Apple Business Manager setup for Indian companies

A 90-person design and engineering firm in Andheri bought forty Macs from a local reseller. On rollout morning, not one of them showed up in the portal.

Day 1 of the Andheri rollout. 9:40 AM.

Forty Macs on the floor, cartons already opened, packaging gone to the basement. The MDM console was configured. The Wi-Fi payload was tested on a spare unit the previous week. And the device list in the portal said zero.

I am Arjun. I have set this up for four Apple fleets now. This is the one I learned the most from, mostly because the mistake was mine.

The name changed, and the guides did not

Start here so the rest makes sense. Apple Business Manager is now Apple Business, and Apple has folded Apple Business Manager, Apple Business Essentials and Apple Business Connect into one thing. The portal is still business.apple.com. Your bookmarks still work.

Everybody in India still calls it ABM, including me, including your reseller. So if a vendor sends you a deck with the old name on it, that tells you nothing except that they made the deck last year.

Part one: the account, and the verification that can delete you

Sign up with a work email address that has never been used for iCloud, the App Store, or any other Apple service. That address becomes your first administrator account. Use a legal first and last name, not a job title. Apple checks.

Then verification, which is the part people underestimate. You enter your organisation’s D-U-N-S number and the name, email and job title of a verification contact. A real person at Apple then calls that contact and confirms your organisation exists.

This is where Indian applications stall.

The D-U-N-S record has to match your MCA registered name and address character for character. Private Limited written one way in Dun and Bradstreet and another way on your incorporation certificate is enough to stall the review. Most Indian companies discover their D-U-N-S record still carries the office they left in 2021.

The verification contact must actually answer the phone. Put your CFO or a director in that box, then tell them Apple will call from an unknown number. Achha, and check that the spam filter allows every apple.com domain.

And the review has a window. If your organisation is not approved inside it, Apple deletes the organisation and its data, and you start again. You start again from the sign-up page with a fresh email address.

Part two: the step that emptied my portal

Now the reseller step, which is the one that cost me a week in Andheri.

Devices only appear in Apple Business automatically if two things are true. Your Apple Customer Number or Reseller Number is linked in the portal under Devices, then Inventory. And your reseller put your organisation’s ID on the actual purchase order. Both. Not one.

Small detail worth knowing: when you type the Apple Customer Number, drop the leading zeros. It rejects them silently.

My mistake was assuming. The reseller told me they do this all the time. I took the sentence at face value. What I should have asked for was the order confirmation showing our organisation ID on it. Forty machines shipped against an order with nothing linked. Bas. No error message, no warning, just an empty list at 9:40 on a Monday.

Ask for that confirmation before the PO is released. It is one email. It now sits in the purchase checklist for every Apple order that runs through our device lifecycle management practice. Cheaper to ask a question than to fix forty laptops by hand.

What the Apple Configurator retrofit actually costs you

There is a rescue path, and it costs you something.

Apple Configurator lets you add devices that were not bought through a linked supplier. It covers iPhone, iPad, and Mac computers with Apple silicon or the Apple T2 chip running macOS 12.0.1 or later. You touch each device once, it enrols, and after that it behaves like any other managed machine with supervision applied.

Then the part your reseller will not raise. Apple gives the user a 30-day provisional period to release that device from Apple Business, from supervision and from your MDM console. Thirty days of an exit door on every machine you just rescued.

For most offices that is a theoretical risk. For a design firm holding client artwork and personal data under the DPDP Act, it is a governance gap you cannot honestly report as closed for a month. And the DPDP Act does not care that the reseller forgot a field.

We worked through all forty over two evenings. Pakka boring work, and the operations head was very kind about it, which somehow made it worse.

The math: which enrollment method for which device

Once the devices are in, you still have to pick how they enrol. This is the table I now draw on a whiteboard before any Apple rollout, and it is drawn from Apple’s own enrollment methods documentation.

Two rows carry the argument in most rooms. The BYOD row, because user enrollment leaves you unsupervised and unable to wipe a device, which is a very different conversation with a DPO than people expect. And the Auto Advance row, because Apple’s deployment guide is clear that it needs an active Ethernet connection during first configuration. Half the offices I walk into no longer have a wired port on the imaging bench.

Part three: the MDM link, and the clock nobody diarises

The connection itself is mechanical. In the portal, go to Devices, then Management Services, and create a new service. Download the public key from your MDM, upload it to Apple, download the service token Apple gives you, upload that token back into the MDM, then sync.

If you run Microsoft Intune, the sequence is the same with Microsoft’s names on it. Intune needs an active Apple token and an Apple MDM push certificate, and it expects devices to be new or wiped before they enrol.

Now the clock. That service token expires after one year. Some MDM consoles warn you. Some do not. Nobody remembers a date they set once, twelve months ago, during a rollout week.

Put the renewal in a shared calendar the day you create it, with a reminder thirty days out, owned by two people. Do the same for the Apps and Books token and the MDM push certificate. Every stalled Apple fleet I have been called into had a token that died quietly in the background while everyone assumed the console was fine.

And the objection I hear at this point, usually from the founder rather than the IT lead: we are only fifty devices, we do not need MDM. Fifty is exactly the size where one lost laptop is a real problem and nobody has a system for it yet. DPDP does not have a headcount exemption, so device governance applies to you the same as it applies to the 2,500-device shop, just cheaper to set up now than to retrofit after an incident. Small is the right time to do this, not the reason to skip it. If you want the numbers behind that, we broke down what MDM actually costs an Indian business in a separate piece.

If you are setting this up yourself

This is the order I would run it in, and roughly what each part takes.

Pull your D-U-N-S record first and compare it line by line against your incorporation certificate. Fix mismatches with Dun and Bradstreet before you touch Apple, because that correction is the long pole and it can run into weeks.

Create the account with a clean work email and a named human, then immediately add a second administrator. Nominate a verification contact who answers unknown numbers.

Before any purchase order goes out, get your Apple Customer Number or Reseller Number into the portal. Then get written confirmation from the reseller that your organisation ID is on the order. This is the step I skipped. Do not skip it.

Connect the MDM, then test exactly one device end to end before the shipment arrives. Erase it, power it on, watch Setup Assistant show your enrollment screen, confirm the profile lands. One device on a quiet afternoon tells you more than forty devices on a busy Monday.

Write down every token expiry date in a place two people can see. Then write down who calls whom when a device fails to enrol at 6 AM, because somebody will ask that question at the worst possible moment.

Last one. Decide your enrollment method per device type before you order, not after the cartons land. Changing your mind afterwards means erasing machines that people are already working on. We have shipped enough of these to know that the erase always happens on the day the client has a deadline. For the fuller picture of how this fits everything from procurement through to disposal, our note on what device lifecycle management actually covers walks through the whole cycle.

* Apple changes its deployment documentation regularly and minimum operating system versions move with each release. Confirm current requirements in Apple’s guides before you plan a rollout window.