Apple School/Business Manager and MDM

[FWBD]

I've setup ASM a few years back and used it happily with Intune (and previously Lightspeed) but have now been tasked of setting up ABM at a new place I am working at and wanted to just make sure what I had done in a previous life was the correct way or if things have moved on since.

 

To my understanding you are best using ABM/ASM running tandem with a MDM solution like Intune, Lightspeed, etc to get the full functionality and management features on your Apple devices? I've seen people mention about using ABM/ASM on its own but my previous experience of this is that you don't get much in terms of control on the devices.

 

Also off the back of this whenever I worked on MacOS or iOS devices with this setup we always had to wipe the device before putting it on the system so that it puts it in a 'supervised' mode otherwise you can't do much with the device. Is this actually the case still or can devices be enrolled with full control without having to wipe them?

 

I'm making this post as more of a sounding board to make sure I'm not going mad and that I do understand the setup here but if any could correct me or confirm with me what I've got then that would be great.

 

As always you are all amazing and I welcome any feedback or ideas

[sideone]

>Is this actually the case still or can devices be enrolled with full control without having to wipe them?

 

Usually it depends on how the devices show up in School Manager. When we purchase our iPads from a reseller, they get added to ASM automatically via Apple Enrollment. You then assign the MDM to the device in ASM, it appears in the MDM as supervised. If the devices don't show up in ASM, you need to manually wipe and add them via a Mac and Apple Configurator 2. They then show up in ASM to be assigned to the MDM.

 

I think you'd have to wipe the device to get it to pick up the new configuration and add itself to the MDM, however.

[Disease]

>Is this actually the case still or can devices be enrolled with full control without having to wipe them?

 

Usually it depends on how the devices show up in School Manager. When we purchase our iPads from a reseller, they get added to ASM automatically via Apple Enrollment. You then assign the MDM to the device in ASM, it appears in the MDM as supervised. If the devices don't show up in ASM, you need to manually wipe and add them via a Mac and Apple Configurator 2. They then show up in ASM to be assigned to the MDM.

 

I think you'd have to wipe the device to get it to pick up the new configuration and add itself to the MDM, however.

 

This exactly, we do the same, any devices get added to ASM, they are then automatically picked up in Intune where we manage them. Only really ever use ASM to get new Apps other than that it's all ported into Intune.

[Michael]

I've always considered ASM as the bottom slice of management - where devices are registered to the organisation, as well as Apps purchased for the organisation.

 

The MDM receives all this configuration and allows you to deploy/customise the user experience.

[Brimstone]

I've setup ASM a few years back and used it happily with Intune (and previously Lightspeed) but have now been tasked of setting up ABM at a new place I am working at and wanted to just make sure what I had done in a previous life was the correct way or if things have moved on since.

 

To my understanding you are best using ABM/ASM running tandem with a MDM solution like Intune, Lightspeed, etc to get the full functionality and management features on your Apple devices? I've seen people mention about using ABM/ASM on its own but my previous experience of this is that you don't get much in terms of control on the devices.

 

Also off the back of this whenever I worked on MacOS or iOS devices with this setup we always had to wipe the device before putting it on the system so that it puts it in a 'supervised' mode otherwise you can't do much with the device. Is this actually the case still or can devices be enrolled with full control without having to wipe them?

 

I'm making this post as more of a sounding board to make sure I'm not going mad and that I do understand the setup here but if any could correct me or confirm with me what I've got then that would be great.

 

As always you are all amazing and I welcome any feedback or ideas

Once you have ASM/ABM in place (one of these not both of them) then the process is very much the same, create MDM instance and name, exchange public/private tokens from MDM with ASM/ABM Add APNS token, add/VPP content token from ABM/ASM to your choice of MDM.

 

You will need an MDM there is no way to manage devices in ABM/ASM

 

If it's ABM the one thing you will also have to do is add the DUNS number from your company.

 

The whole set up guide is below..

 

https://support.apple.com/en-gb/guide/apple-business-manager/axme0f8659ec/web