, and iPadOS hosts. -These organizations may need multiple ABM and VPP tokens: +These organizations may need multiple AB and VPP tokens: - Managed Service Providers (MSPs) - Enterprises that acquire new businesses and as a result inherit new hosts - Umbrella organizations that preside over entities with separated purchasing authority (i.e. a hospital or university) -For **MSPs**, the best practice is to have one ABM and VPP connection per client. +For **MSPs**, the best practice is to have one AB and VPP connection per client. -The default fleets for each client's ABM token will look like this: +The default fleets for each client's AB token will look like this: - macOS: 💻 Client A - Workstations - iOS: 📱🏢 Client A - Company-owned iPhones - iPadOS:🔳🏢 Client A - Company-owned iPads Client A's VPP token will be assigned to the above fleets. -For **enterprises that acquire**, the best practice is to add a new ABM and VPP connection for each acquisition. +For **enterprises that acquire**, the best practice is to add a new AB and VPP connection for each acquisition. These will be the default fleets: -Enterprise ABM token: +Enterprise AB token: - macOS: 💻 Enterprise - Workstations - iOS: 📱🏢 Enterprise - Company-owned iPhones - iPadOS:🔳🏢 Enterprise - Company-owned iPads The enterprises's VPP token will be assigned to the above fleets. -Acquisition ABM token: +Acquisition AB token: - macOS: 💻 Acquisition - Workstations - iOS: 📱🏢 Acquisition - Company-owned iPhones - iPadOS:🔳🏢 Acquisition - Company-owned iPads @@ -146,27 +166,9 @@ The acquisitions's VPP token will be assigned to the above fleets. Fleet uses SCEP certificates (1 year expiry) to authenticate the requests hosts make to Fleet. Fleet renews each host's SCEP certificates automatically every 180 days. -## Troubleshooting - -### Failed enrollments - -If a host is restarted/shut down during macOS Setup Assistant, it will fail to enroll to Fleet. Failed enrollments also happen if Fleet instance is down for an upgrade. When this happens, sometimes hosts automatically restart setup. If that doesn't happen, the best practice is to remotely [wipe the host](https://fleetdm.com/guides/lock-wipe-hosts#wipe-a-host) if the host is connected to Wi-Fi. If it's not, you'll need physical access to [reinstall macOS from Recovery](https://support.apple.com/en-us/102655). - -### Apple Business Manager (ABM) - -Fleet surfaces Apple Business Manager (ABM) automatic enrollment profile assignment by retrieving assignment errors and timestamps for each host. While Fleet does not actively monitor push events, admins can view assignment and push timestamps in host details. If a device shows an assignment time but no push time, admins can infer the push did not occur and may need to restart the device or run `sudo profiles renew -type enrollment` for remediation. Error details and timestamps are available for targeted troubleshooting. Customers may need to contact Apple support if an online host never has a push time. - -![Fleet-ABM-workflow](https://github.com/fleetdm/fleet/blob/main/website/assets/images/articles/abm-assignment-workflow.jpg) - -To view an ABM issue: +## Troubleshooting failed enrollments -1. If there is an active issue assigning a profile, a vital called **ABM issue** will be on the **Dashboard** page. This will take you to a filtered list of hosts with ABM issues. -2. Select a host to view host details where you can review the MDM status. Clicking on the MDM status will display a modal with the following information: - - **MDM status**: the host’s current state in Fleet’s MDM lifecycle. - - **Profile assignment**: timestamp of the last successful profile assignment reported by Apple Business Manager for this host. - - **Profile push**: timestamp of the last successful retrieval of the assigned profile by the host. If the profile wasn’t pushed, the host cannot activate MDM. - - **Profile status**: the most recent status reported by Apple for this host. - - **Profile assignment error** (if active error): a failure during DEP profile assignment or push. Includes error details for troubleshooting. +If a host is turned off due to user action or a low battery during the Setup Assistant, it may fail to enroll. This can also happen if your Fleet instance is down for maintenance when a host tries to enroll automatically during the Setup Assistant. In these cases, hosts usually restart after the user attempts to get past the “Welcome to Mac" screen. The best practice in this situation is to wipe the host with Fleet if it has network connectivity or to [reinstall macOS from Recovery](https://support.apple.com/en-us/102655). diff --git a/articles/apple-push-notification-service-apns-mdm.md b/articles/apple-push-notification-service-apns-mdm.md index 98cd6f0482a..677a3a30ed9 100644 --- a/articles/apple-push-notification-service-apns-mdm.md +++ b/articles/apple-push-notification-service-apns-mdm.md @@ -14,8 +14,8 @@ If you're managing Apple devices, APNs isn't optional. Most of what you do on-de The following MDM functions depend on APNs communication: -* Apps and Books management: Installations, updates, and removals from Apple Business Manager typically flow through the APNs-triggered check-in process. -* Automated Device Enrollment: After a new device activates and enrolls through Apple Business Manager, ongoing on-demand management depends on APNs. +* Apps and Books management: Installations, updates, and removals from Apple Business typically flow through the APNs-triggered check-in process. +* Automated Device Enrollment: After a new device activates and enrolls through Apple Business, ongoing on-demand management depends on APNs. * Configuration profiles: New security settings, VPN settings, and restrictions need an APNs notification to trigger the check-in that downloads them. * MDM commands: Lock, wipe, and restart actions only reach devices after APNs delivers the wake-up signal. If that path is blocked, these commands can sit in the queue with no visible error in your console. * OS updates: Pushing operating system updates to managed devices uses the same APNs channel to prompt check-ins. @@ -78,7 +78,7 @@ The certificate lifecycle and network requirements above apply regardless of whi Fleet handles APNs certificate configuration as part of its [MDM setup](https://fleetdm.com/guides/macos-mdm-setup) process, covering certificate generation, upload, and renewal tracking for macOS, iOS, and iPadOS devices. Fleet also encrypts APNs-related configuration values and outlines renewal procedures within its guides. -Fleet integrates with Apple Business Manager for Automated Device Enrollment and can support multiple Apple Business Manager tokens within a single Fleet instance for managed service providers and larger enterprises. +Fleet integrates with Apple Business for Automated Device Enrollment and can support multiple Apple Business tokens within a single Fleet instance for managed service providers and larger enterprises. Fleet has many options for migration from your current device management service. Fleet is fully compatible with Apple’s [Managed Device Migration](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web) features and has its own [end user enabled migration workflow](https://fleetdm.com/guides/mdm-migration#end-user-workflow) built in. Fleet also supports [MDM migration](https://fleetdm.com/guides/seamless-mdm-migration) workflows that can preserve APNs and SCEP certificates. Certificate-preserving migration is not the preferred migration option for most customers. In supported scenarios, migration involves copying certificates from the existing server and retaining the same ServerURL, CheckinURL, and PushTopic values so devices typically don't need to re-enroll. In practice, this process often involves database configuration changes and load balancer redirects. Fleet's Customer Success team must assist with certificate-preserving migrations that require database manipulation for both cloud and self-hosted instances. diff --git a/articles/automated-provisioning-for-Linux-desktop-in-the-enterprise.md b/articles/automated-provisioning-for-Linux-desktop-in-the-enterprise.md index 0686f4a55b1..87c60602eeb 100644 --- a/articles/automated-provisioning-for-Linux-desktop-in-the-enterprise.md +++ b/articles/automated-provisioning-for-Linux-desktop-in-the-enterprise.md @@ -57,7 +57,7 @@ Third, automated device provisioning establishes the connection between **end us ## Best practices for automated provisioning on Linux deployments -If your organization is purchasing computers directly from a large manufacturer like Dell or Lenovo, or from a 3rd party reseller like CDW or SHI, they all offer computers preinstalled with Linux. This is often the simplest and best way to start with enterprise Linux deployments. There is no MDM specification / protocol for Linux and there is no central registry for Linux computers like [Apple Business Manager (ABM)](https://support.apple.com/guide/apple-business-manager/sign-up-axm402206497/web) or [Microsoft Entra](https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra). +If your organization is purchasing computers directly from a large manufacturer like Dell or Lenovo, or from a 3rd party reseller like CDW or SHI, they all offer computers preinstalled with Linux. This is often the simplest and best way to start with enterprise Linux deployments. There is no MDM specification / protocol for Linux and there is no central registry for Linux computers like [Apple Business (AB)](https://support.apple.com/guide/apple-business-manager/sign-up-axm402206497/web) or [Microsoft Entra](https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra). Typically, orchestration approaches are used for managing Linux devices at scale. diff --git a/articles/automatic-software-install-in-fleet.md b/articles/automatic-software-install-in-fleet.md index ebf429321ca..e32c1886cc3 100644 --- a/articles/automatic-software-install-in-fleet.md +++ b/articles/automatic-software-install-in-fleet.md @@ -46,7 +46,7 @@ If the software install fails, you can reset a software automation and trigger t ![Flowchart](../website/assets/images/articles/automatic-software-install-workflow-674x189@2x.png) *Detailed flowchart* -App Store (VPP) apps won't be installed if a host has MDM turned off or if you run out of licenses (purchased in Apple Business Manager). Currently, these errors aren't surfaced in Fleet. After turning MDM on for a host or purchasing more licenses, you can retry [installing the app on the host's **Host details** page](https://fleetdm.com/guides/deploy-software-packages#install-the-package). To retry on multiple hosts at once, head to **Policies > Manage Automations** in Fleet and turn the app's policy automation off and back on. +App Store (VPP) apps won't be installed if a host has MDM turned off or if you run out of licenses (purchased in Apple Business). Currently, these errors aren't surfaced in Fleet. After turning MDM on for a host or purchasing more licenses, you can retry [installing the app on the host's **Host details** page](https://fleetdm.com/guides/deploy-software-packages#install-the-package). To retry on multiple hosts at once, head to **Policies > Manage Automations** in Fleet and turn the app's policy automation off and back on. Uninstalling VPP apps is [coming soon](https://github.com/fleetdm/fleet/issues/25497). diff --git a/articles/debunk-the-cross-platform-myth.md b/articles/debunk-the-cross-platform-myth.md index fee078a0c2f..17d99c2a76a 100644 --- a/articles/debunk-the-cross-platform-myth.md +++ b/articles/debunk-the-cross-platform-myth.md @@ -16,7 +16,7 @@ By working directly with native operating system features, Fleet ensures you don For example: * **Operating systems**: You can enforce OS updates with Declarative Device Management (DDM), Nudge, and Windows Update from one console. -* **Automated enrollment**: Drop-ship devices to your end users with Apple Business Manager or Autopilot and let them set up their own accounts. No IT help is needed. +* **Automated enrollment**: Drop-ship devices to your end users with Apple Business or Autopilot and let them set up their own accounts. No IT help is needed. * **Config management**: Manage settings with configuration profiles for Apple and device profiles for Windows. Use labels to test changes before they go live. * **App management**: Automatically keep applications and plugins secure and up-to-date. Install the software end users need or let them install it themselves via self-service. * **Scripts and events**: Easily manage and version control your custom script library. Execute shell and PowerShell scripts when computers drift from the baseline. diff --git a/articles/end-user-authentication.md b/articles/end-user-authentication.md index 155ccef37b2..5c9c181a31d 100644 --- a/articles/end-user-authentication.md +++ b/articles/end-user-authentication.md @@ -6,17 +6,17 @@ Fleet MDM server simplifies the macOS setup experience. With Fleet, organization ## Prerequisites -To use this flow, we must have Apple MDM enabled in Fleet and a macOS host ready to set up in [Apple Business Manager (ABM)](https://business.apple.com/) linked to our Fleet MDM server. +To use this flow, we must have Apple MDM enabled in Fleet and a macOS host ready to set up in [Apple Business (AB)](https://business.apple.com/) linked to our Fleet MDM server. -### What is Apple Business Manager? +### What is Apple Business? -Apple Business Manager (ABM) is a web-based portal that helps organizations deploy and manage Apple devices, including macOS computers, iPhones, and iPads. ABM provides a centralized platform for IT administrators to purchase hardware, assign devices to Mobile Device Management (MDM) servers, and distribute apps and content. +Apple Business (AB) is a web-based portal that helps organizations deploy and manage Apple devices, including macOS computers, iPhones, and iPads. ABM provides a centralized platform for IT administrators to purchase hardware, assign devices to Mobile Device Management (MDM) servers, and distribute apps and content. ![Mac mini in ABM](../website/assets/images/articles/end-user-authentication-mac-in-abm-1354x920@2x.png "Mac mini in ABM") ### Apple's ADE vs DEP -Apple's Device Enrollment Program (DEP) was the original, separate Apple service designed to register and configure devices automatically through an MDM solution. Subsequently, Apple rolled DEP into Automated Device Enrollment (ADE) as part of Apple Business Manager, combining DEP's automatic provisioning with other services in a streamlined portal. The terms ADE and DEP are often used interchangeably. +Apple's Device Enrollment Program (DEP) was the original, separate Apple service designed to register and configure devices automatically through an MDM solution. Subsequently, Apple rolled DEP into Automated Device Enrollment (ADE) as part of Apple Business, combining DEP's automatic provisioning with other services in a streamlined portal. The terms ADE and DEP are often used interchangeably. ## Setting up end-user authentication diff --git a/articles/enroll-hosts.md b/articles/enroll-hosts.md index 26e52e96a7b..97de063cc69 100644 --- a/articles/enroll-hosts.md +++ b/articles/enroll-hosts.md @@ -6,7 +6,7 @@ To manually enroll macOS, Windows, and Linux hosts, install Fleet’s agent (fle For iOS, iPadOS, and Android hosts, share the enrollment link from the [Fleet UI](#ui) with your end users. End users with Apple's [Stolen Device Protection](https://support.apple.com/en-us/120340) enabled may have to wait 1 hour before they can enroll, depending on their current location. -You can also automatically enroll macOS, Windows, iOS, and iPadOS hosts. To automatically enroll Apple (macOS, iOS, and iPadOS) hosts, [connect Fleet to Apple Business Manager (ABM)](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm). To automatically enroll Windows hosts, [connect Fleet to Microsoft Entra](https://fleetdm.com/guides/windows-mdm-setup#automatic-enrollment). +You can also automatically enroll macOS, Windows, iOS, and iPadOS hosts. To automatically enroll Apple (macOS, iOS, and iPadOS) hosts, [connect Fleet to Apple Business (AB)](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm). To automatically enroll Windows hosts, [connect Fleet to Microsoft Entra](https://fleetdm.com/guides/windows-mdm-setup#automatic-enrollment). To learn how to enroll Chromebooks, see the [Enroll Chromebooks guide](#enroll-chromebooks). diff --git a/articles/enroll-macbook-neo-at-scale-with-fleet-zero-touch.md b/articles/enroll-macbook-neo-at-scale-with-fleet-zero-touch.md index 98c9e9f4a76..03d63528bb3 100644 --- a/articles/enroll-macbook-neo-at-scale-with-fleet-zero-touch.md +++ b/articles/enroll-macbook-neo-at-scale-with-fleet-zero-touch.md @@ -2,7 +2,7 @@ Thinking about refreshing corporate laptops with the new low-cost MacBook Neo? You're not alone. Apple's $599 notebook has sparked a wave of enterprise interest, and IT teams are already planning large-scale rollouts. The question isn't whether to buy them. It's how to enroll hundreds or thousands of them without drowning in manual setup. -This article covers why MacBook Neo matters for enterprise Mac adoption, how Fleet's zero-touch enrollment works with Apple Business Manager, and what IT teams need to do to prepare for a large rollout. +This article covers why MacBook Neo matters for enterprise Mac adoption, how Fleet's zero-touch enrollment works with Apple Business, and what IT teams need to do to prepare for a large rollout. ## MacBook Neo and the enterprise Mac moment @@ -29,11 +29,11 @@ Zero-touch enrollment eliminates this bottleneck. Devices ship directly from App ## How Fleet zero-touch enrollment works -Fleet integrates with [Apple Business Manager (ABM)](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm) to support zero-touch enrollment through Apple's Automated Device Enrollment (ADE). Here's how the pieces fit together: +Fleet integrates with [Apple Business (AB)](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm) to support zero-touch enrollment through Apple's Automated Device Enrollment (ADE). Here's how the pieces fit together: -1. **Purchase devices through Apple or an authorized reseller.** When you buy MacBook Neos through an authorized channel and provide your ABM Organization ID, each device's serial number is automatically registered to your Apple Business Manager account. +1. **Purchase devices through Apple or an authorized reseller.** When you buy MacBook Neos through an authorized channel and provide your AB Organization ID, each device's serial number is automatically registered to your Apple Business account. -2. **Assign devices to Fleet in Apple Business Manager.** In the ABM portal, assign the registered serial numbers to your Fleet MDM server. This tells Apple's activation servers to direct those devices to Fleet when they first boot up. +2. **Assign devices to Fleet in Apple Business.** In the AB portal, assign the registered serial numbers to your Fleet MDM server. This tells Apple's activation servers to direct those devices to Fleet when they first boot up. 3. **Configure enrollment settings in Fleet.