Apple Business Manager and Automated Device Enrollment: The Foundation for Zero-Touch Mac

Zero-touch Mac deployment gets explained as an MDM feature, but the MDM is the last layer to arrive. What actually makes a Mac enroll supervised, the moment it first connects to Wi-Fi, is Apple Business Manager and Automated Device Enrollment sitting underneath it. After setting this up for fleets that grew past a thousand devices, here is how to build that foundation so the MDM work on top of it is boring in the best way.

Stand up Apple Business Manager properly

Apple Business Manager (ABM) is the portal where Apple, your reseller, and your MDM meet. A few decisions at setup save pain later:

• Federate with Entra ID. Link ABM to Microsoft Entra ID so Managed Apple Accounts map to your existing identities and users sign in with credentials they already have.
• Use real roles. Give people Administrator, Device Enrollment Manager, or Content Manager scoped to what they do. The single shared super-admin login is a finding waiting to happen.
• Model your locations. Locations in ABM drive volume app purchasing and token boundaries — get the structure right before you buy apps against them.

Connect your purchase channel

The point of ADE is that devices show up in your MDM automatically because Apple knows you bought them. For that to work, add your Apple Customer Numbers and every authorized reseller’s Reseller ID to ABM. From then on, anything bought through those channels appears in ABM within a day or two, ready to assign. Devices bought from a retail store or a channel you have not linked will not appear — plan for that exception rather than being surprised by it.

MDM server tokens and the annual clock

In ABM you create one or more MDM servers, each representing a connection to Jamf, Intune, or another platform. You download a token from ABM, upload it to the MDM, and that pairing is what lets the MDM claim devices. Two things to record on a calendar the day you do this:

• The MDM server token expires yearly. Renewing is a quick download-and-upload, but if it lapses, new devices stop flowing and existing enrollments can be disrupted.
• The APNs certificate is separate and also annual. Different portal, different expiry, same catastrophic result if it lapses — every Apple device you manage goes dark.

Device assignment: default versus deliberate

You can set a default MDM server so all new devices of a type land there automatically, or assign devices manually by serial number or order number. For a single-MDM shop, a default assignment is the least error-prone choice. If you run more than one MDM — say Jamf for Macs and Intune for iPhones — assign by device type and audit the unassigned list weekly so nothing sits in limbo.

Shape the first-boot experience

Enrollment customization lets you decide which Setup Assistant panes a user sees. Skip the ones that create support tickets — Apple ID sign-in, Screen Time, Siri, data and privacy walls of text — and keep the experience to signing in and reaching the desktop. You can also show a branded enrollment screen with your own text and logo so the user knows the machine is genuinely theirs to use, not a mistake.

Supervision, Activation Lock, and what release does not do

Devices enrolled through ADE are supervised and have non-removable management — a user cannot unenroll to escape policy. Activation Lock becomes something you manage rather than something a personal Apple ID controls, which matters enormously when an employee leaves with a laptop still locked to their account. One common misconception worth stating plainly: removing a device from ABM does not wipe it or unenroll it. Release is an ownership record change; decommissioning is still a separate deliberate step you perform in the MDM.

Handling out-of-channel devices

For Macs bought outside your linked resellers, Apple Configurator can add them to ADE manually: connect or use the iPhone app to assign the device to your organization. The user gets a 30-day provisional period during which they can remove that enrollment, after which it behaves like any other supervised device. It is more friction than channel purchases, so steer buying back through your reseller wherever you can.

Bottom line

Apple Business Manager and Automated Device Enrollment are the plumbing that makes zero-touch possible: federate identity, link every purchase channel, guard the two annual tokens like production credentials, assign devices deliberately, and trim the Setup Assistant to the essentials. Get this layer solid and every MDM decision above it — Jamf or Intune — becomes simpler and more predictable.