Apple Business Is Live: What MSPs Need to Know (And What’s Actually Free)

This is the new Apple Business. It used to be Apple Business Manager, and it looks radically different. There’s a lot more here just in general that talks about how you should be branding your things. Like, it’s a lot more marketing focused to this this UI because you it’s got all the things of how to promote your local business, how to claim your location, how you can manage your users, tap to pay, view all your devices, making your brand visible to customers, and getting ready. So there is a lot here in this first page. The Apple Business Addiglance, you know, kinda tells you overall that it’s the new all in one platform. It’s for businesses of all size. And I think it’s their it helps a lot of people who are especially on that smaller end, but they really are pushing the need to reach more customers and give your team the tools and get support all in a singular location. So you have device management, which was in Apple Business Manager already. Locations is new to Apple Business. This was something that you used to use Apple Business Connect for. Identity and access, it’s just managing managed Apple accounts, having the federation of it. That was in Apple Business. Content distribution is Apple apps and books. That was in Apple Business Manager. And new things like the manage Apple account iCloud storage, this is new to Apple Business. It used to be part of Apple Business Essentials, which was a paid for add on to Apple Business Manager. Now it’s free. And brand management, where can you have your logo? They have a few examples here of, like, you know, in tap to pay in the Apple Wallet or different applications or in the Apple Maps. Branded mail, I think that’s what this is showing is an email, And AppleCare Plus. So you can buy AppleCare Plus and have the coverage and all of this stuff in one singular tool. So their whole thing is as your organization grows, Apple Business scales with you. That’s a really big thing that they are really kinda planting that seed as it were. Account. You go through the verification. So here’s how you sign up. Right. So after you sign up, anyone can sign up. You have sixty days to verify that you’re a real organization, and you need two methods, and it takes five business days to complete. They no longer call you. Back in the day with Apple Business Manager, you got a phone call from Apple, and they asked who you were, and they asked, like, basic questions about your business. Now you can still use a D U N S number. That is still a thing, but you can also use an employer identification number. You could use, for the domain validation, you have to have a text record in your DNS server, but there are a lot of business IDs. So I’m gonna go here. And oh my god. Depending on what country you’re in so if you are in let’s choose a country. Let’s say Canada. If you are in Canada, you can use your federal corporation number. This explains what it is. If you are in Denmark, you can use your company house registration number. So depending on or a CVR. Depending on how what country you’re in, you can use however you are registered as a business within your country, and and they give you different different options and what exactly they are and where they are. So the D U S number is no longer a hard requirement. The EIN, there’s this very important or that’s doing a lot of work. You also need to upload one of these official documents, a business license, a sales tax permit, a food health or alcohol permit, a lease or property agreement, utility bill, or other. Other is doing a lot of work there as well. So, and you can go through and repeat the process every time. So every you have to do two. You choose your first. You choose any one of these, and then you do it again for the second and send to review. If they have questions after five business days, although that may change depending on how busy they are, they will reach out or or give you your role. I’m logged in here as an organizational administrator for this business. I have a few backup logins, but this is an organizational admin view. Each view will have different things. So, like, my staff members won’t be able to log in to Apple Business at all. So there’s different roles that are included in Apple Business. It remembered. So it automatically fills in the managed Apple account. So this is gonna be the username, and this is gonna be the domain. This is their managed Apple ID, and there’s a lot of different roles. So there’s the org. Oh, that’s a terrible UI. See how it flips. As all our features, this is what I am. You have a people manager. This is how they manage specific organization units within here, Apple Business, device enrollment manager. You can manage devices and device management services. This is assigning to MDM profiles or handling the built in management. Content manager is the apps and books, the volume purchasing. Apple still uses that word of buying a lot of licenses, and they manage licenses for things within their organizational unit. Staff are just employees who can use Apple devices and services managed, but they cannot sign in to Apple Business. IT admin is people who can manage people, devices, licenses. So it’s kind of a few different things. They can be assigned to organizational units if you need to limit their access. So that’s like a combo thing. Marketing admin is a new one as well. You can manage all the brands, locations, associated features, and an API user because Apple Business comes with a fully expanded API. So those are all the different roles for Catherine. Let’s make her an IT admin. And you enter the phone number. These are optional. You can enter in job