Unboxing a new laptop and having it configure itself sounds like a small thing, until an IT team has done it the manual way a hundred times. Apple Business Manager is the piece that makes the automatic version possible, linking a company’s device purchases directly to its device management setup so a machine can walk itself through most of onboarding before anyone in IT lifts a finger. Here’s how the mechanics work under the hood, and what shifts once a fleet runs on it.
A Quick History Worth Knowing
This wasn’t always one tool. Apple originally ran a separate Device Enrollment Program, often shortened to DEP, purely for automatic enrollment. In 2019, Apple folded DEP into the wider Automated Device Enrollment framework and tied it to Apple Business Manager on the enterprise side and Apple School Manager for education.
The rename wasn’t cosmetic. Consolidating the programs meant one dashboard could handle enrollment, purchasing, and identity together instead of three separate systems that barely talked to each other. For an IT team managing a few hundred devices across offices, that consolidation alone cuts down on a fair amount of back and forth between admin consoles.
Getting Set Up Isn’t Complicated
Signing up is free, which surprises a lot of first-time admins. A company needs a D-U-N-S number, a nine-digit identifier used to confirm a business is real, and confirmation that it operates in a country Apple supports for the program. From there, an account gets created and linked to purchases made directly from Apple or an authorised reseller.
That last part matters. Devices bought secondhand or through unofficial channels generally won’t qualify for automatic linking, which is a detail worth checking before a bulk order goes out.
What Happens the Moment a Device Turns On
Automated enrollment kicks in the second a new device connects to Wi-Fi during setup. It checks in with Apple’s activation servers, confirms it’s tied to the company account, and pulls its enrollment profile from whichever MDM platform the business runs, whether that’s Jamf, Intune, or another vendor.
From there, setup screens get skipped, security policies apply automatically, and required apps install themselves. An employee opens the box, connects to the internet, and is working within minutes rather than waiting on a support ticket.
Where Apple Device Management for Business Draws the Line
Not every device gets treated the same way, and that’s deliberate. Apple Device Management for Business splits into two models depending on who owns the hardware.
Company-owned devices typically run under supervision, which unlocks the deepest level of control. IT can push software updates on a schedule, enforce complex passcodes, and remotely wipe a lost device. Personal devices used for work lean on a lighter model called User Enrollment instead, which keeps corporate data in a separate, encrypted space and leaves personal photos, messages, and location completely untouched.
Mac for Business Fleets Have Their Own Quirks
Rolling out Mac for Business hardware at scale looks slightly different from iPhones and iPads. Machines with Apple silicon or the older T2 security chip can be added to the enrollment program even after purchase, using Apple Configurator run from a paired iPhone.
That flexibility helps companies that already owned a batch of Macs before adopting the program properly. There’s a thirty-day window after enrollment where a device can still be released from management if something was set up incorrectly, which gives IT a reasonable safety net during the transition.
A Few Things That Catch Teams Off Guard
Mixed fleets are the most common snag. The framework only covers Apple hardware, so Windows machines need a separate parallel tool, with both feeding results into one MDM console.
New admins sometimes treat the whole system as if it were the MDM itself, when it’s closer to a directory that an MDM platform draws from. And devices already in daily use need a full factory reset before they can join the program properly, which is worth planning around rather than discovering mid-rollout.
Before Enrolling a Fleet
- Confirm every purchase channel qualifies for automatic linking before ordering in bulk.
- Pick and configure an MDM platform ahead of the first enrollment, not after.
- Map out which devices need supervision and which fall under a lighter BYOD model.
- Budget time for factory resets if adding devices bought before the program was set up.
Conclusion
None of this removes IT from the picture entirely. Someone still has to configure policies, choose an MDM, and handle exceptions. What changes is where that effort goes. Instead of touching every device by hand, a team sets the rules once and lets each new machine apply them on its own the moment it’s switched on.
For a company adding new hardware every month, that difference adds up fast. Fewer support tickets on day one, fewer misconfigured laptops circulating, and a much shorter list of things that can go wrong before an employee even logs in for the first time.
