Hacker News Reader

Comment by meego | Hacker News Reader

I recently tried setting Apple Business Manager for our ≈20 people SME.

The first step was "Domain Lock/Capture" which takes over all Apple accounts for a specific domain.

I've never had a worse experience from Apple.

The process is buggy, filled with foot-guns and dead ends. It expects huge amounts of work from users who have had their account for more than a few weeks and are expected to remove a lot of their personal data before their account can be migrated (e.g. do you know how to delete all your Health data?). The process is also impossible to cancel.

Phone support was par for the course, e.g. tickets escalated to the abyss, suggestions to restore workstations to factory settings, etc.

Be warned.

View on HN

The domain lock process was an absolute fiasco at our company. I think this could work if you did this at the time your company launched, but the moment you have employees who have Apple IDs tied to their work email that aren't from the Business Essentials system you are stuck in an impossible-to-mange place.

There are several cheap MDM solutions for Apple devices that I would rather pay for than be dependent on this. (We've used SimpleMDM and love them.)

I'm currently in that hellish process too... I don't know how to get out of it. Did you know that your employees will be forbidden from downloading from the App store once you launched that migration? It's a nightmare

Apple and MDM has always been a shit show. In the days as recently as Ventura (last time I tried it), MDM bypass was as simple as "null route 4 DNS entries during install process, remove null routing after install complete, and never be bothered by it again". This is on Apple Silicon. With no workarounds or anything, upgrades work all the way up to Tahoe.

Like really Apple, that's your device "locking"? I could test activate my work Mac with my personal Apple ID while doing this, no alarm bells, nothing, effectively "It's your laptop now".

The baffling thing is that iOS+MDM has been fantastic over the years. macOS is a completely different beast though.

MacOS used to be excellent for a short period of time when Fleetsmith existed. Then Apple purchased Fleetsmith around 2020 and killed the product not long after.

Fortunately around the same time, JamF ended the practice of the mandatory Jamf JumpStart (£5K fee), which finally made Jamf a feasible option for the company I was in at the time.

True, I remember looking at jamf at one point and the mandatory consulting was so annoying because we already had it dialled in on the free trial.

In the end we just made do with intune. It's a lot less capable for Mac but these days you can get by with it.

hopefully there's no kill switch for macs on intune, if not, the threat of wiping machines with one click is real, just ask stryker; https://www.cybersecuritydive.com/news/stryker-attack-device...

Of course there is a kill switch. This is one of the key features of an MDM/endpoint manager. You won't be able to sell one without it. It's also built in to apple's management protocol (which most endpoint management systems leverage) and in activesync.

You just have to secure it properly. Have limits to how many one admin can wipe etc. But trust me every company with managed IT assets has this capability. Often even in BOYD scenarios! Stryker just failed to secure access to it properly and to set sensible limits.

However, the feature isn't very effective in the field. It's very unlikely for an attacker to be smart enough to bypass the password on a stolen Mac which is needed to connect it to WiFi, yet at the same time be dumb enough to connect it to the unfiltered internet so it can receive the wipe command. The overlap between these sets of people is almost zero. We do fire a wipe at every stolen computer but I doubt it ever actually happens. If it ever happens it'll be a total end user fail (like writing the password on a post-it with the laptop)

Either you will lose it to a common thief who won't be able to breach the login (99% of cases), or to a really targeted adversary who has cellebrite or something similar and won't connect it to the internet ever again. This is still the most risky scenario because if someone like that steals it, there's bound to be something really valuable on it.

In practice this is something more suited to mobile devices.

Well yeah, the idea is that if you have ABM, you have an MDM you can use to purchase licenses for them and install the apps with the MDM.

It can be done that way, but it is definitely not the norm. Businesses will generally “purchase” (many for €0) apps in ABM that are to be used for business purposes and push those to devices, the user can then use an Apple ID to download any other apps they want for personal use.

If they’re using Managed Apple IDs they will have no access at all to the app store and won’t be able to download their own apps anymore. IT department will have to buy and assign any apps that anyone needs, even the $0 ones that only 1 person needs.

If my employer did that to me, I would seriously consider sueing them.

You’ve never been issued a work computer that’s not yours to fuck around with?

