Set up an Apple Business account

Apple Business is free and includes device management. This walks through setting it up from nothing, in the order that avoids the mistakes that are hard to undo.

Before you start

Create the account

Go to business.apple.com and select Sign up now. Use a role address such as it@ rather than a personal one — this account outlives whoever creates it.

1. Enter your organization name, location and address, and your website.
2. Enter the legal first and last name of the person enrolling, and set a password.
3. Enter a phone number and choose SMS or a call for codes.
4. Enter the code sent to the email address, then the one sent to the phone.
5. Review and accept the terms.

Verify the organization

Sign in and go to Settings, then Organization, and select Verify Now. You must supply two of: a business ID such as a D-U-N-S number or EIN, domain validation by TXT record, an App Store Connect selection, or official documents. Choose your methods and select Send for Review.

Add your domain

1. Go to Settings, then Domains, and add your domain.
2. Add the TXT record Apple gives you at your DNS host, exactly as shown.
3. Wait for DNS to propagate, then verify.

If employees already signed up for personal Apple Accounts using their work address, Apple will prompt you to resolve the conflict. Handle it deliberately — those accounts may hold purchases and photos that belong to the person.

Set up roles

Do this before creating users. Apple Business has five default roles — Organization Administrator, IT Administrator, Marketing Administrator, Ads Administrator and Staff — plus custom ones including People Manager, Content Manager, Device Enrollment Manager and Device API Manager.

• Have at least two Organization Administrators, so one person losing a phone cannot lock the company out.
• IT Administrator is the right level for most day-to-day device work.
• Device Enrollment Manager covers devices only — the right level for a helpdesk, or for Virtisphere when we are handling devices and have no reason to touch your people.
• Never share an Organization Administrator login, with us or with anyone else. Named accounts make every action attributable and removing access one click.
• To add us, see Give Virtisphere access.

Create user accounts

1. Go to People, then Users, and select Add.
2. Fill the required fields: name, account prefix, domain, email address and role.
3. Select Save.
4. Issue credentials with Share Sign-in Instructions or Create Sign-In. The account is not usable until the person signs in and changes the temporary password.

Adding by hand stops scaling around twenty people. Directory Sync pulls users from Microsoft Entra ID or Google Workspace and is the right answer if you already run one. Federated authentication lets people use credentials they already have. Invitations ask people to link a personal Apple Account — easiest, and weakest, because the account leaves when they do.

Turn on device management

1. Go to Devices, then Management Services, and open the Device Enrollment tab.
2. Enable the built-in device management service.
3. Choose Enroll as an organization-owned device for the device types you own.
4. Choose Enroll as personal device only if you support staff-owned devices.
5. Link your Apple Customer Number or Reseller Number, so new orders appear automatically.

Enroll devices

This decides what you can recover later. Supervision is not something you switch on afterwards — it is set by how the device was enrolled.

For new hardware: link the customer or reseller number, assign the device to your management service, then power it on with an internet connection. To enroll an existing device, go to People, then Users, select the person, choose Enroll Devices, pick the device type and send — they get an emailed link.

Configurations and Blueprints

Configurations are individual settings — passcode rules, software update enforcement, FileVault, Wi-Fi, firewall and more, in four groups: Recommended, Security, Network and Personalization. Build them in order of what protects you most: passcode, software update, FileVault, then Wi-Fi and certificates.

A Blueprint bundles configurations and apps and assigns them to users, groups or devices. Build one per role — office staff, field staff, shared devices — rather than one per person. Three good Blueprints are maintainable; thirty personal ones are not.

1. Go to Devices, then Blueprints, and select Add.
2. Choose a template: user devices, service devices, or custom.
3. Add your configurations and the apps that role needs.
4. Assign it to a user group, to individuals, or directly to devices.
5. Select Add Blueprint.

Apps and books

Buy app licences through Apple Business rather than letting people buy their own. The licences belong to the company and can be reclaimed from somebody who leaves and reissued to their replacement. An app bought on a personal account leaves with the person, and you pay again.

Where we come in

All of the above is doable in-house, and this page exists so that you can. What most companies struggle with is keeping it accurate through hiring, leaving and breakage. We set it up, run joiners and leavers including the Activation Lock check, keep the device register in your CRM alongside the people it belongs to, and handle lockouts and lost devices while you carry on. Raise a ticket from your dashboard or call (877) 588-5152.