Skip to main content

173: AMB provisioning

Implementation Effort: Medium
User Impact: Medium

Overview​

For corporate-owned Macs, Apple Business Manager (ABM) with Automated Device Enrollment (ADE) is the preferred provisioning model for Microsoft Intune. It provides a controlled out-of-box experience, ensures the device enters management during setup, and reduces the chance that security controls are bypassed before the user reaches production resources.

Within Zero Trust, ADE supports a stronger trust chain because the device identity, enrollment ownership, and first-run configuration are established in a predictable and supportable way.

Implementation Guidance​

Prepare the Apple and Microsoft prerequisites​

  • Maintain a valid Apple MDM push certificate and connect Intune to Apple Business Manager using an enrollment token for Automated Device Enrollment.
  • Ensure corporate-purchased Macs are assigned in ABM to the correct MDM server and reviewed before shipment to users.
  • Decide which Setup Assistant screens should be shown or skipped and whether modern authentication or Company Portal sign-in is required for the user journey.

Create and assign the enrollment design​

  • Create macOS ADE enrollment profiles in the Microsoft Intune admin center and scope them to the correct device groups or token assignments.
  • Align ADE with downstream requirements such as FileVault, Platform SSO, Defender for Endpoint, and software update policy so the device reaches a secure state quickly after first sign-in.
  • Pilot with new devices and with wiped-and-reprovisioned devices to validate the full lifecycle experience.

Operate the provisioning process​

  • Monitor token expiration, ADE profile assignment success, and first-run enrollment failures as part of standard service operations.
  • Use documented warehouse or reseller workflows so devices are not shipped before ABM assignment is complete.
  • Establish a fallback plan for exceptions such as repair replacements or preexisting Macs that were not purchased through standard channels.

Reference​