I haven’t. Did have issued laptops that were company managed but I basically didn’t use and, in any case, I like many others reinstalled a clean operating system image and did my own support.

You could do that in our place but you'd lose access to everything due to not being in compliance.

In a small shop that might work but not in an enterprise with ISO norms and security certifications to meet.

At most decent sized companies with a cyber security and network admin team, this is probably the fastest way to get disconnected from the internal corporate network with no way to reconnect.

I always seem to end up with local admin at the bigger places I've been at because I'm so annoying with onboarding and requesting access to download development tools.

This was a larger company and they did not care so long as you followed policies like turning on encryption. Companies do differ.

I was talking about domain capture. If you own my apple ID just because I used the company email to register it, I will definitely consider sueing you.

Just on a personal note, tying your personal devices to your work email account is a very silly thing to do. Even if it's your company you could be locked out of your company email account at any time (HR grievance, SEC investigation, hostile takeover...) Losing access to your devices and not being able to access things like reset emails at the same time would not be fun.

Sue for what? Do you think you own the company email address?

Yep. Truly horrid policy. Where I work our issued iPhones suck to use without App Store access; no Bitwarden was the killer for me personally. Everyone I checked with uses their personal email/Apple ID instead of the MAID, and there's a sword over your head if you ever accidently copy/paste something from internal emails to something like Notes which has iCloud sync (we're semi serious about leaker). Absolute failure of an MDM setup by Apple.

MDM can restrict pasteboard from managed apps to non-managed apps, as well as allowing iCloud sign-ins but restricting which iCloud services are allowed.

It's an absolute failure of the MDM server administrator for allowing such things, not on Apple.

This was a big pain in the ass for me to figure out. I ended up using the free version of Mosyle and hiring someone on Fiverr to help me figure out how to get the licenses assigned to our managed devices.

I did not. If I had known what would happen when we tried this we would have skipped the process entirely. Our staff (roughly 125) was so confused and it wasted a lot of time communicating about it, then trying to roll it back, etc.

The Domain Capture process cannot be canceled once it’s started. It’s also not required, unless by your company policy.

The point is to make sure there’s not a mess on the other end when you enforce SSO for MAIDs.

Apple’s documentation for ABM and ABE is atrocious, but they do manage to document a bunch of footguns, just poorly and in seemingly bizarre places.

For example, ABE doesn’t support MDM migration (either as source or destination), despite the fact that the feature launched with macOS/iOS/iPadOS 26 and is supported by other MDM solutions.

And you cannot push custom config profiles with ABE which declare a non-Apple preference domain. Utter nonsense.

If you’re using the full ABM-with-ADE and MDM stack, it’s expected that you push apps to employees.

You can also use Munki to make apps available to users. You can just push only Munki via MDM if you want, and let it manage app installs and self service installs for you. There are caveats.

How does a company allow personal Apple IDs?

I think the idea is that it happens before they lock the domain as a business. Before that, if you have an email address you can create a personal account with it.

yes, that's exactly how it happens.

Employee needs to download Microsoft Remote Desktop (sorry, Windows App) that is only distributed through App Store.

Employee does not trust the company having access to everything else in their personal iCloud account - photos, mails, messages, calendar, reminders, etc.

Employee registers a new Apple ID with company email, as it would be only used for downloading one single app.

Got it. It’s registering with the company email first, not their personal one.

> I think this could work if you did this at the time your company launched, but the moment you have employees who have Apple IDs tied to their work email that aren't from the Business Essentials system you are stuck in an impossible-to-mange place.

I had the same thing happen but with Microsoft. A friend and I had started a small consulting business and were using Google Workspace, but I needed a Microsoft account to interact with a client. I made one with my business email. None of us knew any better, but I couldn’t connect with our client’s Microsoft setup because it was a personal account. So I went to set up a business account. It was a whole fiasco and the only way I could really fix it was create an alias and use that for Microsoft.

> I think this could work if you did this at the time your company launched

This should not be a surprise. Greenfield services have not existed long enough to resolve edge cases that inevitably arise while integrating existing operating models already in use.

The broken part of this process (domain claim) has existed for several years as part of ABE, it isn't new.

