iOS Development Basics 148 - ABM vs MDM

Apple Business Manager (ABM) vs. Mobile Device Management (MDM)

Apple Business Manager (ABM)

vantage：

1. centralized management：

   • Provides a one-stop centralized management platform that can manage devices, applications and content.
   • Supports bulk purchase of apps and books for distribution through VPP (Volume Purchase Program).

2. Automatic Device Enrollment (ADE, Apple Deployment Enrollment)：

   • New devices can be used out-of-the-box, automatically registered to ABM and configured to specific MDM servers, simplifying initial configuration.
   • With the automatic device enrollment feature, configurations and applications can be distributed automatically without having to manually fiddle with the device.

3. Higher security and control：

   • Organizations can enforce security policies on devices and ensure the legality and security of software.
   • Wider control over the device allows you to lock down certain features to ensure compliance.

restrict sth. within set boundaries：

1. Need a new Apple device：
   • ABM is more applicable to the purchase of a new Apple device, as the device needs to be purchased through Apple or an authorized reseller to be automatically enrolled in ABM.
   • For existing Apple devices that were not purchased through ABM, they need to be managed manually and cannot fully utilize the automatic device enrollment feature.

Mobile Device Management (MDM)

vantage：

1. Wide range of compatibility：

   • Support for a wide range of devices on the market, including multi-branded phones, tablets, and computers (not limited to Apple devices), makes it very useful in managing heterogeneous device environments.
   • For Apple devices that have been on the market for years, MDM is still valid and can be managed through manual enrollment or configuration files.

2. Flexible management：

   • MDM solutions can be flexibly customized as needed, including deployment of applications, management of device policies, enforcement of security settings, and more.
   • For organizations that don't plan to replace equipment, MDM can leverage existing hardware infrastructure.

restrict sth. within set boundaries：

1. More complex initial configuration：
   • For devices that do not have automatic device registration, they must be configured and registered manually, increasing the burden of initial management.
   • Requires specialized technicians for initial setup and maintenance.

How to use ABM and MDM together

While ABM and MDM have their own advantages and disadvantages, the two can actually be used in combination to capitalize on their respective strengths.

1. New equipment is managed through ABM：

   • New devices purchased by organizations can be enrolled and auto-configured through ABM, simplifying the deployment of new devices.
   • Make sure new Apple devices are purchased from Apple or an authorized reseller for automatic device enrollment.

2. Existing equipment is managed through MDM：

   • The original equipment is connected to the enterprise's management system through MDM, and centralized management is carried out by utilizing the wide compatibility of MDM.
   • Add existing devices to the MDM management system through manual enrollment or configuration files.

3. Unified Management Platform：

   • Adopting a unified management platform that supports ABM and MDM to realize one-stop management of all equipment.
   • For example, some MDM vendors offer integration with ABMs to be able to manage new devices registered through the ABM and existing older devices on the same platform.

concrete example

Suppose a business has some newly purchased Apple devices and some Apple devices that have been in use for years. This can be managed by following the steps below:

1. Register and configure ABM：

   • Register for an Apple Business Manager account and configure the MDM server in ABM.

2. New equipment registered through ABM：

   • Distribute and auto-configure newly purchased Apple devices to MDM servers via ABM.

3. Existing equipment access to MDM：

   • Manually enroll existing devices into MDM.

Example of MDM's manual enrollment code for an existing device (for an Apple device that has been on the market for a long time)

While most of the MDM management process is done through the platform's GUI, in case you need to automate some tasks through code, here is a simple example of a JSON API request:

import requests
import json

# MDM server API URL (example)
mdm_server_url = '/api/v1/register_device'

# Authentication (replace with your actual token or credentials)
headers = {
    'Authorization': 'Bearer YOUR_MDM_API_TOKEN',
    'Content-Type': 'application/json'
}

# Payload containing device information (should be adjusted according to MDM provider)
payload = {
    'device_name': 'Employee-iPhone',
    'serial_number': 'SERIAL_NUMBER_HERE',
    'os_version': 'iOS 15.0',
    'owner': {
        'user_id': 'USER_ID_HERE',
        'department': 'Sales'
    }
}

# Sending the registration request to the MDM server
response = (mdm_server_url, headers=headers, data=(payload))

# Check the response
if response.status_code == 200:
    print('Device successfully registered to the MDM server.')
else:
    print(f'Failed to register device: {response.status_code}, {}')

Adapted to the API documentation provided by the specific MDM vendor, this is just a generic example to demonstrate the process.

summarize

• ABM Ideal for newly purchased Apple devices, it provides automatic device enrollment and centralized management.
• MDM Typically suited to devices that need to manage multiple devices and those already in use, compatibility is broad and flexible.
• combine Both tools allow for an optimal device management strategy that capitalizes on the strengths of each.

The choice of ABM, MDMand how to utilize a combination of the two largely depends on the realities and needs of the business. Understanding the benefits and limitations of each solution can help organizations make more informed decisions.