Menu
Modern Workplace Blog
  • Home
  • About: Kenneth van Surksum
  • Cookie Policy
Modern Workplace Blog
February 22, 2022February 22, 2022

Apple Business Manager device import options for later use within Microsoft Endpoint Manager

This blogpost is a continuation of two earlier blogposts about integrating Apple Business Manager with Azure Active Directory and Apple Business Manager. The first blogpost written was about Setting up Apple Business Manager for use with Azure Active Directory and covered the steps to request access to Apple Business Manager, and how to setup and integrate ABM with Azure Active Directory, so that you can authenticate to ABM using your Azure AD account. We will also setup synchronization of our Azure AD accounts to ABM which from that point forward will be managed Apple IDs. The second article was about Connecting Microsoft Endpoint Manager to Apple Business Manager  and covered connecting ABM to Microsoft Endpoint Manager/Intune so that we can enable Automated Device Enrollment (ADE) for Apple devices running iOS/iPadOS and MacOS in our environment.

In this article we are going to detail the options we have in order to add devices into Apple Business Manager (ABM). These devices, once added can be synchronized with Microsoft Endpoint Manager (MEM) so that we can assign a profile to the devices to be used during Automated Device Enrollment (ADE).

Add devices via Apple device suppliers

Just as with Windows Autopilot, you can let Apple or any participating Apple Authorized Resellers provision devices directly in ABM. If you buy from Apple directly, you can provision the Apple Customer Number to ABM and if you buy devices from a participating Apple Authorized Reseller you need to give them your Organization ID and add the Reseller Number to ABM. You should arrange with your participating Apple Authorized Reseller or carrier to have them submit your orders through their portal to Apple, since this won’t happen automatically.

You can find your Organization ID, by going to ABM, select Settings -> Enrolment Information. Adding Apple Customer Numbers and/or Reseller Numbers you can do this by going to ABM, select Settings -> Device Management Settings.

Customer numbers

See also: Manage device suppliers in Apple Business Manager

Add devices to ABM using Apple Configurator

Besides letting Apple or any participating Apple Authorized Reseller you also have the option to add existing Apple devices to ABM. In order to do this you need an Apple App called Apple Configurator. For iPhone, iPad, iPod touch, and Apple TV devices you can use the Apple Configurator for macOS. For macOS computers you can use the Apple Configurator App for iPhone.

Devices manually added to ABM using Apple Configurator have a 30 day grace period to release the device from Apple Business Manager and therefore also supervised mode and device management.

Apple Configurator in Mac App Store

Setup Apple Configurator on macOS

Once the Apple Configurator App has been installed on a macOS device, it needs to be configured with configuration pointing to the MDM environment which is Microsoft Endpoint Manager in our case. Apple Configurator is capable of much more than described in this blogpost, please read the following guide if you want to know more about its capabilities: Apple Configurator 2 User Guide for mac

Create Apple Configurator enrollment profile

Before we can add the necessary information in Apple Configurator, we must first retrieve the unique URL for our Microsoft Endpoint Manager environment. This URL can be retrieved by going to the Microsoft Endpoint Manager admin center -> Devices -> choose either iOS/iPadOS devices or macOS -> Choose iOS/iPadOS enrollment or macOS enrollment -> and choose Apple Configurator under Bulk enrollment methods.

We first have to create an enrollment profile for Apple Configurator, this can be done by selecting “+Create” under Profiles, this will start the Create Enrollment Profile wizard. On the first page (1) we have to provide a name for the enrollment profile and optionally a description. On the settings page we select to enroll with or without user affinity. If we select Enroll with user affinity we must selected where users must authenticate, this can either be the Setup Assistant or by using the Company Portal.

Create Enrollment Profile

On the Review + create page of the Create Enrollment Profile wizard you can Create the enrollment profile (1). Once the profile has been created it can be selected, and by selecting the Export Profile link, you can retrieve the profile URL which can be copied into Apple Configurator.

Create Enrollment Profile (2)

Make sure that you copy the Profile URL for later use in Apple Configurator.

In Apple Configurator we can add the Profile URL, by starting the Apple Configurator Preferences and selecting the “Servers” tab. Adding the MDM server can be done by clicking on the + sign.

MDM server configuration in ABM

By providing a name and the copied URL from the Microsoft Endpoint Manager admin center we are able to add Microsoft Endpoint Manager as a MDM server in the Apple Configurator configuration.