My point was trying to fit a new company with no barnacles into an existing process model will always be easier than retrofitting an existing company model full of edge cases the service never had to engineer around

Not really sure why you made that point only to wave it away later saying it's always been broken regardless

That's why Enterprise vendors try so hard to get startups using their stuff. Lock-in is so strong. I can't imagine having a working system at a 100 person company and then trying to migrate to something else unless the current situation was truly awful.

> the moment you have employees who have Apple IDs tied to their work email that aren't from the Business Essentials system you are stuck in an impossible-to-mange place

So give all the employees an email alias they can use to create a new Apple ID for this purpose?

I had a "wonderful" experience as well.

I wanted to evaluate it for MDM purposes so I applied for an ABM account for a company I work for, got soft-approved, created an entirely new Apple ID (as required by the ABM), used it to log on a test device I intended to manage, then sort of forgot about it while awaiting for Apple to conclude their hard-approval for the ABM account creation.

Apple was supposed to contact the business owner to verify company details and finalize the process over the next few days, but they never did.

30 days later they canceled the ABM company account and deleted all the associated users along with the Apple ID which I used to log into a testing device, which now became a fairly expensive paperweight.

I had very little expectations about the experience and I was still disappointed.

This is the kind of failure mode that makes people nervous about tightly coupled identity + device management

FWIW, my experience doing this process for a ~130 person org last year was pretty painless compared to other Domain Claims I've initiated for other SAAS vendors (Docusign in particular), and MDM nightmares (expired JAMF certificates, I'm looking at you).

We had to do it as ppl had made personal Apple accounts using our domain, meaning if they logged in with such an account and left, their iPhone magically transformed into an expensive, elegant paperweight. Due to a setting in our previous MDM we were unable to migrate data cleanly using Apple Biz Manager without committing to use ABM as our MDM (we couldn't) so we told people to "move it yourself following these detailed instructions, otherwise it can't be migrated." Regarding personal data like health on company-managed devices, I certainly don't share that type of info with my employer, and make it clear to staff that it's not our responsibility to migrate such data.

Can you expand on this, specifically how it compares with jamf? It is a direct competitor to jamf right? Essentially Apple vying to eat their lunch right?

> Be warned.

This is exactly what I would have expected from an Apple "business" offering. Apple's whole shtick is to take away most of your choices so that they can focus on the limited number of things they still allow you to do. Businesses need the opposite of that.

Businesses will show up needing integrations with multiple existing third party (often legacy) systems with inherent complexity and then want something that allows them to manage that complexity since it can't be eliminated. It's not really possible in that context to have the experience people otherwise expect Apple to provide, and the thing Apple normally does will often make it worse by removing choices you may have needed in order to make interaction with a third party system less of a pain.

Yes, as an IT professional at a company where a few people have insisted on using Macs, the ABM workflow is by far the most frustrating, half baked product I've had the displeasure of using. People love to complain about Entra/Azure AD, but ABM is another level of obtuse.

What's bad is that it's so much better than it used to be and still this bad.

We use Apple Business Manager. Locking a domain is not a requirement if you're just doing basic MDM, I'm pretty sure. (I also had a negative experience with it, so we didn't use it and everyone just uses their personal apple IDs). Is it no longer possible to skip this step in setting up the account?

In any serious business, you don't want people to use their personal Apple IDs: that could lock their company provided devices for ever when they leave, you also don't want to buy them apps that you won't be able to re-use when they leave, ...

> that could lock their company provided devices for ever when they leave

MDMs like JamF offer override codes to disable activation lock. Hasn’t been an issue in my experience.

Apple's cloud software has been buggy as hell for a long time, at least for me.

I'm in a family iCloud group with my parents... one day I just woke up and had all my podcasts and music replaced with my Mum's :/

Would not want this anywhere near a "business" experience

I'm just gonna go ahead and say that I'm not sure what happened there but either you or your mom signed in with your account on the other device.

I have a lot of technical understanding with how CloudKit works and there's not a pathway for what you're describing to come out of a family group.

Hence, "buggy".