** Set up your [enrollment profile](https://fleetdm.com/guides/setup-experience), including which Setup Assistant screens to show or skip, whether to require end user authentication, and which team to assign the device to. Fleet also supports a [bootstrap package](https://fleetdm.com/guides/manage-boostrap-package-with-gitops) for installing essential software during first setup. @@ -48,10 +48,10 @@ This workflow scales the same way whether you're enrolling 10 devices or 10,000. Before placing a large MacBook Neo order, make sure your Fleet infrastructure is ready. Here's a practical checklist for IT teams planning a rollout: -### Verify Apple Business Manager setup +### Verify Apple Business setup -- Confirm your [ABM account](https://fleetdm.com/articles/what-is-apple-business-manager-a-complete-guide) is verified and active with a valid D-U-N-S number. -- Ensure your Fleet MDM server is added as a virtual MDM server in ABM. +- Confirm your [AB account](https://fleetdm.com/articles/what-is-apple-business-a-complete-guide) is verified and active with a valid D-U-N-S number. +- Ensure your Fleet MDM server is added as a virtual MDM server in AB. - Verify that your Apple Push Notification (APNs) certificate is current and won't expire during the rollout window. ### Configure enrollment profiles and policies @@ -62,7 +62,7 @@ Before placing a large MacBook Neo order, make sure your Fleet infrastructure is ### Use teams for department-level configuration -Fleet's [teams](https://fleetdm.com/guides/teams) let you segment devices by department, office, or role. Different teams can receive different configuration profiles, software packages, and policies. Assign your ABM devices to the appropriate Fleet team so each MacBook Neo gets the right setup for its intended user. +Fleet's [teams](https://fleetdm.com/guides/teams) let you segment devices by department, office, or role. Different teams can receive different configuration profiles, software packages, and policies. Assign your AB devices to the appropriate Fleet team so each MacBook Neo gets the right setup for its intended user. ### Stage software and bootstrap packages @@ -90,13 +90,13 @@ These capabilities apply across macOS, Windows, and Linux, so if you're adding M The MacBook Neo has changed the economics of enterprise Mac adoption. As Evans wrote, this device has sparked "the kind of curiosity you saw with the iMac and the iPad" among people who have never owned an Apple notebook. For IT teams, that interest translates into a real planning exercise: how do you take advantage of a $599 Mac without creating an operational headache? -Fleet's zero-touch enrollment, combined with Apple Business Manager, gives you a repeatable, scalable process for getting MacBook Neos into employees' hands fully configured and secured from first boot. No staging facility, no manual imaging, no configuration drift. +Fleet's zero-touch enrollment, combined with Apple Business, gives you a repeatable, scalable process for getting MacBook Neos into employees' hands fully configured and secured from first boot. No staging facility, no manual imaging, no configuration drift. -If you're evaluating a MacBook Neo rollout, [connect Fleet to Apple Business Manager](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm) and test the enrollment workflow before placing your order. You can also [try Fleet](https://fleetdm.com/register) to see the full MDM experience firsthand. +If you're evaluating a MacBook Neo rollout, [connect Fleet to Apple Business](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm) and test the enrollment workflow before placing your order. You can also [try Fleet](https://fleetdm.com/register) to see the full MDM experience firsthand. - + diff --git a/articles/enroll-personal-byod-ios-ipad-hosts-with-managed-apple-account.md b/articles/enroll-personal-byod-ios-ipad-hosts-with-managed-apple-account.md index 8b6bcf578c0..129380c4e16 100644 --- a/articles/enroll-personal-byod-ios-ipad-hosts-with-managed-apple-account.md +++ b/articles/enroll-personal-byod-ios-ipad-hosts-with-managed-apple-account.md @@ -8,32 +8,32 @@ In Fleet, you can allow your end users to enroll their personal iPhones and iPad With Account-driven User Enrollment, end users can separate work and personal data using their [Managed Apple Account](https://support.apple.com/en-gb/guide/apple-business-manager/axm78b477c81/web). End users retain privacy over their personal information, while IT admins manage work-related OS settings and applications. -- [Step 1: Connect Apple Business Manager (ABM) to Fleet](#step-1-connect-apple-business-manager-abm-to-fleet) -- [Step 2: Add and verify your domain in Apple Business Manager (ABM)](#step-2-add-and-verify-your-domain-in-apple-business-manager-abm) -- [Step 3: Connect (federate) your identity provider (IdP) with Apple Business Manager (ABM)](#step-3-connect-federate-your-identity-provider-idp-with-apple-business-manager-abm) +- [Step 1: Connect Apple Business (AB) to Fleet](#step-1-connect-apple-business-manager-abm-to-fleet) +- [Step 2: Add and verify your domain in Apple Business (AB)](#step-2-add-and-verify-your-domain-in-apple-business-manager-abm) +- [Step 3: Connect (federate) your identity provider (IdP) with Apple Business (AB)](#step-3-connect-federate-your-identity-provider-idp-with-apple-business-manager-abm) - [Step 4: Create a fleet for personal hosts](#step-4-create-a-fleet-for-personal-hosts) - [Step 5: Log in on the device to enroll to Fleet (end user's iPhone or iPad)](#step-5-log-in-on-the-device-to-enroll-to-fleet-end-users-iphone-or-ipad) -## Step 1: Connect Apple Business Manager (ABM) to Fleet +## Step 1: Connect Apple Business (AB) to Fleet -1. If you haven't already, follow the [Apple Business Manager (ABM) instructions](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm) to connect it to Fleet. +1. If you haven't already, follow the [Apple Business (AB) instructions](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm) to connect it to Fleet. -2. In ABM, go to **Preferences > Management Assignment** and make sure the **Default Assignment** for iPads and iPhones is set to Fleet. +2. In AB, go to **Devices > Management** and make sure the **Default Device Assignment** for iPads and iPhones is set to Fleet. -If you're testing Account-driven User Enrollment with Fleet, switch the **Default Assignment** when no iPads or iPhones are expected to enroll, then switch it back when you're done. +If you're testing Account-driven User Enrollment with Fleet, switch the **Default Device Assignment** when no iPads or iPhones are expected to enroll, then switch it back when you're done. To keep non–Account-driven enrollments on your current MDM while sending only Account-driven enrollments to Fleet, you can [self-host a service discovery file](#self-host-a-service-discovery-file-well-known-resource). -## Step 2: Add and verify your domain in Apple Business Manager (ABM) +## Step 2: Add and verify your domain in Apple Business (AB) -Follow the [Apple documentation](https://support.apple.com/en-gb/guide/apple-business-manager/axm48c3280c0/web#axm2033c47b0) to add and verify your company domain in your ABM. Use the domain name associated with your work email (for example, `yourcompany.com` from `name@yourcompany.com`). This will enable the automatic creation of Apple Managed Accounts from your identity provider (IdP) accounts in the next step. +Follow the [Apple documentation](https://support.apple.com/en-gb/guide/business/axm7909096bf/web) to add and verify your company domain in your AB. Use the domain name associated with your work email (for example, `yourcompany.com` from `name@yourcompany.com`). This will enable the automatic creation of Apple Managed Accounts from your identity provider (IdP) accounts in the next step. -## Step 3: Connect (federate) your identity provider (IdP) with Apple Business Manager (ABM) +## Step 3: Connect (federate) your identity provider (IdP) with Apple Business (AB) -Follow the [Apple documentation](https://support.apple.com/en-gb/guide/apple-business-manager/axmb19317543/web) to connect your identity provider (IdP). This will enable end users to log in to their Managed Apple Account using their existing IdP credentials. +Follow the [Apple documentation](https://support.apple.com/en-gb/guide/business/axm7909096bf/web) to connect your identity provider (IdP). This will enable end users to log in to their Managed Apple Account using their existing IdP credentials. -> For visual walk-throughs, see [Connect Google Workspace to ABM](https://www.youtube.com/watch?v=CPfO6W67d3A) and [Connect Microsoft Entra ID to ABM](https://www.youtube.com/watch?v=_-PnhMurAVk). +> For visual walk-throughs, see [Connect Google Workspace to AB](https://www.youtube.com/watch?v=CPfO6W67d3A) and [Connect Microsoft Entra ID to AB](https://www.youtube.com/watch?v=_-PnhMurAVk). These videos show the old Apple Business Manager interface. Updates [coming soon](https://github.com/fleetdm/fleet/issues/43626). ## Step 4: Create a fleet for personal hosts @@ -57,7 +57,7 @@ After signing in, the device will automatically enroll in Fleet. - If your iOS/iPadOS hosts are running version 18.2 or later, skip this step. Fleet manages service discovery automatically for these versions. - If your iOS/iPadOS hosts are running a version below 18.2, self-host a [service discovery JSON file](https://support.apple.com/en-gb/guide/deployment/dep4d9e9cd26/web#depcae01b5df). -> **Note:** If you're using another MDM in production, hosting this file sends only Account-driven User Enrollments to Fleet. Devices enrolled through ABM or an enrollment profile will continue to enroll in your current MDM. +> **Note:** If you're using another MDM in production, hosting this file sends only Account-driven User Enrollments to Fleet. Devices enrolled through AB or an enrollment profile will continue to enroll in your current MDM. Host the JSON file below at the following URL: `https:///.well-known/com.apple.remotemanagement.` diff --git a/articles/fleet-management-software.md b/articles/fleet-management-software.md index 52919b2db16..ce16be4f580 100644 --- a/articles/fleet-management-software.md +++ b/articles/fleet-management-software.md @@ -53,9 +53,9 @@ Fleet, Jamf, and Intune all handle core device management functions: enrollment, ### Enrollment and provisioning -All three solutions support zero-touch deployment for the platforms they support. Apple devices enroll through Apple Business Manager. In Fleet and Intune, Windows devices use Windows Autopilot. All three solutions can configure settings that prevent end users from tampering with management profiles. +All three solutions support zero-touch deployment for the platforms they support. Apple devices enroll through Apple Business. In Fleet and Intune, Windows devices use Windows Autopilot. All three solutions can configure settings that prevent end users from tampering with management profiles. -Jamf Pro's PreStage enrollment configures Apple device onboarding, including signed package deployment during setup. Intune's Autopilot configures Windows device onboarding with comparable automation. Intune also support Apple's Automated Device Enollemnt (ADE) via ABM. Fleet supports both Apple Business Manager and Windows Autopilot, providing consistent zero-touch enrollment across a mixed device fleet. +Jamf Pro's PreStage enrollment configures Apple device onboarding, including signed package deployment during setup. Intune's Autopilot configures Windows device onboarding with comparable automation. Intune also support Apple's Automated Device Enollemnt (ADE) via AB. Fleet supports both Apple Business and Windows Autopilot, providing consistent zero-touch enrollment across a mixed device fleet. ### Configuration management @@ -115,7 +115,7 @@ Fleet provides consistent multi-platform capabilities where Jamf Pro is Apple-fi #### How long does it take to roll out device management software? -Timelines depends on fleet size and configuration complexity. Fleet supports zero-touch enrollment through Apple Business Manager and Windows Autopilot for automated onboarding. Fleet also provides MDM migration workflows and professional services for organizations transitioning from other solutions. [Schedule a demo](https://fleetdm.com/contact) to discuss your rollout timeline. +Timelines depends on fleet size and configuration complexity. Fleet supports zero-touch enrollment through Apple Business and Windows Autopilot for automated onboarding. Fleet also provides MDM migration workflows and professional services for organizations transitioning from other solutions. [Schedule a demo](https://fleetdm.com/contact) to discuss your rollout timeline. diff --git a/articles/fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management.md b/articles/fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management.md index 25a89c1a486..2ae36f34f59 100644 --- a/articles/fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management.md +++ b/articles/fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management.md @@ -25,9 +25,9 @@ Fleet enables organizations to assign and install Apple App Store apps purchased By integrating VPP app distribution into the Fleet Desktop Self-Service portal, organizations can streamline the deployment of essential software across their macOS devices. This ensures that users have easy access to the tools they need while maintaining control over software distribution. This update enhances the overall user experience and operational efficiency, empowering end users to install approved applications with minimal IT intervention. -### Multiple Apple Business Manager and VPP support +### Multiple Apple Business and VPP support -Alongside initial Volume Purchase Program (VPP) support, now you can add and manage multiple Apple Business Manager (ABM) and VPP tokens within a single Fleet instance. This feature is designed for both Managed Service Providers (MSPs) and large enterprises. Whether an MSP or an enterprise with multiple divisions, admins can set up separate workflows to automatically enroll devices and distribute apps through the App Store. This update simplifies the process of handling macOS, iOS, and iPadOS devices, providing a scalable solution for both MSPs and enterprises looking to centralize control while maintaining flexibility for different user groups. +Alongside initial Volume Purchase Program (VPP) support, now you can add and manage multiple Apple Business (AB) and VPP tokens within a single Fleet instance. This feature is designed for both Managed Service Providers (MSPs) and large enterprises. Whether an MSP or an enterprise with multiple divisions, admins can set up separate workflows to automatically enroll devices and distribute apps through the App Store. This update simplifies the process of handling macOS, iOS, and iPadOS devices, providing a scalable solution for both MSPs and enterprises looking to centralize control while maintaining flexibility for different user groups. ![Add software modal](../website/assets/images/articles/fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management-1-2000x1000@2x.png "Add software modal.") *Add software modal.* diff --git a/articles/fleet-supports-macos-26-tahoe-ios-26-and-ipados-26.md b/articles/fleet-supports-macos-26-tahoe-ios-26-and-ipados-26.md index 2a5f531a675..e854a0fed62 100644 --- a/articles/fleet-supports-macos-26-tahoe-ios-26-and-ipados-26.md +++ b/articles/fleet-supports-macos-26-tahoe-ios-26-and-ipados-26.md @@ -7,13 +7,13 @@ _Photo by [MariuszBlach](https://www.istockphoto.com/photo/lake-tahoe-gm48064107 With Apple's releases of macOS Tahoe 26, iOS 26, and iPadOS 26, Fleet provides same-day support for IT teams to upgrade immediately so devices will remain secure and fully managed. This means that all existing Fleet features are tested and bugs are fixed. Also, Fleet will support these new features: -- MDM migration with Apple Business Manager (ABM) +- MDM migration with Apple Business (AB) - Declarative device management (DDM) OS updates and profiles - Platform Single Sign-on during new Mac setup (coming soon) All new features go through Fleet's [prioritization process](https://fleetdm.com/handbook/company/product-groups#how-feature-requests-are-prioritized). Excited about a new feature in macOS Tahoe? You can file a [feature request](https://github.com/fleetdm/fleet/issues/new?template=feature-request.md). -## MDM migration with Apple Business Manager (ABM) +## MDM migration with Apple Business (AB) With macOS Tahoe 26, iOS 26, and iPadOS 26, Apple introduces Device Management Migration: an improved workflow for migrating devices from one management service (MDM) to another. Learn more about configuring and the end user experience in the [Apple docs](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web). @@ -25,7 +25,7 @@ If you're planning a macOS migration with the Tahoe workflow: - Before the first batch, export a device list with each end user's name. - Group devices into batches in a spreadsheet so stakeholders can plan around travel or other conflicts. -> If the MDM migration fails, don’t reassign the host to your old MDM in Apple Business Manager (ABM). Reassigning makes the host ineligible for migration. The host must stay actively enrolled in the MDM it’s migrating from. Once you change the ABM assignment, ABM treats the host as no longer enrolled, and the migration can’t continue. +> If the MDM migration fails, don’t reassign the host to your old MDM in Apple Business (AB). Reassigning makes the host ineligible for migration. The host must stay actively enrolled in the MDM it’s migrating from. Once you change the ABM assignment, AB treats the host as no longer enrolled, and the migration can’t continue. ## Declarative device management (DDM) OS updates and profiles diff --git a/articles/fleet-vs-jamf-pro-ninjaone-mdm-comparison.md b/articles/fleet-vs-jamf-pro-ninjaone-mdm-comparison.md index edf5ce53f9d..1b5cd91d028 100644 --- a/articles/fleet-vs-jamf-pro-ninjaone-mdm-comparison.md +++ b/articles/fleet-vs-jamf-pro-ninjaone-mdm-comparison.md @@ -1,8 +1,8 @@ ## Overview -Fleet is an open-source, multi-platform device management solution supporting macOS, Windows, Linux, iOS, iPadOS, ChromeOS, and Android. Fleet provides zero-touch deployment through Apple Business Manager or Apple School Manager and Declarative Device Management (DDM), with native GitOps workflows for version-controlled configuration management. Fleet’s [osquery](https://fleetdm.com/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems) foundation delivers near real-time device reporting across all platforms. Organizations can self-host or be hosted in Fleet’s managed-cloud environment with [MDM migration](https://fleetdm.com/guides/mdm-migration) support for transitions from your management service. +Fleet is an open-source, multi-platform device management solution supporting macOS, Windows, Linux, iOS, iPadOS, ChromeOS, and Android. Fleet provides zero-touch deployment through Apple Business or Apple School Manager and Declarative Device Management (DDM), with native GitOps workflows for version-controlled configuration management. Fleet’s [osquery](https://fleetdm.com/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems) foundation delivers near real-time device reporting across all platforms. Organizations can self-host or be hosted in Fleet’s managed-cloud environment with [MDM migration](https://fleetdm.com/guides/mdm-migration) support for transitions from your management service. -Jamf Pro is an Apple-focused Mobile Device Management (MDM) solution supporting macOS, iOS, iPadOS, tvOS, visionOS, and watchOS devices, and it also supports Android. Jamf Pro provides zero-touch deployment through Apple Business Manager and Apple School Manager. Jamf Pro offers cloud-hosted deployment only, with on-premises support deprecated. Jamf Pro does not [support Windows](https://fleetdm.com/announcements/fleet-introduces-windows-mdm) or Linux devices natively, so organizations with mixed environments need additional management solutions. +Jamf Pro is an Apple-focused Mobile Device Management (MDM) solution supporting macOS, iOS, iPadOS, tvOS, visionOS, and watchOS devices, and it also supports Android. Jamf Pro provides zero-touch deployment through Apple Business and Apple School Manager. Jamf Pro offers cloud-hosted deployment only, with on-premises support deprecated. Jamf Pro does not [support Windows](https://fleetdm.com/announcements/fleet-introduces-windows-mdm) or Linux devices natively, so organizations with mixed environments need additional management solutions. NinjaOne is a cloud-native IT management solution combining remote monitoring and management (RMM) with MDM capabilities for Windows, macOS, Linux, iOS, iPadOS, and Android devices. NinjaOne provides cross-platform coverage and patch management through a unified console. Both Jamf Pro and NinjaOne are proprietary solutions, while Fleet is open-source. @@ -29,7 +29,7 @@ NinjaOne is a cloud-native IT management solution combining remote monitoring an ### Enrollment and provisioning -Fleet, Jamf Pro, and NinjaOne support zero-touch enrollment for Apple devices through Apple Business Manager. +Fleet, Jamf Pro, and NinjaOne support zero-touch enrollment for Apple devices through Apple Business. Fleet supports Windows enrollment via Windows Autopilot, and Windows Autopilot requires Microsoft Entra ID. Jamf Pro’s zero-touch enrollment capabilities focus on Apple platforms it supports (macOS, iOS/iPadOS, tvOS, visionOS, and watchOS). @@ -53,7 +53,7 @@ Software deployment and patching work differently across these three solutions. Fleet combines software deployment with built-in vulnerability detection, identifying CVEs across all platforms and enabling policy-based automatic remediation when vulnerable software is detected. Fleet enables App Store app installations and offers the Fleet-maintained app catalog for easy deployment. -Jamf Pro handles Apps and Books deployment for Apple devices through Apple Business Manager integration. Jamf Pro includes App Installers for easy deployment. +Jamf Pro handles Apps and Books deployment for Apple devices through Apple Business integration. Jamf Pro includes App Installers for easy deployment. NinjaOne includes OS patch management for Windows, macOS, and Linux, plus third-party application patching primarily for Windows, with deployment flowing through its