Configure MDM Server

Once the MDM server has been added it will show up within the Apple Configurator configuration.

MDM server configured in ABM

The enrollment profile, also allows for enrollment of devices (in provisioning mode) without Apple Business Manager, so we can basically use Apple Configurator to put the devices into provisioning mode and start the deployment from there. Since that is not the scope of this article, we will focus only on the steps needed to add the devices to Apple Business Manager. 

Add iPhone, iPad devices using Apple Configurator for macOS

In order for the iPhone or iPad to be added to ABM, it must have network connectivity configurated. This can be accomplished by creating a Profile in Apple Configurator which will configure a WiFi profile and which we will send to the device.

Create WiFi profile in Apple Configurator

You can create a new profile in Apple Configurator by choosing File -> New Profile. Provide the WiFi network details under the Wi-Fi section and safe the profile for later use.

Apple Configurator Profile for WiFi connection

Add device to Apple Business Manager using Apple Configurator

The slideshow below gives an overview of the steps needed to add the iOS/iPadOS device which is connected to the macOS device running Apple Configurator via USB to Apple Business Manager.

Devices need to be wiped in order to be added to Apple Business Manager and it’s activation lock must be turned off, also be aware that in some cases restoring the configuration of the device afterwards will not have the desired effect. I’ve written about this some time ago already.

iOS restore behaviour when re-enrolling devices with backup data into Intune

In the meantime, Microsoft also has provided some guidance on restore scenario’s, which can be found here: Backup and restore scenarios for iOS/iPadOS

Depending on whether this is the first time, the experience is a little bit different compared to successive attempts since during the first time you will be asked to login to Apple Business Manager using an account with at least the role of Device Enrollment Manager, also a certificate will be stored on the device.

  • Once phone is connected to Configurator it will be displayed
  • You can use the “Prepare” optioin to configure the connected device
  • You can configure which MDM Server to use
  • When using for the first time,
  • When using for the first time a new supervision identity must be created, for follow sessions an existing one can be used
  • Define setup assistant options
  • Provide Network Profile with WiFi settings
  • When configuring for the first time, the Certificate trust settings must be modified
  • iPhone gets prepared, step 2 of 4
  • Step 3 of 4
  • Step 4 of 5

Assign device to MDM server in Apple Configurator

Once the iOS/iPadOS device has been added to Apple Configurator, we (by default) need to assign it to a MDM server configuration. In the slideshow below we see how this can be done, and I’ll also show how to automate this if you only have one MDM instance and want to add each added device to the same configuration.

  • Device has been added to Apple Business Manager
  • By clicking on Edit Device Management, we can add the device to one of the configured MDM servers
  • When asked if you are sure, click Continue
  • Verify that device management has changed to the configured MDM
  • After a sync, the device appears in Microsoft Endpoint Manager
  • These steps can be automated, by configuring the Default device assignment under Device Management Settings in ABM

Add macOS devices using Apple Configurator for iOS

The first thing we need to do is install the Configurator App on your iOS device, this is detailed in the slideshow below. See the following link for more information about its capabilities: Apple Configurator User Guide for iPhone

  • Make sure to download the Configurator App from the Apple App Store
  • Sign in with an Apple ID which is at least device enrollment manager in ABM
  • Provide Apple ID, password and MFA
  • Verify configuration
  • Give access to camera

Add macOS devices to Apple Business Manager

Now that the App is installed and you are successfully logged in, you can add macOS devices using this App

  • Make sure the iPhone is nearby the macOS device once reset
  • Make sure to point the camera to the patterne
  • Verify that the Mac has been assigned to the MDM organization
  • The Mac is also added to ABM
  • The Mac is synchronized to Microsoft Endpoint Manager
  • Added devices also show up in the iPhone app

Conclusion

In this article I covered the options to add devices to Apple Business Manager which is either automatically from Apple or any participating authorized Apple reseller or manually by using Apple Configurator. From that point forward the imported devices can be synchronized either by manually assigning an Mobile Device Management server profile to the device or by automatically doing so. This will eventually add the device to Microsoft Endpoint Manager. This paves the way for a next article where I will describe how to create an Enrollment profile which can be used to rollout the devices using Automated Device Enrollment.