Maybe Something to do with Family Purchase Sharing. I didn’t realize when I bought an audio book it would appear in my dad’s library. Kind of embarrassing. Apple’s help pages make it sound very opt in but I think there are bugs where libraries are merged by default. Some say on a quiet night you can still hear Bono singing “sexy boots”…

Libraries are not merged, only purchase history. It does not download to their device in any scenario automatically.

A lot of people have their iTunes accounts signed in on other devices which would do what you describe, but not family sharing.

AFAIK, it works with subdomains, so you can use something like employees.example.com as your domain, and capture over that.

The org I work for just makes alias's - @ourbrandmdm.com for ABM that forward to their @ourbrand.com emails.

Same here, I never even got in. I never managed to get in. My account is good enough to take my money for other things but somehow I can't manage to onboard into the damn thing so that I can actually manage devices for my company. I just gave up in the end. Couldn't get it done.

I'll try again next month see how far I get with this. This needs to be way simpler than it currently is. Hopefully they fixed a few things there.

It's completely impossible for a 60k employee shop too yeah. They also want you to rearrange the azure ad the way Apple wants. Also impossible for us.

And we have like 20k or so users with manually created Apple IDs on their company email and every one of them has to be manually resolved. It's a joke.

This was my experience switching from GMail to Apple’s mail service. I switched back after a few days.

Genuinely curious, what were the Apple mail service issues for you? I hate gmail and have had zero issues with my @Mac.com email in 20+ years, that I’ve noticed. Thanks

Lots and lots of missing messages. That was the big one. Anything from a SaaS just never arrived, like tickets, notifications, etc. I had random IMAP authentication failures too.

Do you find that iCloud email can correctly handle both “true spam” (meaning the nonsense garbage kind) and “promotional email” effectively?

Our recent (ongoing) experience with Apple Business Manager is just as bad. With no reason or contact they've sent "we can't verify so we've disabled your account because you don't meet the requirements". We ring support and they tell us to try again with no additional information. We then get "we can't verify so we've deleted your accounts" with no information. "Amazing" "experience".

This is also after they've verified us (and our DUNS number) for app signing and distribution. We already have a verified account in another service of theirs!

I gave up when it wanted a Dun and Bradstreet number (whoever they are) and the website to get one didn't work.

I have had the misfortune of having to get D&B numbers (for various Apple things). I believe is the source for lead lists where you start to get dozens to text and phone spam calls per day. Do not pay hundreds of dollars for this if you can at all avoid it.

Definitely avoid unless you are distributing a consumer application through the dominant app stores (App Store and Google Play) ~globally, in which case you may not be able to avoid (or avoiding will be just as much work).

Google and Apple require it for lots of mobile apps targeting certain consumer segments because some countries (eg: Brazil, IIRC? don't quote me on that) have chosen to use D&B as a qualified unique identifier of business legitimacy and it requires exposing personal information of your company's leadership to them.

Afaik every company has a DNB number. It's a credit risk company which sources company data from every country.

Dun & Bradstreet is a business credit agency. Having a D-U-N-S number, which they issue, is like table stakes for being taken seriously as a business.

I'd take Dun & Bradstreet seriously if:

- They didn't sell your data to spammers, and

- Their website actually worked

I also organised this process at work, and it went rather well, (300ppl 10 year old), but of course no one had health data connected under the company domain, thats a crazy idea and it’s probably good apple enforces that to be deleted / moved / disentangled.

It is also clearly described how to move an account that is used privately to a different domain / mail.

you only need to do the domain lock part if you plan to use MAIDs. For 20 people you probably didn't need to do that, at least not at the same time as the rest. You can do it as a later step, not the first step.

Ohh we had a similar experience with Google Cloud. Added our organization and Domain into their Auth system and suddenly all users were migrated into a (invisible / transparent) workspace and could no longer use their calendar or google drive as the workspace had no free usage like you have on a normal free tier.

some years ago i tried this setup for a german company with a special char in its name („ä“) and failed because Apple was not able to match it against DUNS. It took months of support to get it done.

>The process is also impossible to cancel.

This sort of thing should probably be illegal.

Apple's clean separation model only really works if you start that way from day one

Apple really seems to go out of their way to show users the middle finger.

Reply on news.ycombinator.com