agent. NinjaOne recently added 3rd party vulnerability visibility, but Fleet's approach integrates CVE detection with CISA KEV and EPSS scoring to help security teams prioritize what to patch first. @@ -95,11 +95,11 @@ Open-source tools like Fleet provide code that organizations can audit, modify, #### How do multi-platform MDM tools compare with Apple-only options for managing Apple devices? -Multi-platform tools like Fleet provide complete Apple device management capabilities at parity with Apple-focused tools, including zero-touch enrollment through Apple Business Manager, MDM Configuration Profiles, and Apps and Books (VPP) distribution. Organizations using multiple operating systems can consolidate tools rather than running separate solutions for each platform. Schedule a demo to see how [Fleet](https://fleetdm.com/device-management) manages Apple devices alongside Windows and Linux. +Multi-platform tools like Fleet provide complete Apple device management capabilities at parity with Apple-focused tools, including zero-touch enrollment through Apple Business, MDM Configuration Profiles, and Apps and Books (VPP) distribution. Organizations using multiple operating systems can consolidate tools rather than running separate solutions for each platform. Schedule a demo to see how [Fleet](https://fleetdm.com/device-management) manages Apple devices alongside Windows and Linux. #### Can I migrate from Jamf Pro to Fleet without disrupting device management? -Fleet supports gradual migration from Jamf Pro and other MDM solutions. You can run Fleet alongside your existing MDM during the transition, moving devices incrementally while maintaining management continuity. Fleet's Apple Business Manager integration has full compatibility with Apple’s Managed Device Migration and configuration profiles can be deployed through Fleet's GitOps workflows. Schedule a demo to discuss your Jamf migration timeline. +Fleet supports gradual migration from Jamf Pro and other MDM solutions. You can run Fleet alongside your existing MDM during the transition, moving devices incrementally while maintaining management continuity. Fleet's Apple Business integration has full compatibility with Apple’s Managed Device Migration and configuration profiles can be deployed through Fleet's GitOps workflows. Schedule a demo to discuss your Jamf migration timeline. #### How does Fleet's security visibility compare to Jamf Pro and NinjaOne? diff --git a/articles/gitops-mode-software.md b/articles/gitops-mode-software.md index 3e82ddec465..bc23450d828 100644 --- a/articles/gitops-mode-software.md +++ b/articles/gitops-mode-software.md @@ -21,7 +21,7 @@ If you want to use Fleet to host custom packages instead of a third-party packag ## App store apps -To manage Apple App Store (VPP) or Android Google Play apps via GitOps, please see the [`app_store_apps`](https://fleetdm.com/docs/configuration/yaml-files#app-store-apps) in Fleet's best practice GitOps docs. Note that VPP apps must first be added to [Apple Business Manager](https://business.apple.com). +To manage Apple App Store (VPP) or Android Google Play apps via GitOps, please see the [`app_store_apps`](https://fleetdm.com/docs/configuration/yaml-files#app-store-apps) in Fleet's best practice GitOps docs. Note that VPP apps must first be added to [Apple Business](https://business.apple.com). ## Fleet-maintained apps diff --git a/articles/how-to-manage-company-laptops-a-complete-guide.md b/articles/how-to-manage-company-laptops-a-complete-guide.md index dd2dab3a0d0..038ce3d9721 100644 --- a/articles/how-to-manage-company-laptops-a-complete-guide.md +++ b/articles/how-to-manage-company-laptops-a-complete-guide.md @@ -27,7 +27,7 @@ Secure onboarding starts before the device reaches the employee. The goal is zer ### Apple devices: Automated Device Enrollment -Apple Business Manager (ABM) links device serial numbers to an organization's MDM server. When a new Mac powers on, it contacts Apple's activation servers, identifies the assigned MDM, and enrolls automatically during Setup Assistant. Devices enrolled through Automated Device Enrollment (ADE) can be configured as supervised, which prevents users from removing the MDM profile and enables additional management capabilities. Once enrolled, configuration profiles, encryption settings, and applications can deploy automatically. +Apple Business (AB) links device serial numbers to an organization's MDM server. When a new Mac powers on, it contacts Apple's activation servers, identifies the assigned MDM, and enrolls automatically during Setup Assistant. Devices enrolled through Automated Device Enrollment (ADE) can be configured as supervised, which prevents users from removing the MDM profile and enables additional management capabilities. Once enrolled, configuration profiles, encryption settings, and applications can deploy automatically. A few details that often trip teams up: Apple Push Notification service (APNs) certificates need renewal before they expire or enrolled devices may stop receiving new commands, Setup Assistant flows should be tested on the same macOS version being shipped, and splitting profiles by function (security restrictions separate from VPN settings) reduces change risk. @@ -105,7 +105,7 @@ In practice, teams get fewer surprises when access removal is separated from dev * **Revoke identity access first:** Disable the user in your identity provider and enforce conditional access so the laptop can't reach corporate resources even if it stays online. * **Handle legal hold before wiping:** Decide whether data needs to be preserved for legal hold or investigation. A full wipe is final, so the wipe step should align with your HR and legal processes. -* **Reset for reassignment:** Prepare the laptop for reassignment. For Macs, this may involve a manual wipe-and-reenroll cycle, or the device can be reassigned through Apple Business Manager. +* **Reset for reassignment:** Prepare the laptop for reassignment. For Macs, this may involve a manual wipe-and-reenroll cycle, or the device can be reassigned through Apple Business. If device management integrates with the identity provider, offboarding becomes less dependent on someone remembering a checklist. For example, disabling a user account in Microsoft Entra ID or Okta can trigger conditional access policies that block the device from corporate resources. diff --git a/articles/install-app-store-apps.md b/articles/install-app-store-apps.md index f51694cff6d..49a9e7b4560 100644 --- a/articles/install-app-store-apps.md +++ b/articles/install-app-store-apps.md @@ -12,7 +12,7 @@ You can also manage which Google Play Store apps are available for self-service > Before using Fleet to manage VPP apps, you must first [turn on Apple MDM](https://fleetdm.com/guides/apple-mdm-setup#turn-on-apple-mdm) and Apple's [Volume Purchasing Program (VPP)](https://fleetdm.com/guides/apple-mdm-setup#volume-purchasing-program-vpp). Once you've completed that setup, you can follow the directions below for each app. -1. Purchase the relevant app through Apple Business Manager (ABM). You must perform this step even if the app is free, or if it is a custom app you own. Learn how in [Apple's documentation](https://support.apple.com/guide/apple-business-manager/select-and-buy-content-axmc21817890/web). +1. Purchase the relevant app through Apple Business (AB). You must perform this step even if the app is free, or if it is a custom app you own. Learn how in [Apple's documentation](https://support.apple.com/en-gb/guide/business/welcome/web). 2. In Fleet, head to the **Software** page and select a fleet in the fleets dropdown. diff --git a/articles/ipad-mdm-a-complete-guide.md b/articles/ipad-mdm-a-complete-guide.md index d732e5d80b4..958752296c4 100644 --- a/articles/ipad-mdm-a-complete-guide.md +++ b/articles/ipad-mdm-a-complete-guide.md @@ -53,7 +53,7 @@ This works across any internet connection assuming the MDM server is configured Organizations can choose from three enrollment methods that provide different management capabilities depending on device ownership: -- **Automated Device Enrollment (ADE)** through Apple Business Manager (ABM) or Apple School Manager (ASM) provides the most streamlined approach for devices purchased through Apple or authorized Apple reseller channels. Devices automatically contact Apple services and walk the end user through a guided Setup Assistant workflow and an automated provisioning process resulting in a fully-managed device on-demand without admin interaction or IT help. +- **Automated Device Enrollment (ADE)** through Apple Business (AB) or Apple School Manager (ASM) provides the most streamlined approach for devices purchased through Apple or authorized Apple reseller channels. Devices automatically contact Apple services and walk the end user through a guided Setup Assistant workflow and an automated provisioning process resulting in a fully-managed device on-demand without admin interaction or IT help. - **User Enrollment** creates separate management on the device for corporate apps, data and access to resources while maintaining strict privacy boundaries around personal data which can't be deleted via management. @@ -63,13 +63,13 @@ The enrollment method chosen determines the level of control an organization has ### Supervised vs. unsupervised capabilities -Supervision determine which MDM features are available on enrolled devices. Getting devices supervised requires either Automated Device Enrollment through Apple Business Manager or Apple School Manager during initial setup or using Apple Configurator with physical USB connectivity to each device. +Supervision determine which MDM features are available on enrolled devices. Getting devices supervised requires either Automated Device Enrollment through Apple Business or Apple School Manager during initial setup or using Apple Configurator with physical USB connectivity to each device. Two supervision levels serve different organizational needs: - **Supervision** - Organizations can unlock advanced capabilities that address enterprise requirements, like: - - De[ploying managed apps + - Deploying managed apps - Hiding specific Apple native applications from home screens - Making MDM management immutable so end users can't remove the MDM profile - Restricting data exfiltration paths like AirDrop and Sharing @@ -82,9 +82,9 @@ An institutionally-owned iPad deployed 1:1 for a single employee as a primary wo > Supervised devices can't be converted to unsupervised devices without erasing all data contained on them and re-enrolling them into MDM. -### Apple Business Manager and Apple School Manager integration +### Apple Business and Apple School Manager integration -ABM and ASM integration allows your organization to easily grow your iPad deployments to enterprise scale. ABM / ASM administrators can assign devices to one or many MDM servers in the portal. In addition, most MDM solutions allow for multiple enrollment groupings, meaning enrollment can be customized for potentially unique deployments like special-use iPads if needed. +AB and ASM integration allows your organization to easily grow your iPad deployments to enterprise scale. AB / ASM administrators can assign devices to one or many MDM servers in the portal. In addition, most MDM solutions allow for multiple enrollment groupings, meaning enrollment can be customized for potentially unique deployments like special-use iPads if needed. When users power on a new iPad, the device contacts an Apple service configured to recognize and handoff managed devices to specific MDM servers. This ensures that devices belonging to your organization are assigned the correct enrollment profile. Once enrollment is complete, all management configurations are delivered. Fully remote, "touchless" iPad deployments which make use of Apple's "Return To Service" MDM features are also possible. @@ -162,7 +162,7 @@ Beyond iPad, top-level considerations when choosing an MDM include: ### iPad-specific MDM capabilities -iPad-specific MDM capabilities deserve verification during MDM vendor evaluation. Shared iPad support is essential for multi-user scenarios, while kiosk mode and Single App Mode are requirements for retail deployments and digital signage installations and more. Classroom management features for education including screen monitoring and app restrictions require explicit MDM support, and ABM / ASM along with Apps and Books content integration determines whether you can implement zero-touch enrollment or manage app and content licensing at scale. +iPad-specific MDM capabilities deserve verification during MDM vendor evaluation. Shared iPad support is essential for multi-user scenarios, while kiosk mode and Single App Mode are requirements for retail deployments and digital signage installations and more. Classroom management features for education including screen monitoring and app restrictions require explicit MDM support, and AB / ASM along with Apps and Books content integration determines whether you can implement zero-touch enrollment or manage app and content licensing at scale. ### Ease of use and operational fit diff --git a/articles/lock-wipe-hosts.md b/articles/lock-wipe-hosts.md index c1aabf544ce..e6bd2f89968 100644 --- a/articles/lock-wipe-hosts.md +++ b/articles/lock-wipe-hosts.md @@ -53,7 +53,7 @@ Example URL: When wiping and re-installing the operating system (OS) on a host, delete the host from Fleet before you re-enroll it. If you re-enroll without deleting, Fleet won't escrow a new disk encryption key. -If you're gifting a company-owned macOS host or you want to prevent the host from automatically re-enrolling to Fleet for some other reason, first release the host from Apple Business Manager (ABM) and then delete the host in Fleet. +If you're gifting a company-owned macOS host or you want to prevent the host from automatically re-enrolling to Fleet for some other reason, first release the host from Apple Business (AB) and then delete the host in Fleet. For Windows hosts, Fleet uses the [doWipeProtected](https://learn.microsoft.com/en-us/windows/client-management/mdm/remotewipe-csp#dowipeprotected) command by default. According to Microsoft, this leaves the host [unable to boot](https://learn.microsoft.com/en-us/windows/client-management/mdm/remotewipe-csp#:~:text=In%20some%20device%20configurations%2C%20this%20command%20may%20leave%20the%20device%20unable%20to%20boot.). However, it is possible to use the [doWipe command via the API](https://fleetdm.com/docs/rest-api/rest-api#parameters57). diff --git a/articles/mac-device-security.md b/articles/mac-device-security.md index 09e00205f31..90af8685464 100644 --- a/articles/mac-device-security.md +++ b/articles/mac-device-security.md @@ -87,7 +87,7 @@ For organizations managing mixed fleets, unified MDM visibility across Mac, Wind When selecting an MDM, verify these capabilities across all operating systems you manage: -* Zero-touch enrollment through Apple Business Manager +* Zero-touch enrollment through Apple Business * Configuration profile deployment and verification * Software deployment and patch management * Compliance monitoring aligned with NIST mSCP baselines diff --git a/articles/mac-inventory-management.md b/articles/mac-inventory-management.md index f10ff710611..ec261741e1a 100644 --- a/articles/mac-inventory-management.md +++ b/articles/mac-inventory-management.md @@ -38,11 +38,11 @@ Apple's Mobile Device Management framework provides the technical foundation for ### Enrollment and initial registration -Devices enroll through Apple Business Manager for zero-touch deployment or through user-initiated enrollment for existing Macs and BYOD scenarios. During enrollment, devices install the management profile and use APNs to receive MDM notifications, then contact the MDM server to exchange commands and inventory data. +Devices enroll through Apple Business for zero-touch deployment or through user-initiated enrollment for existing Macs and BYOD scenarios. During enrollment, devices install the management profile and use APNs to receive MDM notifications, then contact the MDM server to exchange commands and inventory data. The enrollment process captures initial device identifiers including UDID, serial number, and hardware model, forming the baseline device record that organizations typically reconcile into their HAM system. -Organizations using Apple Business Manager can assign devices by serial number through Automated Device Enrollment (ADE) before they ship, enabling automatic MDM enrollment when users power them on for the first time. This architecture removes the need to physically handle devices for inventory registration in most cases, supporting remote workforce scenarios where Macs ship directly to employee homes. +Organizations using Apple Business can assign devices by serial number through Automated Device Enrollment (ADE) before they ship, enabling automatic MDM enrollment when users power them on for the first time. This architecture removes the need to physically handle devices for inventory registration in most cases, supporting remote workforce scenarios where Macs ship directly to employee homes. ### Continuous data collection through MDM queries @@ -66,7 +66,7 @@ Scaling Mac inventory management across hundreds or thousands of devices require ### 1. Implement zero-touch deployment workflows -Integrate Apple Business Manager with your MDM tool to enable automatic device enrollment. Assign new Macs to your MDM server at the point of purchase, configure Automated Device Enrollment so devices are managed from first boot (and, if desired, the MDM enrollment profile can be non-removable), and integrate with your identity provider for user authentication during enrollment. +Integrate Apple Business with your MDM tool to enable automatic device enrollment. Assign new Macs to your MDM server at the point of purchase, configure Automated Device Enrollment so devices are managed from first boot (and, if desired, the MDM enrollment profile can be non-removable), and integrate with your identity provider for user authentication during enrollment. Tools like Fleet support [zero-touch provisioning through ABM](https://fleetdm.com/docs/using-fleet/mdm-macos-setup), allowing organizations to define enrollment settings, team assignments, and configuration profiles that apply automatically when devices first connect. @@ -106,7 +106,7 @@ This approach supports unified reporting and compliance dashboards while preserv ## Manage your Mac fleet effectively -Mac inventory management works best when you treat device management systems as rich data sources and keep a dedicated Hardware Asset Management (HAM) system as your authoritative system of record. Effective implementation means deploying zero-touch workflows through Apple Business Manager, building data schemas that respect BYOD boundaries, integrating with identity providers, and ensuring the right device data flows into your HAM tool for procurement, assignment, and lifecycle workflows. +Mac inventory management works best when you treat device management systems as rich data sources and keep a dedicated Hardware Asset Management (HAM) system as your authoritative system of record. Effective implementation means deploying zero-touch workflows through Apple Business, building data schemas that respect BYOD boundaries, integrating with identity providers, and ensuring the right device data flows into your HAM tool for procurement, assignment, and lifecycle workflows. Fleet provides an open-source tool that [combines MDM with osquery](https://fleetdm.com/device-management) for macOS, Windows, and Linux. Fleet is not a hardware asset management system, but it can act as a device management and data collection/orchestration layer that captures richer device data more frequently than many device management tools, making it valuable for populating and keeping HAM records current. @@ -128,7 +128,7 @@ The best approach involves implementing check-in requirements where devices must ### Can I use the same inventory collection approach across Mac, Windows, and Linux, or do I need platform-specific tools? -Cross-platform inventory tools exist, but macOS requires platform-specific support due to Apple-specific frameworks, management workflows that depend on the MDM protocol, and Apple Business Manager enrollment patterns. +Cross-platform inventory tools exist, but macOS requires platform-specific support due to Apple-specific frameworks, management workflows that depend on the MDM protocol, and Apple Business enrollment patterns. The most effective approach uses tools with strong native Mac support rather than Windows-centric platforms extended to macOS as an afterthought. Define common inventory fields applicable across all platforms (device name, OS version, assigned