title, manager. You know? I think she’s a VP. She’s my manager, or I’m her manager rather in here. You’re gonna have a start date, employee number, cost center, division, all of these things depending on what the business requires. When that’s created, it’s still the world’s slowest website. You can either send an email invite to them, create a sign in. You can also re reset their MFA if they ever have issues, get a new phone number, something like that. You can see their managed Apple account. Their contact email in this case is the same, what their roles are, and all of the stuff that we’ve just seen. We’ve seen that they have not signed in yet. So and the way to do that is to create a little sign in. There is a whole you know, creates a temporary password, and all the the Apple services will already be configured. So that is how that works. Devices. I’ve got a few devices in here, and this one is in built in management. You can see here, built in management. I have a few others that are unassigned or this one I released. So that is still the same. This looks very similar to Apple Business. The new thing is the built in device management. If you are not using the built in device management, you can go here and assign it. There’s all of my Addigy servers and right here, the built in, which is what I’m using. It doesn’t have its own name. It’s just called built in device management. The other thing that is unique here is this is the AppleCare plus. So I can see that this one has AppleCare plus already assigned to it. This is not from my business, though. But the warranty information is in here along with other details about the devices. It does not have activation lock turned on, which is why this is off. They can’t it’s grayed out. For something else, an iPad or iPhone rather, This is unassigned, so it shows no service here. It has the information to highlight the difference here of when it’s coming through the business versus when it’s coming just from the device itself. This was something that was purchased with the device and then will become eventually I AppleCareOne. So you can differentiate between the two when it was added to Apple Business Manager and or Apple Business and all of the things. So for this one, we’re going to assign it to the built in management. You get this are you sure? So this is gonna take effect the next time the device uses automated device enrollment in setup assistant, so the next time the device is wiped. And this process will continue even if you close this window. So you hit close, and it is gonna be there in activity if I ever need to look. You use your Apple customer number for devices purchased from Apple. So this is something that Apple must be giving to you, like, if you have a or if you’re buying through a reseller. And so that’s one way to set up how devices are or, you know, manually scan your devices. So if you already own the devices and need to assign them to your organization, they’re pointing you to Apple configurator for iPhone. There is an Apple configurator for macOS. So that’s kind of an interesting way of them helping you with your inventory. Management services. This exists in all Apple businesses. You can see I’ve got many servers, but most things using the built in device management. You can see assignment history of where things have what’s happened in your in your service, and the default assignment is all here of if you get a new device, what are they automatically gonna be assigned to? This is the new section. Not everyone has this. The Addigy Apple business does not have. This is the their built in management. So the things that is here is the blueprint for user devices. So if you wanna manage a user base thing through manage Apple accounts, this is what it is. The way this gets pulled down is when you sign in with a manage Apple account on a device, depending on what user is assigned to this blueprint is the settings they’re gonna get. If they are service devices, like kiosks or conference rooms or something that’s going to be shared and not tied to an individual user, you can create a blueprint for service devices. Or you can create a custom blueprint with any configuration or apps for both users and service devices. You can you can kinda this is the choose your own adventure. Do whatever you want. So let’s look at users first. You go here. They have some default configurations. You can change the name of it. And notice the first thing they have is add Wi Fi network. So that’s something that they just assume everyone should have, only really relevant if you’re working in an office space. They’ve got a a default password policy. It’s requiring a passcode, and that looks like it’s about it. And it’s turning on automatic software updates. So it will update it fourteen days after the release at five PM. This is local time. You can add in certain apps depending on I haven’t purchased too many apps. So I want everyone to be on Facebook. Wi Fi is mandatory for this, which is wild. So that’s just kinda what they recommend. These are MDM profiles, or some of them are declarative profiles. But these are settings, device settings that are going down to the application. What’s being used on the back end is really only for nerds, whether it’s MDM or declarative. So these are all the things that are available for free in Apple Business. You can configure Wi Fi, web filters. Web clips are just like think of, like, shortcuts to web pages, VPN software update, password and screen unlock. You can customize the lock screen, iCloud gatekeeper, FileVault. You know, these are all fairly simple. Most every device management service should have this. They also have a custom configuration. If there’s something that you