Setting Up Apple Business Manager for Corporate iOS App Distribution
Apple Business Manager (ABM) is an organizational device and app management portal. It's needed not for App Store publishing but for controlled app distribution within a company: via MDM system, without user involvement, without personal Apple ID binding.
What ABM Solves and Doesn't
ABM bridges Apple and MDM platforms (Jamf Pro, Microsoft Intune, VMware Workspace ONE, Kandji). Through ABM you obtain VPP tokens (Volume Purchase Program) to buy App Store app licenses and assign them to devices centrally — without entering Apple ID on each device.
ABM doesn't allow distributing apps not in App Store without Custom Apps publishing. Internal apps not publishable publicly are distributed via two mechanisms: Custom App Distribution (App Store app, visible only to your organization by invitation) or Apple Developer Enterprise Program (distribution outside App Store, see separate service).
ABM Setup: Technical Steps
Organization Registration requires DUNS number or equivalent legal identifier. Process takes several days — Apple verifies organization existence. Without DUNS, process is harder in some countries.
Federated Authentication — connecting corporate IdP (Azure AD, Okta, Google Workspace) to ABM via SCIM. Allows managing Managed Apple ID through corporate directory. Without federation, Managed Apple IDs are created manually, unacceptable for large organizations.
MDM Server Binding. Add MDM server as Device Management Server in ABM. ABM generates token to upload to MDM. After this, devices enrolled via Automated Device Enrollment (ADE, formerly DEP) automatically get under MDM control on first boot.
VPP Tokens. Create locations in ABM — organizational structure units for license management. Each location generates VPP Content Token. Load token into MDM to allow system to assign and revoke app licenses on devices.
Custom App Distribution
If app developed for specific organization and shouldn't be visible in public App Store — use Custom App Distribution. Developer publishes via App Store Connect with Custom App flag, specifies ABM organizations that get access. From user perspective — app arrives via MDM without visibility in public catalog.
Requirement: app still passes full App Store Review. This isn't review bypass — it's distribution channel change. Review time is similar to normal.
Typical Implementation Issues
Most common: MDM doesn't see VPP licenses after token load. Reason — location in ABM doesn't match token's MDM location. Solution: verify token created for correct location.
Devices don't enroll via ADE on first boot — usually because device serial isn't added to ABM. Auto-happens with authorized Apple reseller purchase. For BYOD scenario — manually add via Apple Configurator 2.
ABM setup from scratch — three to seven working days accounting for Apple verification time.