user) while maintaining platform-specific extensions for Mac attributes like FileVault status, Apple silicon architecture details, and System Integrity Protection configuration state. @@ -136,7 +136,7 @@ The most effective approach uses tools with strong native Mac support rather tha Look for device management and data collection tooling that can reliably collect the fields your HAM system needs: stable identifiers (serial number, hardware UUID), enrollment metadata, assignment/user mapping, and lifecycle status signals (last check-in, OS version eligibility, encryption state). In addition, ensure you can export or integrate that device data into your HAM system. -Fleet combines Apple's MDM framework with osquery to collect Mac device data across hardware specifications, software versions, and security configurations. Fleet supports zero-touch deployment through Apple Business Manager integration, enabling automatic enrollment and policy enforcement for new devices, and it can provide high-fidelity data that you can use to populate and maintain your hardware asset records in a dedicated HAM solution. +Fleet combines Apple's MDM framework with osquery to collect Mac device data across hardware specifications, software versions, and security configurations. Fleet supports zero-touch deployment through Apple Business integration, enabling automatic enrollment and policy enforcement for new devices, and it can provide high-fidelity data that you can use to populate and maintain your hardware asset records in a dedicated HAM solution. [Try Fleet](https://fleetdm.com/get-started) to evaluate it as a device management and data collection layer for your Mac inventory workflows. diff --git a/articles/mac-zero-touch-deployment-guide.md b/articles/mac-zero-touch-deployment-guide.md index 404da4b6ef2..db54348703a 100644 --- a/articles/mac-zero-touch-deployment-guide.md +++ b/articles/mac-zero-touch-deployment-guide.md @@ -6,7 +6,7 @@ Shipping Mac devices to remote employees typically means either extensive IT han Zero-touch deployment lets organizations ship Macs directly from vendors to end users without IT intervention. When a user opens their box and powers on their new Mac it walks them though a setup assistant, automatically queries Apple's servers, receives its MDM assignment, enrolls itself, and applies the organization's security policies and configuration profiles. -The workflow is enabled by Apple's Automated Device Enrollment (formerly DEP), which links a device's serial number to an MDM server through Apple Business Manager (ABM). When powered on, devices query Apple's activation servers to determine their assigned MDM service and automatically enroll. For macOS 14 and later, if devices don't enroll during first setup, they display a full-screen setup experience that enforces enrollment, preventing users from bypassing organizational control. +The workflow is enabled by Apple's Automated Device Enrollment (formerly DEP), which links a device's serial number to an MDM server through Apple Business (AB). When powered on, devices query Apple's activation servers to determine their assigned MDM service and automatically enroll. For macOS 14 and later, if devices don't enroll during first setup, they display a full-screen setup experience that enforces enrollment, preventing users from bypassing organizational control. This automation eliminates the traditional imaging workflow where IT teams receive shipments, unbox devices, connect them to imaging stations, install base configurations, and then ship them to users. Instead, devices go directly from the vendor to employees, arriving ready for automated configuration and immediate use. @@ -26,13 +26,13 @@ These provisioning, security, and efficiency improvements compound when managing ## How zero-touch deployment works -Mac zero-touch deployment operates through a three-tier architecture: Apple Business Manager as the enrollment authority, the MDM server as the policy distributor, and the Mac itself as an active participant in provisioning. +Mac zero-touch deployment operates through a three-tier architecture: Apple Business as the enrollment authority, the MDM server as the policy distributor, and the Mac itself as an active participant in provisioning. ### Device registration and assignment -Devices must be purchased from Apple or participating Apple Authorized Resellers to be automatically registered in Apple Business Manager. The vendor registers devices to your organization's Apple Business Manager account during purchase, linking each serial number to that organization. +Devices must be purchased from Apple or participating Apple Authorized Resellers to be automatically registered in Apple Business. The vendor registers devices to your organization's Apple Business account during purchase, linking each serial number to that organization. -After devices appear in Apple Business Manager, you assign them to the MDM server through the ABM web portal. This assignment links serial numbers with the MDM instance through a "virtual MDM server" configuration, establishing the trust relationship for automatic enrollment. +After devices appear in Apple Business, you assign them to the MDM server through the ABM web portal. This assignment links serial numbers with the MDM instance through a "virtual MDM server" configuration, establishing the trust relationship for automatic enrollment. ## Prerequisites and setup considerations @@ -40,9 +40,9 @@ Successfully implementing zero-touch deployment depends on having the right infr ### Required infrastructure -You need an Apple Business Manager account with organizational verification. Your organization must complete Apple's verification process before devices can enroll through ADE. This process requires a valid D-U-N-S number (an organization's business tax identification) and verification of organizational details by Apple representatives. Verification is separate from ABM account creation and typically takes 24-48 hours to complete. Missing this step is a common cause of ADE enrollment failures, as devices won't appear in your ABM account until verification is approved. +You need an Apple Business account with organizational verification. Your organization must complete Apple's verification process before devices can enroll through ADE. This process requires a valid D-U-N-S number (an organization's business tax identification) and verification of organizational details by Apple representatives. Verification is separate from ABM account creation and typically takes 24-48 hours to complete. Missing this step is a common cause of ADE enrollment failures, as devices won't appear in your ABM account until verification is approved. -Your MDM server must be added to Apple Business Manager as a virtual MDM server, establishing the trust relationship for device assignments. Your MDM tool must support Automated Device Enrollment with mandatory, non-removable enrollment profiles and the Auto Advance key for Setup Assistant customization. +Your MDM server must be added to Apple Business as a virtual MDM server, establishing the trust relationship for device assignments. Your MDM tool must support Automated Device Enrollment with mandatory, non-removable enrollment profiles and the Auto Advance key for Setup Assistant customization. Network connectivity requires internet access to contact Apple's activation servers and MDM endpoints during first boot. Fully automated deployment without any user interaction requires Ethernet connectivity during Auto Advance. Wi-Fi-only deployments typically require users to select the network during Setup Assistant, though Wi-Fi profiles can be pre-configured in enrollment settings. @@ -66,9 +66,9 @@ Apple announced that macOS 26 will expand DDM capabilities to include package de Platform SSO allows identity-first provisioning where authentication happens during enrollment rather than after. Platform SSO can now be activated during automated device enrollment, allowing employees to immediately access managed apps and company services without additional sign-ins. This addresses a common friction point where users complete device enrollment but then face repeated authentication prompts when accessing corporate resources. -### Apple Business Manager API capabilities +### Apple Business API capabilities -Apple Business Manager has received significant API enhancements that allow programmatic device management. New endpoints let administrators retrieve device management service information, list all devices assigned to a specific MDM server, and programmatically assign or unassign devices from management services. +Apple Business has received significant API enhancements that allow programmatic device management. New endpoints let administrators retrieve device management service information, list all devices assigned to a specific MDM server, and programmatically assign or unassign devices from management services. These new APIs support infrastructure-as-code patterns where device assignments and MDM configurations are version-controlled and deployed through automated pipelines, aligning with emerging GitOps-based management approaches for enterprise Mac fleet management. @@ -84,7 +84,7 @@ Autopilot depends on specific features available in Windows client, cloud identi | Platform | Zero-Touch Approach | Key Requirements | Enrollment Method | | ----- | ----- | ----- | ----- | -| macOS | Automated Device Enrollment (ADE) | Apple Business Manager, participating vendors | Cloud-based automatic enrollment via Setup Assistant | +| macOS | Automated Device Enrollment (ADE) | Apple Business, participating vendors | Cloud-based automatic enrollment via Setup Assistant | | Windows | Windows Autopilot | Cloud identity services, Windows MDM, participating OEMs | Cloud-based device registration and provisioning | | Linux | Custom automation | Configuration management tools, IT infrastructure | No standardized vendor-provided protocol | @@ -92,7 +92,7 @@ While Linux supports automated provisioning through tools like cloud-init, Ansib ### Post-enrollment management convergence -Though each operating system platform requires separate enrollment infrastructure (Apple Business Manager for macOS, Windows Autopilot for Windows, and custom automation for Linux) modern MDM solutions can provide unified management after enrollment completes. Administrators can configure management once and deploy across platforms, with MDM translating intent into platform-specific implementations. +Though each operating system platform requires separate enrollment infrastructure (Apple Business for macOS, Windows Autopilot for Windows, and custom automation for Linux) modern MDM solutions can provide unified management after enrollment completes. Administrators can configure management once and deploy across platforms, with MDM translating intent into platform-specific implementations. With single-platform device management solutions, IT teams must architect separate enrollment strategies per platform while seeking unified visibility and control post-enrollment. A practical approach involves accepting platform-specific enrollment workflows while standardizing on security baselines and compliance monitoring that work across operating systems. @@ -108,17 +108,17 @@ With Fleet GitOps, organizations define configuration through YAML files that sp Implementing zero-touch deployment gives your team consistent device provisioning while reducing manual workload. The right tool makes the difference between automation that works and automation that creates new problems. This is where Fleet comes in. -Fleet integrates with Apple Business Manager for automated device enrollment and provides the multi-platform visibility you need when managing mixed Mac, Windows, and Linux fleets. [Schedule a demo](https://fleetdm.com/contact) to see how Fleet simplifies Mac fleet management. +Fleet integrates with Apple Business for automated device enrollment and provides the multi-platform visibility you need when managing mixed Mac, Windows, and Linux fleets. [Schedule a demo](https://fleetdm.com/contact) to see how Fleet simplifies Mac fleet management. ## Frequently asked questions -### Can we implement zero-touch deployment without Apple Business Manager? +### Can we implement zero-touch deployment without Apple Business? -Automated Device Enrollment requires devices registered in Apple Business Manager or Apple School Manager, which is only possible when purchased from Apple or participating Apple Authorized Resellers. Alternative methods like user-initiated enrollment or Apple Configurator require manual steps and don't provide the same capabilities. Devices acquired through unauthorized channels can't use Automated Device Enrollment. +Automated Device Enrollment requires devices registered in Apple Business or Apple School Manager, which is only possible when purchased from Apple or participating Apple Authorized Resellers. Alternative methods like user-initiated enrollment or Apple Configurator require manual steps and don't provide the same capabilities. Devices acquired through unauthorized channels can't use Automated Device Enrollment. ### What happens if a device fails to enroll during first boot? -Common failure causes include network connectivity issues, MDM server configuration errors, or device assignment problems. Troubleshooting involves checking MDM synchronization status, verifying device assignment in Apple Business Manager, and ensuring access to Apple's activation servers and MDM endpoints. +Common failure causes include network connectivity issues, MDM server configuration errors, or device assignment problems. Troubleshooting involves checking MDM synchronization status, verifying device assignment in Apple Business, and ensuring access to Apple's activation servers and MDM endpoints. ### How does zero-touch deployment affect device security and compliance? @@ -133,5 +133,5 @@ Yes. Replacement devices enroll automatically through the same workflow as new d - + diff --git a/articles/managing-macs-globally-apple-ecosystem-deployment-security.md b/articles/managing-macs-globally-apple-ecosystem-deployment-security.md index f412c9b9c3a..66ff677bd1f 100644 --- a/articles/managing-macs-globally-apple-ecosystem-deployment-security.md +++ b/articles/managing-macs-globally-apple-ecosystem-deployment-security.md @@ -4,7 +4,7 @@ This guide covers why global Mac management requires specialized approaches and ## What is Apple ecosystem management for global deployments? -Apple's deployment ecosystem operates differently than Windows. Where Windows relies on Active Directory and Group Policy for configuration, Mac management integrates Apple Business Manager for device registration, the Push Notification service for device management communication, configuration profiles for device and user settings, and the MDM (Mobile Device Management) protocol for remote administration. These components work together through Apple's cloud infrastructure. +Apple's deployment ecosystem operates differently than Windows. Where Windows relies on Active Directory and Group Policy for configuration, Mac management integrates Apple Business for device registration, the Push Notification service for device management communication, configuration profiles for device and user settings, and the MDM (Mobile Device Management) protocol for remote administration. These components work together through Apple's cloud infrastructure. When you're managing hundreds to thousands of Mac devices across geographic regions, this architecture requires specific capabilities like automated enrollment systems that provision devices without physical access, federated identity management that connects devices to organizational accounts, standardized configuration deployment that maintains consistency, and continuous compliance monitoring that catches drift before audits. @@ -18,7 +18,7 @@ Organizations managing Mac devices across enterprise environments face several c * **Supporting employee choice and productivity:** Knowledge workers increasingly expect macOS as an option for development, design, and productivity workflows. * **Meeting security and compliance requirements:** Operating across multiple regions means facing overlapping regulatory requirements including GDPR, HIPAA, PCI-DSS, and jurisdiction-specific data residency rules. -* **Reducing management costs:** Zero-touch deployment through Apple Business Manager and Automated Device Enrollment can significantly reduce hands-on provisioning time. +* **Reducing management costs:** Zero-touch deployment through Apple Business and Automated Device Enrollment can significantly reduce hands-on provisioning time. * **Enabling distributed and remote workforces:** Devices ship directly to employee homes across multiple countries and may never connect to corporate network infrastructure. These capabilities work together through Apple's ecosystem rather than traditional Windows-based infrastructure, requiring specialized solutions that understand both Apple's architecture and enterprise requirements. @@ -27,21 +27,21 @@ These capabilities work together through Apple's ecosystem rather than tradition Enterprise Mac management operates through several interconnected technical components that work together to provide control across your global device fleet. -### Apple Business Manager +### Apple Business -Apple Business Manager (ABM) serves as the device registry to prove institutional ownership for automated enrollment and app distribution in enterprise deployments. When you purchase Mac devices through Apple or authorized resellers who participate in the Device Enrollment Program, device serial numbers automatically register to your organizational Apple Business Manager account. +Apple Business (AB) serves as the device registry to prove institutional ownership for automated enrollment and app distribution in enterprise deployments. When you purchase Mac devices through Apple or authorized resellers who participate in the Device Enrollment Program, device serial numbers automatically register to your organizational Apple Business account. -You assign devices in Apple Business Manager to specific MDM servers. This assignment tells Apple's activation servers which MDM server should manage each device. The system supports multiple tokens for organizations with different business units or for managed service providers supporting multiple clients. +You assign devices in Apple Business to specific MDM servers. This assignment tells Apple's activation servers which MDM server should manage each device. The system supports multiple tokens for organizations with different business units or for managed service providers supporting multiple clients. The practical usability of multiple tokens depends on your device management solution. Some solutions support multiple tokens but with interface limitations. Verify your device management solution vendor's multi-token capabilities before planning segmentation around multiple tokens. ### Automated Device Enrollment (ADE) -Automated Device Enrollment provisions devices globally without your IT team physically touching them. When a user powers on a device for the first time, it contacts Apple's activation servers during Setup Assistant, which recognize the device serial number, confirm its Apple Business Manager registration, and automatically downloads the assigned enrollment profile. +Automated Device Enrollment provisions devices globally without your IT team physically touching them. When a user powers on a device for the first time, it contacts Apple's activation servers during Setup Assistant, which recognize the device serial number, confirm its Apple Business registration, and automatically downloads the assigned enrollment profile. This wireless enrollment process means you can drop-ship devices directly to users anywhere in the world, with devices arriving at the desktop fully configured with required security settings and applications. -Supervision mode provides the highest level of management capabilities for ADE-enrolled devices. Unlike manually enrolled devices where users can remove MDM profiles, ADE-enrolled supervised Macs can enforce mandatory, immutable enrollment that persists across OS reinstallations because the device remains registered in Apple Business Manager. +Supervision mode provides the highest level of management capabilities for ADE-enrolled devices. Unlike manually enrolled devices where users can remove MDM profiles, ADE-enrolled supervised Macs can enforce mandatory, immutable enrollment that persists across OS reinstallations because the device remains registered in Apple Business. Your security policies remain enforced even if a user attempts to wipe and reinstall macOS. (Note: Manually supervised devices via Apple Configurator typically do not retain supervision after factory reset, though behavior can vary by workflow and macOS version.) @@ -69,7 +69,7 @@ Beyond the foundational Apple technologies, several operational components work ### Zero-touch deployment workflows -Zero-touch deployment represents the complete process from device purchase to productive end user without IT physically touching equipment. The workflow starts when you purchase devices through Apple Business Manager from participating suppliers, who automatically register serial numbers to your organization. You assign devices to users, and when users power on the device for the first time, it contacts Apple's activation servers and automatically downloads the enrollment profile, establishing supervised mode wirelessly. +Zero-touch deployment represents the complete process from device purchase to productive end user without IT physically touching equipment. The workflow starts when you purchase devices through Apple Business from participating suppliers, who automatically register serial numbers to your organization. You assign devices to users, and when users power on the device for the first time, it contacts Apple's activation servers and automatically downloads the enrollment profile, establishing supervised mode wirelessly. Enrollment can trigger app installation, scripts, and configurations that install during Setup Assistant, before the user sees the desktop. Users receive fully configured devices ready for work without IT intervention. This capability matters when you're deploying devices at scale to employees in regions without local IT support. @@ -81,7 +81,7 @@ Platform SSO on macOS Sequoia and later typically uses Secure Enclave-backed aut ### Software distribution and updates -Managing application installation and updates across global Mac fleets works better when using automated workflows that don't depend on users visiting App Store manually. Your MDM solution should manage application distribution through volume purchasing and automatic deployment. Apple Business Manager includes Apps and Books, which lets you purchase app licenses in bulk and assign them to device serial numbers rather than individual user accounts. +Managing application installation and updates across global Mac fleets works better when using automated workflows that don't depend on users visiting App Store manually. Your MDM solution should manage application distribution through volume purchasing and automatic deployment. Apple Business includes Apps and Books, which lets you purchase app licenses in bulk and assign them to device serial numbers rather than individual user accounts. Declarative Device Management provides automatic software update controls that install macOS updates during user-defined time windows. Devices check for updates independently, download them when network connectivity permits, and install them according to policies rather than waiting for MDM commands. This asynchronous behavior works better than traditional command-based updates for globally distributed fleets. @@ -127,15 +127,15 @@ What distinguishes multi-platform device management with osquery integration is ## Scaling Mac management with confidence -Managing Mac fleets across global regions requires architecture that handles Apple Business Manager enrollment, Declarative Device Management, and configuration verification beyond simple MDM command acknowledgment. Organizations need solutions that integrate with Apple's cloud infrastructure while supporting Windows and Linux devices from the same console. +Managing Mac fleets across global regions requires architecture that handles Apple Business enrollment, Declarative Device Management, and configuration verification beyond simple MDM command acknowledgment. Organizations need solutions that integrate with Apple's cloud infrastructure while supporting Windows and Linux devices from the same console. With Fleet, your team can manage Mac fleets alongside Windows and Linux devices from a single open-source solution, with osquery-based verification that confirms configurations actually exist on devices. [Schedule a demo](https://fleetdm.com/try-fleet/device-management) to see how Fleet fits your global device management strategy. ## Frequently asked questions -### What's the difference between MDM and Apple Business Manager? +### What's the difference between MDM and Apple Business? -Apple Business Manager is Apple's portal for automatically assigning devices to device management solutions during enrollment, linking device serial numbers to your organization and enabling Automated Device Enrollment (ADE). Device management is the management function plus the Apple MDM protocol and server software that configures and controls devices after they're enrolled. Both are needed: Apple Business Manager for zero-touch automated enrollment, and a device management solution to manage devices after enrollment. +Apple Business is Apple's portal for automatically assigning devices to device management solutions during enrollment, linking device serial numbers to your organization and enabling Automated Device Enrollment (ADE). Device management is the management function plus the Apple MDM protocol and server software that configures and controls devices after they're enrolled. Both are needed: Apple Business for zero-touch automated enrollment, and a device management solution to manage devices after enrollment. ### How many Macs can one admin realistically manage? diff --git a/articles/mdm-just-got-better.md b/articles/mdm-just-got-better.md index 79f732a6763..a0601ae33d0 100644 --- a/articles/mdm-just-got-better.md +++ b/articles/mdm-just-got-better.md @@ -18,11 +18,11 @@ This delivers the most frictionless macOS authentication experience to date — ## Managed device migration -You can now move macOS devices between MDM servers in Apple Business Manager or School Manager. No need to erase, rely on scripts, or use a vendor migration app. For iOS and iPadOS, MDM migration is also available without erasing devices. +You can now move macOS devices between MDM servers in Apple Business or School Manager. No need to erase, rely on scripts, or use a vendor migration app. For iOS and iPadOS, MDM migration is also available without erasing devices. Whether you’re switching providers, consolidating tools after an acquisition, or moving from cloud to on-prem (or vice versa), device migration is now native, scalable, and user-driven. -Apple Business Manager and Apple School Manager introduce: +Apple Business and Apple School Manager introduce: - Enforced migration deadlines with persistent user prompts - Full-screen modals or reboot requirements if migration is delayed @@ -60,7 +60,7 @@ These updates may be under the radar but they make a real difference: Apple’s WWDC25 updates point to a future of frictionless onboarding, declarative management, and user transparency. -**Fleet delivers that today**, supporting declarative MDM on macOS, iOS, and iPadOS, with zero-touch provisioning via Apple Business Manager and Windows Autopilot. +**Fleet delivers that today**, supporting declarative MDM on macOS, iOS, and iPadOS, with zero-touch provisioning via Apple Business and Windows Autopilot. Fleet lets you manage macOS, Windows, and Linux devices from one open, cross-platform system. It’s open source, scalable to millions of devices, and trusted by enterprises with 5,000+ endpoints. With Fleet Desktop, end users can see exactly what’s being managed and what data is collected—helping IT teams build trust through visibility and manage everything as code. diff --git a/articles/mdm-migration.md b/articles/mdm-migration.md index 14785613406..50a3ef54096 100644 --- a/articles/mdm-migration.md +++ b/articles/mdm-migration.md @@ -4,12 +4,12 @@ This guide provides instructions for migrating devices from your current MDM sol > For seamless MDM migration, [view this guide](https://fleetdm.com/guides/seamless-mdm-migration). -> For Apple's native MDM migration support for ABM-registered devices running macOS, iOS or iPadOS 26, [consult Apple's documentation](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web) +> For Apple's native MDM migration support for AB-registered devices running macOS, iOS or iPadOS 26, [consult Apple's documentation](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web) ## Requirements - A [deployed Fleet instance](https://fleetdm.com/docs/deploy/deploy-fleet) -- Fleet is connected to Apple Push Notification service (APNs) and Apple Business Manager (ABM). [See macOS MDM setup](https://fleetdm.com/guides/macos-mdm-setup) +- Fleet is connected to Apple Push Notification service (APNs) and Apple Business (AB). [See macOS MDM setup](https://fleetdm.com/guides/macos-mdm-setup) - For the end-user workflow: A service is required that can receive a webhook to send an unenroll request to the existing MDM server. See [this example](https://victoronsoftware.com/posts/webhook-flow-with-tines/) using Fleet webhooks with Tines. > **Important:** Apple MDM enrollment relies on a Safari-based system web view. If Safari is blocked or restricted, enrollment can fail. @@ -19,7 +19,7 @@ This guide provides instructions for migrating devices from your current MDM sol To migrate hosts, we will do the following steps: 1. Enroll hosts to Fleet -2. Assign hosts in Apple Business Manager (ABM) to Fleet +2. Assign hosts in Apple Business (AB) to Fleet 3. Choose migration workflow and migrate hosts ### Step 1: Enroll hosts to Fleet @@ -27,11 +27,11 @@ To migrate hosts, we will do the following steps: 1. First, [enroll your hosts](https://fleetdm.com/guides/enroll-hosts) to Fleet by installing Fleet's agent (fleetd). 2. Ensure your end users have access to an admin account on their Mac. End users won't be able to migrate on their own if they have a standard account. -### Step 2: Assign hosts in Apple Business Manager (ABM) to Fleet +### Step 2: Assign hosts in Apple Business (AB) to Fleet -1. In ABM, unassign your hosts from your current MDM solution by selecting **Devices** and then selecting **All Devices**. Then, select **Edit** next to **Edit MDM Server**, select **Unassign from the current MDM**, and select **Continue**. +1. In AB, unassign your hosts from your current MDM solution by selecting **Inventory** > **Devices** then **Select** and then selecting **Select All**. Then, select **Actions** > **Unassign device management**. -2. Assign these hosts to Fleet: select **Devices** and then select **All Devices**. Then, select **Edit** next to **Edit MDM Server**, select **Assign to the following MDM:**, select your Fleet server in the dropdown, and select **Continue**. +2. Assign these hosts to Fleet: select **Inventory** > **Devices** then **Select** and then selecting **Select All**. Then, select **Actions** > **Assign device management** and select your Fleet server in the dropdown. ### Step 3: Choose migration workflow and migrate hosts @@ -45,11 +45,11 @@ The end user migration workflow allows the user to kick off migration by unenrol End user experience: -- After a host is unenrolled from your current MDM solution, the end user is prompted with Apple’s Remote Management full-screen pop-up, typically within two hours, if the host is assigned to Fleet in ABM. +- After a host is unenrolled from your current MDM solution, the end user is prompted with Apple’s Remote Management full-screen pop-up, typically within two hours, if the host is assigned to Fleet in AB. > **Note:** After Fleet begins prompting end users to enroll, it will continue to prompt them every few minutes. macOS Remote Management popup -- If the host is not assigned to Fleet in ABM (manual enrollment), the end user will be given the option to download the MDM enrollment profile on their **My device page**. +- If the host is not assigned to Fleet in AB (manual enrollment), the end user will be given the option to download the MDM enrollment profile on their **My device** page. Fleet icon in menu bar My device page - turn on MDM @@ -125,9 +125,9 @@ After turning on disk encryption in Fleet, share [these guided instructions](#ho In Fleet, the [Activation Lock](https://support.apple.com/en-us/HT208987) feature is disabled by default for automatically enrolled (ADE) hosts. -In 2024, Apple added the ability to manage activation lock in Apple Business Manager (ABM). For devices that are owned by the business and available in ABM, you can [turn off activation lock remotely](https://support.apple.com/en-ca/guide/apple-business-manager/axm812df1dd8/web). +In 2024, Apple added the ability to manage activation lock in Apple Business (AB). For devices that are owned by the business and available in AB, you can [turn off activation lock remotely](https://support.apple.com/en-ca/guide/business/welcome/web). -If a device is not available in ABM and has Activation Lock enabled, we recommend asking the end user to follow these instructions to disable Activation Lock before migrating the device to Fleet: https://support.apple.com/en-us/HT208987. +If a device is not available in AB and has Activation Lock enabled, we recommend asking the end user to follow these instructions to disable Activation Lock before migrating the device to Fleet: https://support.apple.com/en-us/HT208987. If the Activation Lock is enabled, you will need the Activation Lock bypass code to wipe and reuse the Mac successfully. diff --git a/articles/mdm-providers-compared.md b/articles/mdm-providers-compared.md index ae7ff1ee8bc..3831d77b6da 100644 --- a/articles/mdm-providers-compared.md +++ b/articles/mdm-providers-compared.md @@ -20,7 +20,7 @@ Workspace ONE is an MDM product from Omnissa that provides unified endpoint mana ### Enrollment and provisioning -When new employees join or devices need to be deployed at scale, zero-touch enrollment lets IT ship devices directly to end users without manual setup. Fleet supports zero-touch deployment for macOS, Windows, and iOS/iPadOS, with Apple Business Manager integration for Apple devices and Windows Autopilot for Windows. Workspace ONE also supports zero-touch enrollment across these operating systems. +When new employees join or devices need to be deployed at scale, zero-touch enrollment lets IT ship devices directly to end users without manual setup. Fleet supports zero-touch deployment for macOS, Windows, and iOS/iPadOS, with Apple Business integration for Apple devices and Windows Autopilot for Windows. Workspace ONE also supports zero-touch enrollment across these operating systems. Both solutions provide options for preventing end users from removing management and MDM configuration profiles without authorization. Both also support MDM migration using Apple's native capabilities for macOS, iOS, and iPadOS. Fleet extends this further for Windows and Linux. Fleet offers migration scripts and documentation to help IT teams transition these devices with minimal end-user disruption, allowing teams to move enrolled devices to Fleet without requiring employees to re-enroll or lose data. @@ -71,7 +71,7 @@ Fleet's interoperable import/export format avoids vendor lock-in. Workspace ONE ## Deployment flexibility -Fleet offers both cloud-hosted and self-hosted deployment options with identical features and no restrictions. Self-hosted deployments enable organizations with strict data sovereignty requirements to keep all device data within their own infrastructure. Fleet manages all device types from a single console, with Apple Business Manager integration for zero-touch deployment on Apple devices. +Fleet offers both cloud-hosted and self-hosted deployment options with identical features and no restrictions. Self-hosted deployments enable organizations with strict data sovereignty requirements to keep all device data within their own infrastructure. Fleet manages all device types from a single console, with Apple Business integration for zero-touch deployment on Apple devices. Workspace ONE discourages on-premises deployment, steering organizations toward cloud hosting. @@ -87,7 +87,7 @@ Open-source tools like Fleet provide full transparency into the codebase, allowi #### How does Fleet manage Apple devices? -Fleet provides full Apple device management including MDM enrollment, configuration profiles, and software deployment for macOS, iOS, and iPadOS. Fleet supports Apple Business Manager integration for zero-touch deployment, and manages Apple devices alongside Windows, Linux, ChromeOS, and Android endpoints from a single console. +Fleet provides full Apple device management including MDM enrollment, configuration profiles, and software deployment for macOS, iOS, and iPadOS. Fleet supports Apple Business integration for zero-touch deployment, and manages Apple devices alongside Windows, Linux, ChromeOS, and Android endpoints from a single console. #### How does device reporting speed affect IT and security operations? diff --git a/articles/role-based-access.md b/articles/role-based-access.md index 5431a1fe946..834670b0b32 100644 --- a/articles/role-based-access.md +++ b/articles/role-based-access.md @@ -95,7 +95,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines. | Retrieve contents from file carving | | | | | ✅ | | | Create Apple Push Certificates service (APNs) certificate signing request (CSR) | | | | | ✅ | | | View, edit, and delete APNs certificate | | | | | ✅ | | -| View, edit, and delete Apple Business Manager (ABM) connections | | | | | ✅ | | +| View, edit, and delete Apple Business (AB) connections | | | | | ✅ | | | View, edit, and delete Volume Purchasing Program (VPP) connections | | | | | ✅ | | | Connect Android Enterprise | | | | | ✅ | | | View disk encryption key for macOS, Windows, and Linux hosts | ✅ | ✅ | ✅ | ✅ | ✅ | | diff --git a/articles/setup-experience.md b/articles/setup-experience.md index 919f5316aeb..8d242c15931 100644 --- a/articles/setup-experience.md +++ b/articles/setup-experience.md @@ -6,9 +6,9 @@ In Fleet, you can customize the out-of-the-box macOS, Windows, Linux, iOS, iPadO This guide covers macOS, iOS, iPadOS, and Android. Learn more about Windows and Linux in a [separate guide](https://fleetdm.com/guides/windows-linux-setup-experience). -macOS setup features require [connecting Fleet to Apple Business Manager (ABM)](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm). +macOS setup features require [connecting Fleet to Apple Business (AB)](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm). -> If a host is marked with a [migration deadline](https://support.apple.com/en-bh/guide/apple-business-manager/axm3a49a769d/web#axmf524b36d9) in Apple Business Manager, Fleet treats it as already set up. This means Fleet won’t install setup experience software, run scripts, or install bootstrap packages on that host. +> If a host is marked with a [migration deadline](https://support.apple.com/en-bh/guide/apple-business-manager/axm3a49a769d/web#axmf524b36d9) in Apple Business, Fleet treats it as already set up. This means Fleet won’t install setup experience software, run scripts, or install bootstrap packages on that host. Below is the end user experience for macOS. Check out the separate videos for [iOS](https://www.youtube.com/watch?v=bPtr3Qgp1JY), [iPadOS](https://www.youtube.com/watch?v=sK3ZR2iItJY), and [Android](https://www.youtube.com/watch?v=-zB1zgtGAMs). @@ -133,7 +133,7 @@ To sign the package we need a valid Developer ID Installer certificate: You can install software during first time macOS, iOS, iPadOS, Android, and [Windows and Linux setup](https://fleetdm.com/guides/windows-linux-setup-experience). -Currently, for macOS hosts, software is only installed on hosts that automatically enroll to Fleet via Apple Business Manager (ABM). For iOS and iPadOS hosts, software is only installed on hosts that enroll via ABM and hosts that manually enroll via the `/enroll` link (profile-based device enrollment). +Currently, for macOS hosts, software is only installed on hosts that automatically enroll to Fleet via Apple Business (AB). For iOS and iPadOS hosts, software is only installed on hosts that enroll via ABM and hosts that manually enroll via the `/enroll` link (profile-based device enrollment). Add setup experience software: @@ -239,13 +239,13 @@ To customize the Setup Assistant, we will do the following steps: ### Step 3: Test the custom Setup Assistant -Testing requires a test Mac that is present in your Apple Business Manager (ABM) account. We will wipe this Mac and use it to test the custom Setup Assistant. +Testing requires a test Mac that is present in your Apple Business (AB) account. We will wipe this Mac and use it to test the custom Setup Assistant. 1. Wipe the test Mac by selecting the Apple icon in top left corner of the screen, selecting **System Settings** or **System Preference**, and searching for "Erase all content and settings." Select **Erase All Content and Settings**. 