wanna if you’re a little bit more technical, you can upload something from the Apple spec, which personally is why I’m doing this. But I wanna call on FileVault in particular because you cannot enforce FileVault. It will not be applied to devices until an encryption certificate is uploaded. So you need to go and actually create and upload an encryption certificate. This this is something that we every device management service, including Addigy, does not require. We we do this for you. It makes sense to me personally why Apple Business has this because this is something that Apple even if Apple wanted to, they don’t have the certificate. So in the case of, like, subpoenas for, like, you know, law enforcement, Apple can’t decrypt anything. You, as the the owner, has the access to the certificate. So this is a really important thing, though, is and it doesn’t affect Mac’s enrolled as personal devices either. But this is this is a massive thing for FileVault. The other thing is is it’s fairly basic. Like, there’s not a restrictions payload, for example. So if you wanna restrict someone from being able to log in with a different iCloud account or a personal Apple ID, it’s not really allowed. You have a lot of very generic options, like what’s allowed to be part of the iCloud backup, especially if you’re paying for your business’ iCloud. You can, you know, enable different app access of of what’s allowed, what’s not allowed. So those things, but you can’t really get beyond this without getting super technical and doing a custom configuration. So this is something that’s in an XML format or has the dot mobile config that you’ve created yourself. Any restrictions payload is, I think, the biggest one that’s missing. The restrictions payload in Addigy is huge. There’s a lot of things that you can control on the devices. If you’re doing Wi Fi so let’s actually take a look at the Wi Fi one. They’re pretty limited in their enterprise options. They don’t have WPA three or any this doesn’t look like you’re allowed to do any SCEP or anything like that. So if you’re an enterprise that has an enterprise network, this is a fairly simple setup. So they’ve got one type of SCEP with a RADIUS server. But if you wanna get more complicated or more specific, Addigy can do that out of the box. The other big thing that I don’t see here is automated device enrollment. So if you are have owned a personal device, you know there’s, like, a million screens during the setup assistant. If it’s an organizationally owned device, there doesn’t appear to be a way to skip any of those setup screens. You may not want your users to, you know, set up touch ID. You may not want them to set up face ID. You may not want them to set up location services or even have control over certain things. And in device management service like Addigy, you can control that whole setup experience. The other thing here too, if I pop down to packages, is let’s see how to add a package. So here, you have to have so for computers, you deploy applications. You kinda have to have a package URL already. You have to have the SHA, two fifty six hash, the bundle ID, the version number. There’s a lot here that you have to host yourself. There’s not, like, a place for us to be able to upload a package and save it to a place. Whereas, Addigy, we provide the hosting. You give us a package, we’ll upload it, and we’ll deploy it. We handle all of this for you so you don’t have to. Some of these things, you know, are are nice. You can include the the required MDM profiles and things like that. Addigy can do it as well, but you do have to host your own package URL. And this URL cannot change or it will stop working. So hosting and distributing your own PKGs may be a bit beyond a lot of folks. Supports and service. So if you have repair credits, you know, what’s going on, if there’s repair cry requests. This is my personal PIN and AppleCare customer. So now I have a proof coverage because I have a a device in in a with AppleCare for Business. This is a new service that some people are offering. You know, how do you manage your brand? How do you Apple Maps never used to have ads, and now it does. So how do you make your location more discoverable? How do you do the branded emails when people receive an email from you? You know? How do you make sure that your brand is is up close and upfront? Same thing with tap to pay. You know? When they’re paying at your business, making sure the brand is showing, and your Apple Wallet, everything like that. So setting up a brand profile is a lot. You’ve got single. If you’re just a small business with a without a physical location, then this is the way for you. Or if you are business with a lot of different brands, maybe you have a lot of different services that you offer, or maybe you’re in different countries, or maybe you’re, like, a music venue that’s got a lot of physical locations that are all slightly different. There’s a few different ways to do this. Let’s just go simple. You have to prove that you own this brand or whether it’s a franchise, which is a big deal. I’m not gonna be able to go through all these steps. But there are a lot of things here that I think people are still discovering about this. You need you know, they gave examples of people in different countries, different information about how your logo should be. I think people are still understanding how this works from Apple Business Connect, and people are also still trying to figure out what has happened to their Apple Business connect accounts or why they can’t claim their brand yet. So this is where most of the talks at is how do you set up this brand profile, and how do you make sure it’s good. There’s also, like, little