Skip to main content

173: AMB provisioning

Overview​

Provisioning macOS devices using Apple Business Manager (ABM) in Microsoft Intune streamlines device management and enhances security. Here's a detailed overview:

Steps to AMB Provisioning​

  1. Set Up Apple Business Manager (ABM):

    • Ensure your organization is enrolled in Apple Business Manager.
    • Link ABM with Microsoft Intune by obtaining an Apple MDM push certificate.

  2. Add Devices to ABM:

    • Purchase devices through an authorized Apple reseller and assign them to your ABM account.
    • Alternatively, manually add existing devices to ABM.

  3. Configure Enrollment Program Token:

    • In the Intune admin center, navigate to Devices > Enroll devices > Apple enrollment > Enrollment program tokens.
    • Create a new token and upload the server token file from ABM.

  4. Assign Devices to Intune:

    • In ABM, assign the devices to the MDM server token created in Intune.
    • This ensures that devices are automatically enrolled in Intune when they are turned on and connected to the internet.

  5. Create and Assign Profiles:

    • In Intune, create an enrollment profile specifying the settings and configurations for the devices.
    • Assign this profile to the devices in ABM.

  6. Deploy Devices:

    • Distribute the devices to users. When they turn on the devices, they will automatically enroll in Intune and receive the assigned configurations.

Benefits​

  • Automated Enrollment: Devices are automatically enrolled in Intune, reducing manual setup time.
  • Enhanced Security: Ensures devices are managed and compliant with organizational policies from the moment they are activated.
  • Streamlined Management: Simplifies the deployment and management of macOS devices across the organization.
  • Consistency: Ensures all devices have a consistent configuration and security posture.

Drawbacks​

  • Initial Setup Complexity: Setting up ABM and integrating it with Intune can be complex and time-consuming.
  • Dependency on Apple: Requires purchasing devices through Apple or authorized resellers to take full advantage of ABM.
  • Limited to Corporate Devices: Primarily designed for corporate-owned devices, not suitable for BYOD scenarios.

Possible Impact on End Users​

  • Seamless Setup: Users receive devices that are pre-configured and ready to use, reducing setup time.
  • Learning Curve: Users may need initial guidance on new policies and procedures.
  • Enhanced Security: Users benefit from improved security measures, reducing the risk of data breaches.

Tying to Zero Trust​

Provisioning macOS devices with ABM in Intune aligns with Zero Trust principles by:

  • Continuous Verification: Ensures that devices are continuously verified and compliant before granting access.
  • Conditional Access: Enforces policies that require devices to meet security standards.
  • Least Privilege Access: Limits access to resources based on user roles and compliance status.

Reference​