2. In Fleet, navigate to the Hosts page and find your Mac. Make sure that the host's **MDM status** is set to "Pending." - > New Macs purchased through Apple Business Manager appear in Fleet with MDM status set to "Pending." See our [automatic enrollment guide](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager) for more information. + > New Macs purchased through Apple Business appear in Fleet with MDM status set to "Pending." See our [automatic enrollment guide](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager) for more information. 3. Transfer this host to a test fleet by selecting the checkbox to the left of the host and selecting **Transfer** at the top of the table. In the modal, choose the test fleet and select **Transfer**. diff --git a/articles/sysadmin-diaries-device-enrollment.md b/articles/sysadmin-diaries-device-enrollment.md index 733758a7e52..eefc3f0c346 100644 --- a/articles/sysadmin-diaries-device-enrollment.md +++ b/articles/sysadmin-diaries-device-enrollment.md @@ -14,7 +14,7 @@ Automatic Device Enrollment, often called DEP, empowers sysadmins to seamlessly Bring Your Own Device enrollment is intended to allow users to enroll their personal devices into corporate management systems. While BYOD fosters user convenience and productivity, it introduces potential security vulnerabilities. Notably, the ability for users to unenroll their devices poses a significant challenge for sysadmins, as it compromises centralized device management and security measures. -Our examination of BYOD enrollment underscores the importance of vigilance and proactive measures. As sysadmins, it is crucial to verify that all devices are appropriately registered within the Apple Business Manager (ABM) account. Devices not present in ABM should be [manually added](https://support.apple.com/guide/apple-business-manager/add-devices-from-apple-configurator-axm200a54d59/web) to ensure comprehensive device oversight and security. +Our examination of BYOD enrollment underscores the importance of vigilance and proactive measures. As sysadmins, it is crucial to verify that all devices are appropriately registered within the Apple Business (AB) account. Devices not present in AB should be [manually added](https://support.apple.com/guide/apple-business-manager/add-devices-from-apple-configurator-axm200a54d59/web) to ensure comprehensive device oversight and security. ## Differences and considerations diff --git a/articles/tales-from-fleet-security-securing-the-startup.md b/articles/tales-from-fleet-security-securing-the-startup.md index 92a7b0d2a12..4a432bf96c2 100644 --- a/articles/tales-from-fleet-security-securing-the-startup.md +++ b/articles/tales-from-fleet-security-securing-the-startup.md @@ -57,7 +57,7 @@ Google should offer more granularity than on/off for third-party cookies, such a ### ADE in other countries -First, we enrolled in ADE in the US. Once we had our customer numbers and Mobile Device Management (MDM) system linked up, we were ready to buy laptops in the US that would get configured out of the box. Then, we found a workaround for Canada. If you add Apple’s Reseller ID to [Apple Business Manager](https://business.apple.com/), you can order computers over the phone and have them linked to your business account. The Reseller ID part is critical. I learned that the hard way, by receiving a laptop ordered like this to find it not part of ADE. Fortunately, it was easy for me to [add it to ADE manually](https://support.apple.com/en-ca/guide/apple-configurator/welcome/ios). +First, we enrolled in ADE in the US. Once we had our customer numbers and Mobile Device Management (MDM) system linked up, we were ready to buy laptops in the US that would get configured out of the box. Then, we found a workaround for Canada. If you add Apple’s Reseller ID to [Apple Business](https://business.apple.com/), you can order computers over the phone and have them linked to your business account. The Reseller ID part is critical. I learned that the hard way, by receiving a laptop ordered like this to find it not part of ADE. Fortunately, it was easy for me to [add it to ADE manually](https://support.apple.com/en-ca/guide/apple-configurator/welcome/ios). We will keep trying the same approach in every country where we need Macs, though we know it will not be possible everywhere. We will either obtain equipment from a nearby country or rely on manual MDM enrollment by end-users for those countries. diff --git a/articles/technology-platform.md b/articles/technology-platform.md index f7b8b5c3afc..e5ef42d3448 100644 --- a/articles/technology-platform.md +++ b/articles/technology-platform.md @@ -12,7 +12,7 @@ As the fleet grows, the team needs a more scalable way to manage devices using a * **Devices managed:** ~15,000 iPads plus corporate macOS devices -* **Primary requirements:** GitOps workflows, API-first management, Apple Business Manager integration +* **Primary requirements:** GitOps workflows, API-first management, Apple Business integration * **Previous challenge:** Manual enrollment processes and limited automation @@ -33,7 +33,7 @@ Fleet must meet three key requirements: 1. **GitOps workflows** Integrate with GitHub Enterprise for version-controlled device management. -2. **Apple Business Manager integration** +2. **Apple Business integration** Seamlessly manage large numbers of iPads. 3. **API-first management** @@ -47,7 +47,7 @@ Device configurations live in version-controlled repositories. Changes go throug Fleet’s API powers several automated workflows. For example, device names synchronize automatically with the company’s inventory system, ensuring records remain accurate without manual updates. -Fleet also integrates with Apple Business Manager to automate provisioning of new devices. +Fleet also integrates with Apple Business to automate provisioning of new devices. ### A flexible migration strategy diff --git a/articles/the-mdm-mirgration-reality.md b/articles/the-mdm-mirgration-reality.md index dc4aa0da7d9..5b7652e5e03 100644 --- a/articles/the-mdm-mirgration-reality.md +++ b/articles/the-mdm-mirgration-reality.md @@ -1,6 +1,6 @@ # The MDM migration reality: easier, but not easy -Recent macOS and iOS/iPadOS updates, along with improvements in Apple Business Manager (ABM), have made MDM migration less disruptive. Previously, migrating iOS and iPadOS devices to a new MDM server required a complete factory reset, disrupting end users. Now, these mobile devices can be reassigned to a new MDM server without wiping, bringing them in line with macOS devices which already supported non-destructive migration. +Recent macOS and iOS/iPadOS updates, along with improvements in Apple Business (AB), have made MDM migration less disruptive. Previously, migrating iOS and iPadOS devices to a new MDM server required a complete factory reset, disrupting end users. Now, these mobile devices can be reassigned to a new MDM server without wiping, bringing them in line with macOS devices which already supported non-destructive migration. While macOS avoided the factory reset requirement, migration prior to macOS 26 still required careful coordination and communication with end users and, in some cases, custom workflows to ease the transition. diff --git a/articles/what-is-apple-business-a-complete-guide.md b/articles/what-is-apple-business-a-complete-guide.md new file mode 100644 index 00000000000..5d338f39182 --- /dev/null +++ b/articles/what-is-apple-business-a-complete-guide.md @@ -0,0 +1,110 @@ +# What is Apple Business? A complete guide + +This article explains what Apple Business (AB) does and its key features. + +## Apple Business defined + +Apple Business (AB) is Apple's free service for tracking the provenance of an organization's purchased devices from Apple or from authorized Apple resellers. By validating institutional ownership of Apple devices, AB allows organizations to: + +- Connect their MDM servers to AB to enable Automated Device Enrollment (ADE) for zero-touch enrollment workflows +- Control licensed software and content distribution via Apps and Books management +- Administer Managed Apple Accounts + +The backend of the AB infrastructure handles connecting institutionally-owned devices to Apple activation servers after first boot. Devices negotiate with AB and become associated to an organization's MDM server to receive an enrollment profile. When a device is enrolled, users are walked through a partially or fully automated Setup Assistant process, usually followed by a customized provisioning workflow. The "Out Of the Box" (OOB) experience for a new employee is easy to understand and hassle-free, resulting in a completely configured, fully-managed device that is ready for work without manual or IT intervention. + +Apple consolidated AB in 2018 from two previously separate programs: the Device Enrollment Program (DEP) for automated enrollment and the Volume Purchase Program (VPP) for app licensing. The consolidation eliminated operational silos of managing device enrollment in one system and app distribution in another. + +AB is a single-portal for: + +- Device enrollment automation (ADE) +- Software and content purchasing (Apps and Books) +- Managed Apple Account provisioning + +integrated with your chosen mobile device management (MDM) solution for complete control of your devices across the Apple platform. + +## Is Apple Business an MDM? + +AB alone is not a substitute for an MDM solution. MDM servers connected to AB are responsible for performing management actions on devices after enrollment. + +Pairing AB with an MDM solution results in a comprehensive management system where automated enrollment feeds devices to the MDM server. The MDM server deploys MDM commands and configuration profiles to enforce settings and controls post-enrollment. + +MDM is possible without AB, but, manual enrollment can create bottlenecks that slow provisioning and increase IT overhead. AB enables ADE which allows for Apple devices to be fully managed and supervised, giving organizations access to the full range of Apple device management capabilities. + +AB can be integrated with all major MDM solutions, including [Fleet](http://fleetdm.com/). This flexibility allows organizations to evaluate MDM vendors based on specific requirements or features like REST API capabilities, cross-platform support, data collection, security compliance, remediation capabilities, GitOps automation, and self-hosting options. + +If your current MDM fails to meet your needs, you can switch MDM vendors without having to create a new AB instance. At WWDC 2025 Apple introduced [Managed Device Migration](https://fleetdm.com/announcements/mdm-just-got-better) making the move from your current MDM vendor to any other easier than ever. + +## What are the key features of Apple Business? + +AB has three core capabilities that work together to automate device provisioning at scale: Automated Device Enrollment (ADE), volume purchasing for Apps and Books, and identity management through Managed Apple Accounts + +### Automated Device Enrollment + +Automated Device Enrollment (ADE) streamlines MDM enrollment by handling initial device setup through Apple's activation infrastructure. + +### Volume purchasing and app distribution + +AB provides bulk app and content purchases with remote distribution that doesn't require employees to use personal Apple Accounts on-device. This gives you complete license management with remote deployment capabilities even if users or your organization has disabled the App Store on managed devices. + +Admins can push app updates and revoke compromised app access during security incidents across their entire fleet without requiring physical access to devices. + +When employees leave, licenses are maintained by your organization rather than leaving with them. This means licenses are available for reassignment to current employees and licensing costs can be more easily managed. For organizations with proprietary software, AB allows custom, in-house app distribution directly to managed devices without requiring App Store distribution or public availability. + +### Managed Apple Accounts + +Managed Apple Accounts allow organizations to separate work and personal identities. AB People Managers can control all identities created within an organization's domain. This solves the problem of employees controlling Apple Accounts created with an organizational identity but intended for personal use outside the organization's control. + +Managed Apple Accounts also enable role-based access control within AB. This allows an organization to delegate specific AB administrative responsibilities. A Content Manager, for example, can distribute apps without accessing device configurations. A People Manager can provision Managed Apple Accounts without access to change MDM assignments. + +Role-based access control typically follows the security principle of "least privilege" while distributing workloads across your IT team, preventing any single AB administrator from having unnecessary access to sensitive configurations. + +## Benefits of Apple Business + +AB eliminates manual device setup, reduces administrative overhead through automation, and provides vendor flexibility at zero platform cost. + +- **Deployment efficiency:** Automated enrollment delivers devices ready for work on first boot, allowing IT teams to shift their focus from repetitive device configuration to designing policies and maintaining infrastructure. + +- **Operational scale:** AB supports organizational growth without requiring architectural changes, keeping your provisioning process consistent as your device fleet expands from dozens to thousands of devices. + +- **Cost savings:** AB itself costs nothing, and volume app purchasing keeps software and content license expenses predictable. + +- **Security and compliance:** AB enables good security posture at many different levels: + + - Device supervision via ADE enforce security settings from first boot and enabling remote lock / wipe capabilities + - Managed Apple Accounts can help to keep work data separate from personal information + - Role-based access controls in AB allow organizations to engage in best practices + +- **Vendor flexibility:** AB integrates with any MDM solution, preventing vendor lock-in. Select the MDM solution that fits your organization bwest and switch MDM vendors without rebuilding your enrollment infrastructure via Managed Device Migration. + +## Who should use Apple Business? + +Small US-only teams with fewer than 500 employees and basic security needs might be able to use ABE. Organizations managing Apple devices at scale should use AB paired with a third-party MDM solution, such as [Fleet](https://fleetdm.com/device-management). + +Value emerges for enterprises with distributed teams, international operations, or those planning to exceed 500 employees. Large enterprises with multi-location operations will appreciate AB's global availability and unlimited scale. + +Fleet pairs well with AB. Fleet's MDM features are built on top of [osquery](https://fleetdm.com/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems), Fleet provides deep endpoint visibility through 300+ queryable data tables and delivers device reporting in under 30 seconds. Its cross-platform support extends beyond the Apple ecosystem to Windows, Linux, Chromebooks and Android devices. For organizations with data residency requirements, Fleet offers both hosted, cloud-managed and self-hosted server deployment options, while native GitOps and API-first design integrate with the modern, infrastructure-as-code practices large enterprises are adopting to thrive. + +## What about Apple devices in education and the public sector? + +Educational institutions should use Apple School Manager (ASM) instead of AB. ASM has all the features of AB with additional features designed for K-12 and higher education like Shared iPad management, student information management tools, and student account provisioning. Schools don't need both portals and only need to pair ASM with a third-party MDM solution like [Fleet](http://fleetdm.com/). + +AB works with all MDM solutions and provides detailed procurement, enrollment and compliance data. Government and public sector agencies managing Apple devices that: + +Must meet strict vendor flexibility and audit requirements +Operate under strict procurement and regulatory frameworks +should require AB as part of their technology stack. + +Fleet helps these organizations [meet compliance requirements](https://fleetdm.com/securing/get-and-stay-compliant-across-your-devices-with-fleet) through automated vulnerability detection, policy enforcement, continuous monitoring, and deployment flexibility with both cloud-hosted and self-hosted options that address data residency requirements. + +## Pairing AB with the right MDM + +AB provides the enrollment infrastructure that makes automated Apple device provisioning possible. Pairing AB's free platform with your chosen MDM solution eliminates manual device setup and gives you a flexible foundation that scales with your organization. + +For comprehensive device management across Mac, iPhone, iPad, Windows, and Linux, Fleet provides open-source MDM that integrates with AB. Once AB handles enrollment, Fleet manages your devices with an API-first architecture that supports GitOps workflows and configuration as code. [Schedule a Fleet demo](https://fleetdm.com/contact) to explore how AB and Fleet work together. + + + + + + + diff --git a/articles/what-is-apple-business-manager-a-complete-guide.md b/articles/what-is-apple-business-manager-a-complete-guide.md deleted file mode 100644 index 2c4861ad643..00000000000 --- a/articles/what-is-apple-business-manager-a-complete-guide.md +++ /dev/null @@ -1,126 +0,0 @@ -# What is Apple Business Manager? A complete guide - -This article explains what Apple Business Manager (ABM) does and its key features. - -## Apple Business Manager defined - -Apple Business Manager (ABM) is Apple's free service for tracking the provenance of an organization's purchased devices from Apple or from authorized Apple resellers. By validating institutional ownership of Apple devices, ABM allows organizations to: - -- Connect their MDM servers to ABM to enable Automated Device Enrollment (ADE) for zero-touch enrollment workflows -- Control licensed software and content distribution via Apps and Books management -- Administer Managed Apple Accounts - -The backend of the ABM infrastructure handles connecting institutionally-owned devices to Apple activation servers after first boot. Devices negotiate with ABM and become associated to an organization's MDM server to receive an enrollment profile. When a device is enrolled, users are walked through a partially or fully automated Setup Assistant process, usually followed by a customized provisioning workflow. The "Out Of the Box" (OOB) experience for a new employee is easy to understand and hassle-free, resulting in a completely configured, fully-managed device that is ready for work without manual or IT intervention. - -Apple consolidated ABM in 2018 from two previously separate programs: the Device Enrollment Program (DEP) for automated enrollment and the Volume Purchase Program (VPP) for app licensing. The consolidation eliminated operational silos of managing device enrollment in one system and app distribution in another. - -ABM is a single-portal for: - -- Device enrollment automation (ADE) -- Software and content purchasing (Apps and Books) -- Managed Apple Account provisioning - -integrated with your chosen mobile device management (MDM) solution for complete control of your devices across the Apple platform. - -## Is Apple Business Manager an MDM? - -ABM alone is not a substitute for an MDM solution. MDM servers connected to ABM are responsible for performing management actions on devices after enrollment. - -Pairing ABM with an MDM solution results in a comprehensive management system where automated enrollment feeds devices to the MDM server. The MDM server deploys MDM commands and configuration profiles to enforce settings and controls post-enrollment. - -MDM is possible without ABM, but, manual enrollment can create bottlenecks that slow provisioning and increase IT overhead. ABM enables ADE which allows for Apple devices to be fully managed and supervised, giving organizations access to the full range of Apple device management capabilities. - -ABM can be integrated with all major MDM solutions, including [Fleet](http://fleetdm.com/). This flexibility allows organizations to evaluate MDM vendors based on specific requirements or features like REST API capabilities, cross-platform support, data collection, security