things about, like, this is only available on iOS, and it’s only gonna work if it’s set to English. This is also only available in the United States and Canada, only advertisers with businesses in those countries. So there is some limitations to this today. But this is something that somebody will look at and be like, I don’t really know how this is working. It’s an add on service that I think MSPs can kinda cash in on a little bit of, like, do you know what you’re doing? Do you know what DMARC is? Is that a requirement? If you don’t know that, you don’t know how to handle that, let us do it for you. So you can set up email for up to five hundred users. I have started setting this up, and I have not finished it. So I need to do this. But up to five hundred, this is really good if you’re somebody that’s using G Suite and are paying a lot of money for it like I am. I’m using G Suite, and I need to switch my email provider still. This is gonna save me a lot of money because this is free. I can have up to five hundred emails whereas G Suite charges you. And if I want, you can turn off emails. Let’s see what happens because I haven’t set it up yet. So you can set up emails up to five hundred people, which is pretty great, and it’s free. This is another business opportunity for MSPs. Could be just a small add on of do you wanna buy a new domain? If you’re a new business, this is great. You can manage it all directly from Apple Business, which is super great. I already own a domain, and I have verified ownership. It knows that it’s set up with another provider, so I need to do some more extra steps. And it asks you, how do you want your emails to all be formatted? So use oh my god. I cannot scroll down. This is a terrible UI problems. They offer some suggestions of if you want a dash or just the first name. I think I want a custom one. And and you can’t manage it from here. You have to go to domains, which takes you somewhere else. And I can say, actually, I don’t want that. I want it to actually be first dot I know this is formatting is gonna be kinda weird. Yeah. So I don’t want it to be that. I want it to be first name dot last initial. No. I want it to be first dot last name. Done. And all new managed Apple accounts are gonna do that. So in here, where it did take me very confusingly, I can see there’s one unmanaged Apple account in here. I haven’t locked my domain yet. You can stop people from creating new Apple accounts man with their email addresses, and you can see more about, like, the domain capture of how do I take ownership of my personal Apple account that is tied to this domain. Storage. This is now a thing that is available. I can buy iCloud storage for my user. This is when they’re signed in with their managed Apple account, the amount of storage, which is great, and AppleCare. This is where I purchased. I’ve got one device plan. I can add another one, or I can manage this one and change out this device. So I can say, actually, I don’t wanna cover this device anymore. I wanna cover this device. And it also tells you when devices are not eligible for AppleCare. Just here in the settings, there is a ton here. I registered with D U N S. All the roles and permissions are here. You can see, you know, at a glance of what’s happening. You can create some custom roles if you want. A beta feature opt in is here if you’re somebody who wants to have VisionOS’s. Most importantly, though, the API is here. So you can see all your API keys and things like that to manage the Apple Business API. And to renew all of your tokens for apps and books is here. So you can go in and you can assign apps. That’s not even where the tokens are. The tokens keep moving. But, anyways, this is the the settings. So here, they kinda break down the feature availability. So if you are not in Canada, maybe, say, you’re in Europe and you’re in the Netherlands. Right? We’ve got a lot of customers that are in the wow. Is this gonna work it down? The iCloud storage, looks like Canada doesn’t have access to that. Mail, calendar, and directory, that’s a thing that only the US has. So there’s a few things. So it’s not across the board. Looks like, you know, for these countries, you can’t buy apps and books. The Apple App Store, volume purchasing isn’t available. You can still enroll the devices, but so, actually, what’s critical about this is this is for the built in management. Oh, no. This is gonna affect everyone. So you can enroll into a a device management service, whether you’re using the built in or something like Addigy. You’re not able to deploy books through Apple apps. But if you’re using something like Addigy, you can still easily deploy packages to macOS. Your iOS stuff is a little limited. The European ones, you can get apps and books. You can do zero touch enrollment. You can’t do the iCloud stuff or or the AppleCare stuff. Same thing here in most of Europe. So it’s still limited. I recommend people check out what’s available in different countries. I didn’t realize the Apple App Store wasn’t available. But, like, a lot of these countries, like Afghanistan, for example, has never had zero touch deployment. So at the very least, they can buy devices and enroll devices. Obviously, little nuances in all of the things. Like, for example, in China, you can buy apps but not books. Some publisher maybe there isn’t any publishers. But I know for most of is there just not Africa Middle East and Africa? Most of Africa and the Middle East didn’t have any Apple business, so this is still something better than what they, you know, were missing. They can still enroll and have some type of management, whereas before, they couldn’t do anything. They just just straight up didn’t exist. So