References

Apple Configurator 2 User Guide – https://support.apple.com/guide/apple-configurator-2/welcome/mac

Add devices from Apple Configurator to Apple Business Manager – https://support.apple.com/guide/apple-business-manager/add-devices-from-apple-configurator-axm200a54d59/web

Tweet
Follow me
Tweet #WPNinjasNL

1 thought on “Apple Business Manager device import options for later use within Microsoft Endpoint Manager”

  1. Miha Pecnik says:
    October 28, 2022 at 9:21 pm

    Great series, but am I missing a continuation on this topic, as said “his paves the way for a next article where I will describe how to create an Enrollment profile which can be used to rollout the devices using Automated Device Enrollment.”?

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Founding member of:

Recent Posts

  • Azure AD Conditional Access authentication context now also available for Azure AD Privileged Identity Management
  • December 2022 update of the conditional access demystified whitepaper and workflow cheat sheet.
  • Conditional Access public preview functionality reviewed (22H2) – Part 3: Granular control for external user types
  • Conditional Access public preview functionality reviewed (22H2) – Part 2: Conditional Access filters for Apps and Workload Identities
  • Conditional Access public preview functionality reviewed (22H2) – Part 1: Authentication Strength

Books

System Center 2012 Service Manager Unleashed
Amazon
System Center 2012 R2 Configuration Manager Unleashed: Supplement to System Center 2012 Configuration Manager
Amazon
System Center Configuration Manager Current Branch Unleashed
Amazon
Mastering Windows 7 Deployment
Amazon
System Center 2012 Configuration Manager (SCCM) Unleashed
Amazon

Archives

  • February 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • May 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • August 2019
  • July 2019
  • November 2016
  • November 2015
  • June 2015
  • May 2015
  • November 2014
  • July 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • November 2013
  • August 2013
  • April 2013
  • March 2013
  • January 2013
  • December 2012
  • November 2012
  • August 2012
  • July 2012
  • June 2012

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Categories

  • ABM (3)
  • Advanced Threat Protection (4)
  • Announcement (42)
  • Azure (3)
  • AzureAD (65)
  • Certification (2)
  • Cloud App Security (3)
  • Conditional Access (50)
  • Configuration Manager (24)
  • Events (11)
  • Exchange Online (7)
  • Identity Protection (3)
  • Intune (17)
  • Licensing (2)
  • Microsoft Endpoint Manager (35)
  • Mobile Application Management (1)
  • Modern Workplace (65)
  • Office 365 (10)
  • Overview (10)
  • Power Platform (1)
  • PowerShell (2)
  • Presentations (7)
  • Privileged Identity Management (5)
  • Role Based Access Control (2)
  • Security (50)
  • Service Manager (4)
  • Speaking (22)
  • Troubleshooting (4)
  • Uncategorized (11)
  • Windows 10 (14)
  • Windows 11 (4)
  • Windows Update for Business (3)
  • WMUG.nl (16)
  • WPNinjasNL (30)

Tags

#AzureAD #community #conditionalaccess #ConfigMgr #IAM #Intune #m365 #MEM #MEMCM #microsoft365 #modernworkplace #office365 #security #webinar #wmug_nl ATP AzureAD Branding Community Conditional Access ConfigMgr ConfigMgr 2012 Configuration Manager Email EXO Identity Intune Licensing M365 MCAS Modern Workplace Office 365 OSD PIM Policy Sets Presentation RBAC roles Security Service Manager SSP System Center troubleshooting webinar Windows 10

Recent Comments

  • Kenneth on December 2022 update of the conditional access demystified whitepaper and workflow cheat sheet.
  • John Barnes on December 2022 update of the conditional access demystified whitepaper and workflow cheat sheet.
  • Intune Newsletter - 24th February 2023 - Andrew Taylor on Azure AD Conditional Access authentication context now also available for Azure AD Privileged Identity Management
  • Azure AD Conditional Access authentication context now also available for Azure AD Privileged Identity Management | Modern Workplace Blog on A first look at Azure AD Conditional Access authentication context
  • Kenneth on Intune: Choosing whether to assign to User or Device Groups

This information is provided “AS IS” with no warranties, confers no rights and is not supported by the author.

Copyright © 2021 by Kenneth van Surksum. All rights reserved. No part of the information on this web site may be reproduced or posted in any form or by any means without the prior written permission of the publisher.

Shorthand: Don’t pass off my work as yours, it’s not nice.

©2023 Modern Workplace Blog | Powered by WordPress and Superb Themes!
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Cookie settingsACCEPT
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Non-necessary
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
SAVE & ACCEPT