compliance, remediation capabilities, GitOps automation, and self-hosting options. - -If your current MDM fails to meet your needs, you can switch MDM vendors without having to create a new ABM instance. At WWDC 2025 Apple introduced [Managed Device Migration](https://fleetdm.com/announcements/mdm-just-got-better) making the move from your current MDM vendor to any other easier than ever. - -### What is Apple Business Essentials? - -Apple Business Essentials (ABE) is Apple's MDM solution for small businesses that bundles enrollment and settings enforcement into a single paid subscription ($2.99 to $24.99 per device per month). Unlike ABM which requires a separate MDM, ABE packages ABM functionality with built-in MDM, 24/7 support, and iCloud storage in a simplified offering. - -ABE works best for organizations with specific characteristics and constraints: - -- Organizations with fewer than 500 employees -- US-based operations that don't require multi-region deployment -- Apple-only device fleets without Windows, Linux, or cross-platform management needs -- Limited IT staff who benefit from simplified administration and built-in support -- Basic security requirements that don't demand advanced compliance - -ABE lacks advanced controls like conditional access, dynamic grouping, and sophisticated automation, while app deployment is via App Store software distribution custom package installation capabilities. - -Complex organizations with strict management requirements should consider using ABM paired with a a third-party MDM solution for greater flexibility and capabilities. - -## What are the key features of Apple Business Manager? - -ABM has three core capabilities that work together to automate device provisioning at scale: Automated Device Enrollment (ADE), volume purchasing for Apps and Books, and identity management through Managed Apple Accounts - -### Automated Device Enrollment - -Automated Device Enrollment (ADE) streamlines MDM enrollment by handling initial device setup through Apple's activation infrastructure. - -### Volume purchasing and app distribution - -ABM provides bulk app and content purchases with remote distribution that doesn't require employees to use personal Apple Accounts on-device. This gives you complete license management with remote deployment capabilities even if users or your organization has disabled the App Store on managed devices. - -Admins can push app updates and revoke compromised app access during security incidents across their entire fleet without requiring physical access to devices. - -When employees leave, licenses are maintained by your organization rather than leaving with them. This means licenses are available for reassignment to current employees and licensing costs can be more easily managed. For organizations with proprietary software, ABM allows custom, in-house app distribution directly to managed devices without requiring App Store distribution or public availability. - -### Managed Apple Accounts - -Managed Apple Accounts allow organizations to separate work and personal identities. ABM People Managers can control all identities created within an organization's domain. This solves the problem of employees controlling Apple Accounts created with an organizational identity but intended for personal use outside the organization's control. - -Managed Apple Accounts also enable role-based access control within ABM. This allows an organization to delegate specific ABM administrative responsibilities. A Content Manager, for example, can distribute apps without accessing device configurations. A People Manager can provision Managed Apple Accounts without access to change MDM assignments. - -Role-based access control typically follows the security principle of "least privilege" while distributing workloads across your IT team, preventing any single ABM administrator from having unnecessary access to sensitive configurations. - -## Benefits of Apple Business Manager - -ABM eliminates manual device setup, reduces administrative overhead through automation, and provides vendor flexibility at zero platform cost. - -- **Deployment efficiency:** Automated enrollment delivers devices ready for work on first boot, allowing IT teams to shift their focus from repetitive device configuration to designing policies and maintaining infrastructure. - -- **Operational scale:** ABM supports organizational growth without requiring architectural changes, keeping your provisioning process consistent as your device fleet expands from dozens to thousands of devices. - -- **Cost savings:** ABM itself costs nothing, and volume app purchasing keeps software and content license expenses predictable. - -- **Security and compliance:** ABM enables good security posture at many different levels: - - - Device supervision via ADE enforce security settings from first boot and enabling remote lock / wipe capabilities - - Managed Apple Accounts can help to keep work data separate from personal information - - Role-based access controls in ABM allow organizations to engage in best practices - -- **Vendor flexibility:** ABM integrates with any MDM solution, preventing vendor lock-in. Select the MDM solution that fits your organization bwest and switch MDM vendors without rebuilding your enrollment infrastructure via Managed Device Migration. - -## Who should use Apple Business Manager? - -Small US-only teams with fewer than 500 employees and basic security needs might be able to use ABE. Organizations managing Apple devices at scale should use ABM paired with a third-party MDM solution, such as [Fleet](https://fleetdm.com/device-management). - -Value emerges for enterprises with distributed teams, international operations, or those planning to exceed 500 employees. Large enterprises with multi-location operations will appreciate ABM's global availability and unlimited scale since Apple Business Essentials has strict size and geographic limits. - -Fleet pairs well with ABM. Fleet's MDM features are built on top of [osquery](https://fleetdm.com/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems), Fleet provides deep endpoint visibility through 300+ queryable data tables and delivers device reporting in under 30 seconds. Its cross-platform support extends beyond the Apple ecosystem to Windows, Linux, Chromebooks and Android devices. For organizations with data residency requirements, Fleet offers both hosted, cloud-managed and self-hosted server deployment options, while native GitOps and API-first design integrate with the modern, infrastructure-as-code practices large enterprises are adopting to thrive. - -## What about Apple devices in education and the public sector? - -Educational institutions should use Apple School Manager (ASM) instead of ABM. ASM has all the features of ABM with additional features designed for K-12 and higher education like Shared iPad management, student information management tools, and student account provisioning. Schools don't need both portals and only need to pair ASM with a third-party MDM solution like [Fleet](http://fleetdm.com/). - -ABM works with all MDM solutions and provides detailed procurement, enrollment and compliance data. Government and public sector agencies managing Apple devices that: - -Must meet strict vendor flexibility and audit requirements -Operate under strict procurement and regulatory frameworks -should require ABM as part of their technology stack. - -Fleet helps these organizations [meet compliance requirements](https://fleetdm.com/securing/get-and-stay-compliant-across-your-devices-with-fleet) through automated vulnerability detection, policy enforcement, continuous monitoring, and deployment flexibility with both cloud-hosted and self-hosted options that address data residency requirements. - -## Pairing ABM with the right MDM - -ABM provides the enrollment infrastructure that makes automated Apple device provisioning possible. Pairing ABM's free platform with your chosen MDM solution eliminates manual device setup and gives you a flexible foundation that scales with your organization. - -For comprehensive device management across Mac, iPhone, iPad, Windows, and Linux, Fleet provides open-source MDM that integrates with ABM. Once ABM handles enrollment, Fleet manages your devices with an API-first architecture that supports GitOps workflows and configuration as code. [Schedule a Fleet demo](https://fleetdm.com/contact) to explore how ABM and Fleet work together. - - - - - - - diff --git a/articles/what-is-apple-mdm.md b/articles/what-is-apple-mdm.md index 77316dbda62..aaed2a89f83 100644 --- a/articles/what-is-apple-mdm.md +++ b/articles/what-is-apple-mdm.md @@ -1,6 +1,6 @@ # Apple MDM: A complete guide -Managing Apple devices across an enterprise organization requires more than just deploying hardware. Configuration settings, security policies, and app distribution must reach hundreds or thousands of macOS, iOS, and iPadOS devices without manual intervention. Apple's Mobile Device Management (MDM) protocol provides the foundation for managing large device fleets, but the protocol itself is just one piece of the puzzle. This guide covers how Apple MDM works, integration with Apple Business Manager (ABM). +Managing Apple devices across an enterprise organization requires more than just deploying hardware. Configuration settings, security policies, and app distribution must reach hundreds or thousands of macOS, iOS, and iPadOS devices without manual intervention. Apple's Mobile Device Management (MDM) protocol provides the foundation for managing large device fleets, but the protocol itself is just one piece of the puzzle. This guide covers how Apple MDM works, integration with Apple Business (AB). ## What is Apple MDM and how does it work? @@ -10,19 +10,19 @@ The architecture relies on two core components working together. A check-in prot When administrators push a configuration change, the MDM server doesn't communicate directly with the device. Instead, it sends a push notification through APNs, which triggers the device to check in with the MDM server and retrieve any queued commands. This communication depends on valid certificates, including an APNs certificate that requires annual renewal to keep your fleet connected. -## Managing enrollment and apps through Apple Business Manager +## Managing enrollment and apps through Apple Business -Without Apple Business Manager (ABM), enrollment is typically manual or user-initiated, often via profile installation or account-driven enrollment flows. These approaches work but are harder to scale than zero-touch deployment. +Without Apple Business (AB), enrollment is typically manual or user-initiated, often via profile installation or account-driven enrollment flows. These approaches work but are harder to scale than zero-touch deployment. -ABM connects Apple's activation servers to your MDM server. When you purchase devices through Apple or authorized resellers, they automatically appear in your ABM account. From there, you assign devices to your MDM server so they enroll automatically when employees power them on for the first time. +AB connects Apple's activation servers to your MDM server. When you purchase devices through Apple or authorized resellers, they automatically appear in your AB account. From there, you assign devices to your MDM server so they enroll automatically when employees power them on for the first time. -ABM also centralizes app purchasing through Apps and Books, letting you buy apps in bulk and distribute them to devices without requiring individual Apple IDs. Apple School Manager (ASM) provides the same capabilities for educational institutions. +AB also centralizes app purchasing through Apps and Books, letting you buy apps in bulk and distribute them to devices without requiring individual Apple IDs. Apple School Manager (ASM) provides the same capabilities for educational institutions. ### Zero-touch deployment through automated device enrollment Automated Device Enrollment (ADE) lets employees power on a new Mac or iPhone and start working without IT touching the device. The device automatically enrolls in your MDM server during Setup Assistant, receives its configuration profiles, and installs required apps. -Here's how it works: when an employee powers on a new device, it contacts Apple's activation servers, which recognize the device belongs to your organization through ABM. Apple redirects the device to your MDM server, and enrollment happens automatically. Depending on configuration (for example, Auto Advance on supported Macs), setup can be largely hands-off. +Here's how it works: when an employee powers on a new device, it contacts Apple's activation servers, which recognize the device belongs to your organization through AB. Apple redirects the device to your MDM server, and enrollment happens automatically. Depending on configuration (for example, Auto Advance on supported Macs), setup can be largely hands-off. ADE provides capabilities that manual enrollment can't match: @@ -64,7 +64,7 @@ DDM coexists with traditional MDM commands and profiles, so you can adopt it gra Most enterprises manage more than just Apple devices. IT teams typically oversee fleets spanning macOS, Windows, and Linux and more. This historically has meant running separate management tools for each platform. Multi-platform MDM tools address this fragmentation by managing all devices through a single console. -The best multi-platform tools don't sacrifice Apple-specific capabilities for multi-platform coverage. They implement Apple's MDM protocol natively, including full support for ABM integration, ADE, Apps and Books, and declarative device management, while extending the same depth of management to Windows and Linux devices. +The best multi-platform tools don't sacrifice Apple-specific capabilities for multi-platform coverage. They implement Apple's MDM protocol natively, including full support for AB integration, ADE, Apps and Books, and declarative device management, while extending the same depth of management to Windows and Linux devices. ### When Apple-only MDM falls short @@ -78,7 +78,7 @@ Linux typically uses configuration management tools like Ansible or Puppet with When evaluating tools that manage Apple devices alongside other platforms, certain capabilities separate tools that genuinely simplify management from those that just add another layer of abstraction: -* **Native Apple MDM support:** The tool should implement Apple's MDM protocol properly, including ABM integration, ADE, Apps and Books, and configuration profiles. +* **Native Apple MDM support:** The tool should implement Apple's MDM protocol properly, including AB integration, ADE, Apps and Books, and configuration profiles. * **Declarative device management:** Support for DDM helps ensure you can take advantage of Apple's modern management architecture. * [**GitOps workflows:**](https://fleetdm.com/gitops-workshop) Infrastructure-as-code approaches let you version control configurations and maintain audit trails. * **API-first architecture:** Robust APIs enable [automation workflows](https://fleetdm.com/guides/automations) and integration with your existing security and IT tools. @@ -88,15 +88,15 @@ Open-source options add transparency to the equation. Organizations can inspect ## Manage Apple devices across your fleet -Apple MDM provides the protocol foundation for enterprise device management, while ABM and automated device enrollment enable zero-touch deployment workflows. Declarative device management points toward Apple's intended direction for modern management. +Apple MDM provides the protocol foundation for enterprise device management, while AB and automated device enrollment enable zero-touch deployment workflows. Declarative device management points toward Apple's intended direction for modern management. -For comprehensive device management across Mac, iPhone, iPad, Windows, and Linux, Fleet provides open-core MDM that integrates with ABM. Fleet manages your devices with an API-first architecture that supports GitOps workflows and configuration as code. [Try Fleet](https://fleetdm.com/try-fleet) to see how unified device management works across your entire fleet. +For comprehensive device management across Mac, iPhone, iPad, Windows, and Linux, Fleet provides open-core MDM that integrates with AB. Fleet manages your devices with an API-first architecture that supports GitOps workflows and configuration as code. [Try Fleet](https://fleetdm.com/try-fleet) to see how unified device management works across your entire fleet. ## Frequently asked questions -### What's the difference between MDM and ABM? +### What's the difference between MDM and AB? -MDM is the protocol and server infrastructure that actually manages devices, pushing configurations, enforcing policies, and executing commands. ABM is Apple's web portal for device enrollment and app purchasing. ABM connects to your MDM server and tells Apple's activation servers which MDM server should manage each device. You need both working together for automated enrollment and zero-touch deployment. +MDM is the protocol and server infrastructure that actually manages devices, pushing configurations, enforcing policies, and executing commands. AB is Apple's web portal for device enrollment and app purchasing. AB connects to your MDM server and tells Apple's activation servers which MDM server should manage each device. You need both working together for automated enrollment and zero-touch deployment. ### Can users remove MDM profiles from their devices? @@ -104,7 +104,7 @@ It depends on the enrollment method. Devices enrolled through Automated Device E ### How long does it take to set up Apple MDM for an organization? -Initial setup often takes anywhere from a few days to a couple of weeks, depending on your existing infrastructure. You'll need to establish an ABM account, obtain APNs certificates, connect your MDM server, and configure enrollment profiles. Fleet's [MDM setup guide](https://fleetdm.com/guides/macos-mdm-setup) walks through the specific steps for connecting ABM. +Initial setup often takes anywhere from a few days to a couple of weeks, depending on your existing infrastructure. You'll need to establish an AB account, obtain APNs certificates, connect your MDM server, and configure enrollment profiles. Fleet's [MDM setup guide](https://fleetdm.com/guides/macos-mdm-setup) walks through the specific steps for connecting AB. ### Does Apple MDM work for BYOD scenarios? diff --git a/articles/what-is-application-management.md b/articles/what-is-application-management.md index 18d24d24bc0..e3f12912c58 100644 --- a/articles/what-is-application-management.md +++ b/articles/what-is-application-management.md @@ -126,7 +126,7 @@ Your organization's specific requirements should determine which approach works ### Platform-specific MDM with application management -An Apple-focused MDM platform like Jamf Pro includes application management. It is focused on Apple devices with functions like Apple Business Manager integration, Apps and Books license management and managed app deployments, but, it only supports Apple devices. +An Apple-focused MDM platform like Jamf Pro includes application management. It is focused on Apple devices with functions like Apple Business integration, Apps and Books license management and managed app deployments, but, it only supports Apple devices. Organizations with heterogeneous environments that include multiple device platforms (e.g., Apple, Linux, Windows, Chromebook, iOS / iPadOS, Android) require multiple management solutions, or, cross-platform managements solutions. diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md index 2c1a7ac83b2..6628d2a99e0 100644 --- a/docs/Configuration/fleet-server-configuration.md +++ b/docs/Configuration/fleet-server-configuration.md @@ -3286,7 +3286,7 @@ You'll likely need to set this if using a non-AWS S3-compatible object store. > The [`server_private_key` configuration option](#server_private_key) is required for macOS MDM features. -> The Apple Push Notification service (APNs), Simple Certificate Enrollment Protocol (SCEP), and Apple Business Manager (ABM) [certificate and key configuration](https://github.com/fleetdm/fleet/blob/fleet-v4.51.0/docs/Contributing/reference/configuration-for-contributors.md#mobile-device-management-mdm) are deprecated as of Fleet 4.51. They are maintained for backwards compatibility. Please [upload your APNs certificate and ABM token](https://fleetdm.com/docs/using-fleet/mdm-setup). +> The Apple Push Notification service (APNs), Simple Certificate Enrollment Protocol (SCEP), and Apple Business (AB) [certificate and key configuration](https://github.com/fleetdm/fleet/blob/fleet-v4.51.0/docs/Contributing/reference/configuration-for-contributors.md#mobile-device-management-mdm) are deprecated as of Fleet 4.51. They are maintained for backwards compatibility. Please [upload your APNs certificate and AB token](https://fleetdm.com/docs/using-fleet/mdm-setup). ### mdm.apple_scep_signer_validity_days @@ -3302,7 +3302,7 @@ The number of days the signed SCEP client certificates will be valid. ### mdm.apple_dep_sync_periodicity -The duration between DEP device syncing (fetching and setting of DEP profiles). Only relevant if Apple Business Manager (ABM) is configured. +The duration between DEP device syncing (fetching and setting of DEP profiles). Only relevant if Apple Business (AB) is configured. - Default value: 1m - Environment variable: `FLEET_MDM_APPLE_DEP_SYNC_PERIODICITY` diff --git a/docs/Contributing/architecture/mdm/automated-device-enrollment.md b/docs/Contributing/architecture/mdm/automated-device-enrollment.md index e6cfe3ea8af..3cb09e2b303 100644 --- a/docs/Contributing/architecture/mdm/automated-device-enrollment.md +++ b/docs/Contributing/architecture/mdm/automated-device-enrollment.md @@ -8,7 +8,7 @@ Automated Device Enrollment (ADE) in Fleet's MDM allows for zero-touch deploymen ## Architecture overview -The ADE architecture integrates with platform-specific enrollment programs (Apple Business Manager/Apple School Manager for Apple devices) to automatically enroll devices when they are activated. +The ADE architecture integrates with platform-specific enrollment programs (Apple Business/Apple School Manager for Apple devices) to automatically enroll devices when they are activated. ## Key components @@ -29,14 +29,14 @@ The ADE architecture integrates with platform-specific enrollment programs (Appl For Apple devices, ADE (formerly known as DEP) involves the following components: -- **Apple Business Manager/Apple School Manager**: Web portals for managing device enrollment. +- **Apple Business/Apple School Manager**: Web portals for managing device enrollment. - **MDM Server Tokens**: Tokens that authenticate the MDM server with Apple's services. - **Enrollment Profiles**: Configurations that define the enrollment experience. - **Device Assignments**: Mapping between devices and enrollment profiles. #### Synchronization process -Synchronization of devices from all ABM tokens uploaded to Fleet happens in the `dep_syncer` cron job, which runs every 1 minute. +Synchronization of devices from all AB tokens uploaded to Fleet happens in the `dep_syncer` cron job, which runs every 1 minute. We keep a record of all devices ingested via the ADE sync in the `host_dep_assignments` table. Entries in this table are soft-deleted. @@ -47,9 +47,9 @@ On every run, we pull the list of added/modified/deleted devices and: - Always assign a JSON profile for added devices. We assign JSON profile for modified devices if the profile has not been modified according to Apple DEP device response. 