Skip to main content

071: ABM Provisioning

Implementation Effort: High

User Impact: Medium to High

Overview​

For corporate-owned Apple devices, Automated Device Enrollment through Apple Business Manager or Apple School Manager is usually the preferred provisioning model. It lets devices enroll into Microsoft Intune during initial setup, supports supervised management, and gives administrators stronger control over required apps, configuration, and security posture from day one.

This is a strong Zero Trust starting point because corporate-owned devices can be brought under management before the user begins normal work.

Implementation Guidance​

  1. Connect Apple Business Manager to Intune using the enrollment token and validate synchronization of device records.
  2. Import and assign devices in Apple Business Manager so the correct devices are available for Intune enrollment.
  3. Create an Automated Device Enrollment profile in Intune that defines setup-assistant behavior, whether user affinity is required, supervision, and any shared-device considerations.
  4. Decide which required apps, compliance policies, certificates, Wi-Fi, and VPN profiles must be available as early as possible in the provisioning flow.
  5. Pilot wipe-and-reprovision scenarios, replacement devices, and reseller-assigned devices. Enrollment strategy is incomplete if only the happy path works.
  6. Keep terminology current: use Automated Device Enrollment and Apple Business Manager, not older DEP branding except where historical mapping is needed.

Reference​