You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Solution for Small Business

I currently have a few Apple devices in my small business, used by my designers. I just purchased a new Mac mini and I'd like a streamlined solution so that they can all connect and share easily (via AirDrop, handoff, etc). Currently I have the devices signed into my personal Apple ID, however this solution gets confusing when talking to multiple Macs. I would also like my employees to be able to talk easily to their own personal devices that they may use for taking photos of jobs etc and need to transfer data to the Mac (rather than emailing all the time).

I'm interested in ABM/ABE however it's not perfectly clear whether this will provide what I need. Otherwise I suppose the next answer is to just register the device under each employee's ID and reset it if they leave.


I also perform all of my business through my own Apple ID (on my Mac, iPhone, iPad), so if I use a new email for ABM, will I still be able to connect my personal ID and continue using my devices seamlessly?


Any feedback would be greatly appreciated.

Mac mini, macOS 10.13

Posted on Feb 5, 2024 10:03 PM

Reply
Question marked as Top-ranking reply

Posted on Feb 8, 2024 11:07 AM

Step 3:  If you need to use Apple IDs, consider using Managed Apple IDs created in ABM.  As noted above, these can be manually created or you can link to your identity provider and have them created automatically.  Managed Apple IDs do have limitations so be mindful of that.  It is worth reviewing this document to ensure that Managed Apple IDs will work for you.




Step 4:  Collaboration.  In your question, you state "I'd like a streamlined solution so that they can all connect and share easily (via AirDrop, handoff, etc)."  AirDrop requires no significant setup. Handoff is linked to Apple IDs.  See above on cautionary advice regarding personal Apple IDs.  If you are talking about document sharing, then this is a different conversation.  Avoid physical file servers are their day has passed. If you are Microsoft, use Teams sites synced via OneDrive.  If Google, use Google Drive.  If neither, consider Dropbox or Box.  




To paint a picture of what is possible, you can have a solution where you can have equipment shipped directly to your new employee.  The employee powers the unit on, answer very basic questions like language and country, joins the device to a network, and then allows automated enrollment.  Everything can be delivered to the device, including apps, profiles, data, FileVault, etc.  The employee does next to nothing other that provide authentication for apps and services.




With the MDM, devices can be locked or remote wiped.  New apps or updates can be delivered automatically.  The OS updates can be deferred or enforced.




And return to service is as easy as erasing and re-enrolling.




Hope this is helpful.

Similar questions

2 replies
Question marked as Top-ranking reply

Feb 8, 2024 11:07 AM in response to Strontium90

Step 3:  If you need to use Apple IDs, consider using Managed Apple IDs created in ABM.  As noted above, these can be manually created or you can link to your identity provider and have them created automatically.  Managed Apple IDs do have limitations so be mindful of that.  It is worth reviewing this document to ensure that Managed Apple IDs will work for you.




Step 4:  Collaboration.  In your question, you state "I'd like a streamlined solution so that they can all connect and share easily (via AirDrop, handoff, etc)."  AirDrop requires no significant setup. Handoff is linked to Apple IDs.  See above on cautionary advice regarding personal Apple IDs.  If you are talking about document sharing, then this is a different conversation.  Avoid physical file servers are their day has passed. If you are Microsoft, use Teams sites synced via OneDrive.  If Google, use Google Drive.  If neither, consider Dropbox or Box.  




To paint a picture of what is possible, you can have a solution where you can have equipment shipped directly to your new employee.  The employee powers the unit on, answer very basic questions like language and country, joins the device to a network, and then allows automated enrollment.  Everything can be delivered to the device, including apps, profiles, data, FileVault, etc.  The employee does next to nothing other that provide authentication for apps and services.




With the MDM, devices can be locked or remote wiped.  New apps or updates can be delivered automatically.  The OS updates can be deferred or enforced.




And return to service is as easy as erasing and re-enrolling.




Hope this is helpful.

Feb 8, 2024 11:06 AM in response to v10ferrari

You have a lot to unpack here. First, some cautionary statements.


1: You should not be using your Apple ID on all of the devices. This runs the risk of your employees having access to your personal information with a simple flick of a toggle. (System Settings > iCloud account > iCloud > Show More Apps... > enable stuff they should not see, like email, contacts, etc).


2: If you do not want to risk activation locked devices and data leakage, do not let your employees use personal Apple IDs. This includes Apple IDs the employee creates using your company domain. If the employee created the ID, it is a personal ID. They take the ID with them when they leave. And all the data associated to the ID goes also. Regarding activation lock, if the employee uses a personal Apple ID and enables Find My, then the hardware is linked to the employee's personal Apple ID. If the employee leaves and does not release the device from Find My, you have a brick. This idea: "register the device under each employee's ID and reset it if they leave" is a really bad one. You will not have access to the password or the MFA token if the ID used is a personal Apple ID.


3: An MDM makes managing the Apple platform easy. Managing an Apple platform with an MDM is hard. This is not to discourage. But please understand that managing an MDM is more than clicking a few buttons. There are a lot of topics that you should know and understand, ranging from configuration profiles to packaging software to writing scripts. Do your research and pick an MDM that matches your needs. If you need help, there are plenty of consultants that can help (do a search on the Apple Consultants Network website for Apple certified consulting partners in your area (or beyond)).


4: Apple Business Manager (ABM) is NOT an MDM. Apple Business Essentials (ABE) is. ABM is the cornerstone to Apple platform management. ABM provides three main features: chain of custody of hard assets, chains of custody of soft assets available via the App Stores, and identity trust and management through the Managed Apple ID infrastructure. ABM is all about a legal trust between your business entity (NOT you the person) and Apple. ABM allows hardware assets purchased through the proper channels to be automatically associated to your business entity. In conjunction with an MDM, this leads to automated enrollment and management and powerful theft or loss mitigation. Regarding soft assets, you can volume license/purchase apps from the App Store and with an MDM deliver the apps to your devices automatically. No Apple ID required on the device. And finally, identity. ABM allows the creation of Managed Apple IDs. These IDs are controlled by the business and can be recovered when an employee leaves. This means that you can protect your intellectual property (data) when you have a separation. Optionally, if your mail is with Microsoft or Google, you can Federate ABM to your identity provider and sync accounts automatically. This allows you to create a new email account and that automatically makes a Managed Apple ID. With Federation, the authentication is passed to the identity provider, allowing for single sign on. The cautionary statement here is that ABM is the start of your path, not the destination.


This leads to your questions. The answers can be pages long but I will focus on a recommendation.


Step 1: sign up for ABM. The service is provided for free from Apple. You will need a DUNS number which Apple or an Apple consultant can look up. Or ask your accountant. Once ABM is setup, you should purchase all new equipment through proper sales channels. These include going to the Apple Retail store and asking for the Business Sales Team, working with a DEP-capable Apple reseller, and most nationwide cellular providers (Verizon, AT&T, Singular, etc). The key to automation is to avoid retail purchases. The retail channel cannot participate in the chain of custody. (granted, you can use Apple Configurator to side load retail purchases, but it is a pain and a waste of time considering it could all be done for you if you buy properly). You existing devices will not be included in this unless you erase them.


Step 2: Select an MDM. There are many out there. Again, consider using a consultant to help define your needs which should result in a properly selected MDM. If you are heavy on the Mac side, make sure you pick one with a cloud distribution point. Also, since you said you have designers, I assume you are using Adobe products. Make sure the MDM can support the huge .pkg.zip installers that Adobe provides for their products. Some names to look at are Jamf Pro, Mosyle, ABE, Intune, and many more.


Solution for Small Business

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.