2. If the host was deleted, we soft delete the `host_dep_assignments` entry. -#### Special case: Host in ABM is deleted in Fleet +#### Special case: Host in AB is deleted in Fleet -If an IT admin deletes a host in the UI/API, and we have a non-deleted entry in `host_dep_assignments` for the host, we immediately create a new host entry as if the device was just ingested from the ABM sync. +If an IT admin deletes a host in the UI/API, and we have a non-deleted entry in `host_dep_assignments` for the host, we immediately create a new host entry as if the device was just ingested from the AB sync. ## Related resources diff --git a/docs/Contributing/product-groups/mdm/custom-configuration-web-url.md b/docs/Contributing/product-groups/mdm/custom-configuration-web-url.md index c39cd3d5a6d..e46ef2b12dd 100644 --- a/docs/Contributing/product-groups/mdm/custom-configuration-web-url.md +++ b/docs/Contributing/product-groups/mdm/custom-configuration-web-url.md @@ -12,7 +12,7 @@ How to require end users to authenticate with a custom web application: 3. In the "Workstations" `fleet` YAML, set the `macos_setup_assistant` option to the DEP profile. -4. In the Fleet UI, go to **Settings > Integrations > Automatic enrollment > Apple Business manager** and set the **Fleet** to "Workstations". +4. In the Fleet UI, go to **Settings > Integrations > Automatic enrollment > Apple Business** and set the **Fleet** to "Workstations". 5. Update the custom web application to send a manual enrollment profile, with the end user's email, to a Mac after the end user enters valid credentials. Here's an example snippet of an enrollment profile: diff --git a/docs/Contributing/reference/api-for-contributors.md b/docs/Contributing/reference/api-for-contributors.md index 1b524d20def..c8171667d02 100644 --- a/docs/Contributing/reference/api-for-contributors.md +++ b/docs/Contributing/reference/api-for-contributors.md @@ -549,7 +549,7 @@ Delete pack by name. The MDM endpoints exist to support the related command-line interface sub-commands of `fleetctl`, such as `fleetctl generate mdm-apple` and `fleetctl get mdm-apple`, as well as the Fleet UI. -- [Generate Apple Business Manager public key (ADE)](#generate-apple-business-manager-public-key-ade) +- [Generate Apple Business public key (ADE)](#generate-apple-business-manager-public-key-ade) - [Request Certificate Signing Request (CSR)](#request-certificate-signing-request-csr) - [Upload APNS certificate](#upload-apns-certificate) - [Add ABM token](#add-abm-token) @@ -586,7 +586,7 @@ The MDM endpoints exist to support the related command-line interface sub-comman - [Android Enterprise PubSub push endpoint](#android-enterprise-pubsub-push-endpoint) -### Generate Apple Business Manager public key (ADE) +### Generate Apple Business public key (ADE) `GET /api/v1/fleet/mdm/apple/abm_public_key` @@ -670,7 +670,7 @@ Content-Type: application/octet-stream | Name | Type | In | Description | | ---- | ---- | -- | ----------- | -| token | file | form | *Required* The file containing the token (.p7m) from Apple Business Manager | +| token | file | form | *Required* The file containing the token (.p7m) from Apple Business | #### Example @@ -713,11 +713,11 @@ Content-Type: application/octet-stream } ``` -### Count ABM tokens +### Count AB tokens `GET /api/v1/fleet/abm_tokens/count` -Get the number of ABM tokens on the Fleet server. +Get the number of AB tokens on the Fleet server. #### Parameters @@ -757,10 +757,10 @@ None. | Name | Type | In | Description | | ---- | ---- | -- | ----------- | -| id | integer | path | *Required* The ABM token's ID | -| macos_team_id | integer | body | macOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team". | -| ios_team_id | integer | body | iOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team". | -| ipados_team_id | integer | body | iPadOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team". | +| id | integer | path | *Required* The AB token's ID | +| macos_team_id | integer | body | macOS hosts are automatically added to this team in Fleet when they appear in Apple Business. If not specified, defaults to "No team". | +| ios_team_id | integer | body | iOS hosts are automatically added to this team in Fleet when they appear in Apple Business. If not specified, defaults to "No team". | +| ipados_team_id | integer | body | iPadOS hosts are automatically added to this team in Fleet when they appear in Apple Business. If not specified, defaults to "No team". | #### Example @@ -871,7 +871,7 @@ Content-Type: application/octet-stream | Name | Type | In | Description | | ---- | ---- | -- | ----------- | -| token | file | form | *Required* The file containing the content token (.vpptoken) from Apple Business Manager | +| token | file | form | *Required* The file containing the content token (.vpptoken) from Apple Business | #### Example @@ -1279,7 +1279,7 @@ This endpoint uses the profiles stored by the [Preassign profiles to devices](#p | Name | Type | In | Description | | ---- | ---- | -- | ----------- | -| token | file | form | *Required* The file containing the content token (.vpptoken) from Apple Business Manager | +| token | file | form | *Required* The file containing the content token (.vpptoken) from Apple Business | #### Example diff --git a/docs/Contributing/reference/configuration-for-contributors.md b/docs/Contributing/reference/configuration-for-contributors.md index c2e3bad530c..75b8ed14bdb 100644 --- a/docs/Contributing/reference/configuration-for-contributors.md +++ b/docs/Contributing/reference/configuration-for-contributors.md @@ -111,7 +111,7 @@ An alphanumeric secret for the Simple Certificate Enrollment Protocol (SCEP). De ### mdm.apple_bm_server_token_bytes -This is the content of the Apple Business Manager encrypted server token downloaded from Apple Business Manager. +This is the content of the Apple Business encrypted server token downloaded from Apple Business. - Default value: "" - Environment variable: `FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES` @@ -126,7 +126,7 @@ This is the content of the Apple Business Manager encrypted server token downloa ### mdm.apple_bm_cert_bytes -This is the content of the Apple Business Manager certificate. The certificate is a PEM-encoded X.509 certificate that's typically generated via `fleetctl generate mdm-apple-bm`. +This is the content of the Apple Business certificate. The certificate is a PEM-encoded X.509 certificate that's typically generated via `fleetctl generate mdm-apple-bm`. - Default value: "" - Environment variable: `FLEET_MDM_APPLE_BM_CERT_BYTES` @@ -141,7 +141,7 @@ This is the content of the Apple Business Manager certificate. The certificate i ### mdm.apple_bm_key_bytes -This is the content of the PEM-encoded private key for the Apple Business Manager. It's typically generated via `fleetctl generate mdm-apple-bm`. +This is the content of the PEM-encoded private key for the Apple Business. It's typically generated via `fleetctl generate mdm-apple-bm`. - Default value: "" - Environment variable: `FLEET_MDM_APPLE_BM_KEY_BYTES` diff --git a/docs/solutions/macos/scripts/revoke-vpp-licenses.sh b/docs/solutions/macos/scripts/revoke-vpp-licenses.sh index 1c8fbabc8a9..1f7e8282348 100644 --- a/docs/solutions/macos/scripts/revoke-vpp-licenses.sh +++ b/docs/solutions/macos/scripts/revoke-vpp-licenses.sh @@ -1,12 +1,12 @@ #!/bin/sh -# 1. Download the VPP token from Apple Business Manager (ABM). +# 1. Download the VPP token from Apple Business (AB). # a. In ABM, go to Account name in bottom left corner > Preferences > Payments and Billing > Download Content Token and download token for your location. # b. Open the downloaded token and copy base64. Paste base64 string instead of '{vpp_token}' in the curl command below. # 2. Find `adamId` in the App Store app and use it in the assets array in the curl command below. # a. It can be retrieved from the app URL (e.g. 1487937127 from https://apps.apple.com/ba/app/craft-write-docs-ai-editing/id1487937127) # 3. Add the serial numbers of the devices from which you want to revoke licenses to the `serialNumbers` array in the curl command below. -# Note: When a license is revoked, it takes some time for that to be reflected in Apple Business Manager. +# Note: When a license is revoked, it takes some time for that to be reflected in Apple Business. # # Script can be used to revoke VPP licenses from all Apple hosts (macOS, iOS, iPadOS). diff --git a/handbook/company/open-positions.yml b/handbook/company/open-positions.yml index 8da9cbd286a..f0e886cf07f 100644 --- a/handbook/company/open-positions.yml +++ b/handbook/company/open-positions.yml @@ -382,7 +382,7 @@ # experience: | # - 💼 3-5 years of experience in IT administration, help desk support, or similar technical support role. # - 🖥️ Strong technical skills with macOS, Windows, and Linux operating systems. -# - 🍎 Experience with Apple Business Manager (ABM) and Apple Device Enrollment (ADE) for device procurement and management. +# - 🍎 Experience with Apple Business (AB) and Apple Device Enrollment (ADE) for device procurement and management. # - 🔐 Experience with identity and access management, including provisioning accounts in Google Workspace, Slack, and other SaaS platforms. # - 📦 Familiarity with hardware procurement, inventory management, and asset tracking systems. # - 💬 Excellent communication and customer service skills, with the ability to explain technical concepts to non-technical users. diff --git a/handbook/it/README.md b/handbook/it/README.md index 6d0813b2be1..b6b32770a2e 100644 --- a/handbook/it/README.md +++ b/handbook/it/README.md @@ -39,7 +39,7 @@ As soon as an offer is accepted, Fleet provides laptops and YubiKey security key - Apple computers shipping to the United States and Canada are ordered using the Apple [eCommerce Portal](https://ecommerce2.apple.com/asb2bstorefront/asb2b/en/USD/?accountselected=true), or by contacting the business team at an Apple Store or contacting the online sales team at [800-854-3680](tel:18008543680). The IT engineer can arrange for same-day pickup at a store local to the Fleetie if needed. - **Note:** Most Fleeties use 16-inch MacBook Pros. Team members are free to choose any laptop or operating system that works for them, as long as the price [is within reason](https://www.fleetdm.com/handbook/communications#spending-company-money). - - When ordering through the Apple eCommerce Portal, look for a banner with *Apple Store for FLEET DEVICE MANAGEMENT | Welcome [Your Name].* Hovering over *Welcome* should display *Your Profile.* If Fleet's account number is displayed, purchases will be automatically made available in Apple Business Manager (ABM). + - When ordering through the Apple eCommerce Portal, look for a banner with *Apple Store for FLEET DEVICE MANAGEMENT | Welcome [Your Name].* Hovering over *Welcome* should display *Your Profile.* If Fleet's account number is displayed, purchases will be automatically made available in Apple Business (AB). - Apple computers for Fleeties in other countries should be purchased through an authorized reseller to ensure the device is enrolled in ADE. In countries that Apple does not operate or that do not allow ADE, work with the authorized reseller to find the best solution, or consider shipping to a US based Fleetie and then shipping on to the teammate. diff --git a/handbook/it/security.md b/handbook/it/security.md index fd80082ef4b..334d18bca1c 100644 --- a/handbook/it/security.md +++ b/handbook/it/security.md @@ -2093,15 +2093,15 @@ The GitHub Deployment page contains a link pointing to a vacant Vercel domain. A This was resolved during the penetration test period as identified in the penetration test report. -#### 3 - Observers can access ABM keys +#### 3 - Observers can access AB keys | Type | Latacora Severity | | ------------------- | ----------------- | | Access Controls | Medium risk | -According to the User Permissions table, an Observer should not be able to “View Apple business manager (BM) information”. The permissions are not enforced as an Observer can download the pair of public and private keys. +According to the User Permissions table, an Observer should not be able to “View Apple Business (AB) information”. The permissions are not enforced as an Observer can download the pair of public and private keys. -This endpoint always returns a new key pair used during ABM/Fleet configuration. It never returns an existing key pair, and cannot be used to gain access to an ABM instance. +This endpoint always returns a new key pair used during AB/Fleet configuration. It never returns an existing key pair, and cannot be used to gain access to an AB instance. #### 4 - Observers can Access Any Software diff --git a/handbook/marketing/marketing-assets.md b/handbook/marketing/marketing-assets.md index 900217865e6..cb63c4119fb 100644 --- a/handbook/marketing/marketing-assets.md +++ b/handbook/marketing/marketing-assets.md @@ -56,7 +56,7 @@ Decks, battle cards, one-pagers, comparisons, and tools used in the sales cycle ## 🔵 Editorial & thought leadership -Opinion, industry analysis, executive POV, named-series articles, and standalone blog posts published on fleetdm.com. Use for PR, social amplification, ABM campaigns, and brand awareness. Audience: content team, PMM, PR. +Opinion, industry analysis, executive POV, named-series articles, and standalone blog posts published on fleetdm.com. Use for PR, social amplification, AB campaigns, and brand awareness. Audience: content team, PMM, PR. ### Executive POV & industry analysis @@ -152,7 +152,7 @@ How Fleet's own security team secures the company — a window into Fleet's inte | [What is Apple MDM? How Mobile Device Management Works in 2026](https://fleetdm.com/articles/what-is-apple-mdm) | How Apple MDM works across iOS, macOS, and iPadOS at scale. | Brock Walters | 2026‑02‑26 | | [What is Apple's Device Enrollment Program (DEP)?](https://fleetdm.com/articles/apple-device-enrollment-program) | How ADE/DEP works, its benefits, and what organizations need to set it up. | Brock Walters | 2026‑02‑26 | | [Managing Macs Globally: Enterprise Apple MDM Best Practices 2026](https://fleetdm.com/articles/managing-macs-globally-apple-ecosystem-deployment-security) | Scale Mac management across global teams with zero-touch deployment, automated compliance, and unified device visibility. | Brock Walters | 2026‑02‑26 | -| [Mac Zero-Touch Deployment: Complete Enterprise Guide 2026](https://fleetdm.com/articles/mac-zero-touch-deployment-guide) | Complete guide to Mac zero-touch deployment using Apple Business Manager and MDM. | Brock Walters | 2026‑02‑26 | +| [Mac Zero-Touch Deployment: Complete Enterprise Guide 2026](https://fleetdm.com/articles/mac-zero-touch-deployment-guide) | Complete guide to Mac zero-touch deployment using Apple Business and MDM. | Brock Walters | 2026‑02‑26 | | [Mac Inventory Management: Device Tracking Guide](https://fleetdm.com/articles/mac-inventory-management) | How Mac inventory combines MDM and osquery to track hardware, software, and security configs. | Brock Walters | 2026‑02‑25 | | [Mac device security: Apple's native protections and third-party tools](https://fleetdm.com/articles/mac-device-security) | How Mac endpoint security works, from Apple's protections (SIP, XProtect, TCC) to third-party tools. | Brock Walters | 2026‑02‑25 | | [How to manage company laptops: a complete guide](https://fleetdm.com/articles/how-to-manage-company-laptops-a-complete-guide) | A complete guide to managing company laptops across macOS, Windows, and Linux at scale. | Brock Walters | 2026‑03‑07 | @@ -160,7 +160,7 @@ How Fleet's own security team secures the company — a window into Fleet's inte | [Why work laptops don't work on plane wifi](https://fleetdm.com/articles/why-work-laptops-dont-work-on-plane-wifi) | VPNs, DNS filters, and captive portals — and why IT teams should fix this by default. | Mike McNeil | 2026‑02‑13 | | [The GitOps idea](https://fleetdm.com/articles/the-gitops-idea) | An introduction to GitOps concepts and components. | Brock Walters | 2026‑02‑04 | | [iPad MDM: a complete guide](https://fleetdm.com/articles/ipad-mdm-a-complete-guide) | A complete guide to iPad MDM, covering deployment models, enrollment methods, and enterprise management at scale. | Brock Walters | 2026‑01‑13 | -| [What is Apple Business Manager? A complete guide](https://fleetdm.com/articles/what-is-apple-business-manager-a-complete-guide) | How ABM works with MDM for automated enrollment and app management. | Brock Walters | 2026‑01‑12 | +| [What is Apple Business? A complete guide](https://fleetdm.com/articles/what-is-apple-business-a-complete-guide) | How AB works with MDM for automated enrollment and app management. | Brock Walters | 2026‑01‑12 | | [Declarative device management: a primer](https://fleetdm.com/articles/declarative-device-management-a-primer) | What DDM is, how it differs from legacy MDM, and why Apple built it. | Brock Walters | 2026‑01‑11 | | [6 business benefits of Apple MDM, explained](https://fleetdm.com/articles/6-business-benefits-of-apple-mdm-explained) | An overview of Apple MDM and the practical business benefits it delivers for security and IT ops. | Brock Walters | 2026‑01‑11 | | [What is application management?](https://fleetdm.com/articles/what-is-application-management) | What app management includes, why it matters, and how tools automate software deployment, updates, and compliance. | Brock Walters | 2026‑01‑11 | diff --git a/website/views/pages/device-management.ejs b/website/views/pages/device-management.ejs index ab6e3a297f7..d7b5397d586 100644 --- a/website/views/pages/device-management.ejs +++ b/website/views/pages/device-management.ejs @@ -80,7 +80,7 @@
Automated enrollment
-

Drop ship devices with Apple Business Manager or Autopilot. End users can set up their own devices. No IT help needed.

+

Drop ship devices with Apple Business or Autopilot. End users can set up their own devices. No IT help needed.