undefined

points

[-]

Apple's cloud software has been buggy as hell for a long time, at least for me.

I'm in a family iCloud group with my parents... one day I just woke up and had all my podcasts and music replaced with my Mum's :/

Would not want this anywhere near a "business" experience

by geoffharcourt4 hours ago|

prev|

[-]

The domain lock process was an absolute fiasco at our company. I think this could work if you did this at the time your company launched, but the moment you have employees who have Apple IDs tied to their work email that aren't from the Business Essentials system you are stuck in an impossible-to-mange place.

There are several cheap MDM solutions for Apple devices that I would rather pay for than be dependent on this. (We've used SimpleMDM and love them.)

by cocoflunchy4 hours ago|

parent|

[-]

I'm currently in that hellish process too... I don't know how to get out of it. Did you know that your employees will be forbidden from downloading from the App store once you launched that migration? It's a nightmare

by wpm2 hours ago|

parent|

[-]

Well yeah, the idea is that if you have ABM, you have an MDM you can use to purchase licenses for them and install the apps with the MDM.

by IrishTechie2 hours ago|

parent|

[-]

It can be done that way, but it is definitely not the norm. Businesses will generally “purchase” (many for €0) apps in ABM that are to be used for business purposes and push those to devices, the user can then use an Apple ID to download any other apps they want for personal use.

by ndespres1 hours ago|

parent|

[-]

If they’re using Managed Apple IDs they will have no access at all to the app store and won’t be able to download their own apps anymore. IT department will have to buy and assign any apps that anyone needs, even the $0 ones that only 1 person needs.

by anxman1 hours ago|

parent|

prev|

[-]

This was a big pain in the ass for me to figure out. I ended up using the free version of Mosyle and hiring someone on Fiverr to help me figure out how to get the licenses assigned to our managed devices.

by FireBeyond3 hours ago|

parent|

prev|

[-]

Apple and MDM has always been a shit show. In the days as recently as Ventura (last time I tried it), MDM bypass was as simple as "null route 4 DNS entries during install process, remove null routing after install complete, and never be bothered by it again". This is on Apple Silicon. With no workarounds or anything, upgrades work all the way up to Tahoe.

Like really Apple, that's your device "locking"? I could test activate my work Mac with my personal Apple ID while doing this, no alarm bells, nothing, effectively "It's your laptop now".

by IrishTechie2 hours ago|

parent|

[-]

The baffling thing is that iOS+MDM has been fantastic over the years. macOS is a completely different beast though.

by wil4216 minutes ago|

parent|

prev|

[-]

How does a company allow personal Apple IDs?

by SoleilAbsolu1 hours ago|

prev|

[-]

FWIW, my experience doing this process for a ~130 person org last year was pretty painless compared to other Domain Claims I've initiated for other SAAS vendors (Docusign in particular), and MDM nightmares (expired JAMF certificates, I'm looking at you).

We had to do it as ppl had made personal Apple accounts using our domain, meaning if they logged in with such an account and left, their iPhone magically transformed into an expensive, elegant paperweight. Due to a setting in our previous MDM we were unable to migrate data cleanly using Apple Biz Manager without committing to use ABM as our MDM (we couldn't) so we told people to "move it yourself following these detailed instructions, otherwise it can't be migrated." Regarding personal data like health on company-managed devices, I certainly don't share that type of info with my employer, and make it clear to staff that it's not our responsibility to migrate such data.

by 5 minutes ago|

parent|

[-]

deleted

by czscout1 hours ago|

prev|

[-]

Yes, as an IT professional at a company where a few people have insisted on using Macs, the ABM workflow is by far the most frustrating, half baked product I've had the displeasure of using. People love to complain about Entra/Azure AD, but ABM is another level of obtuse.

by jillesvangurp1 hours ago|

prev|

[-]

Same here, I never even got in. I never managed to get in. My account is good enough to take my money for other things but somehow I can't manage to onboard into the damn thing so that I can actually manage devices for my company. I just gave up in the end. Couldn't get it done.

I'll try again next month see how far I get with this. This needs to be way simpler than it currently is. Hopefully they fixed a few things there.

by cj3 hours ago|

prev|

[-]

We use Apple Business Manager. Locking a domain is not a requirement if you're just doing basic MDM, I'm pretty sure. (I also had a negative experience with it, so we didn't use it and everyone just uses their personal apple IDs). Is it no longer possible to skip this step in setting up the account?

by true_religion2 hours ago|

prev|

[-]

AFAIK, it works with subdomains, so you can use something like employees.example.com as your domain, and capture over that.

by slyn2 hours ago|

parent|

[-]

The org I work for just makes alias's - @ourbrandmdm.com for ABM that forward to their @ourbrand.com emails.

by razakel1 hours ago|

prev|

[-]

I gave up when it wanted a Dun and Bradstreet number (whoever they are) and the website to get one didn't work.

by dlg1 hours ago|

parent|

[-]

I have had the misfortune of having to get D&B numbers (for various Apple things). I believe is the source for lead lists where you start to get dozens to text and phone spam calls per day. Do not pay hundreds of dollars for this if you can at all avoid it.

by keerthiko1 hours ago|

parent|

[-]

Definitely avoid unless you are distributing a consumer application through the dominant app stores (App Store and Google Play) ~globally, in which case you may not be able to avoid (or avoiding will be just as much work).

Google and Apple require it for lots of mobile apps targeting certain consumer segments because some countries (eg: Brazil, IIRC? don't quote me on that) have chosen to use D&B as a qualified unique identifier of business legitimacy and it requires exposing personal information of your company's leadership to them.

by yolo300036 minutes ago|

parent|

prev|

[-]

Afaik every company has a DNB number. It's a credit risk company which sources company data from every country.

by quietsegfault3 hours ago|

prev|

[-]

This was my experience switching from GMail to Apple’s mail service. I switched back after a few days.

by givinguflac23 minutes ago|

parent|

[-]

Genuinely curious, what were the Apple mail service issues for you? I hate gmail and have had zero issues with my @Mac.com email in 20+ years, that I’ve noticed. Thanks

by jiveturkey55 minutes ago|

prev|

[-]

you only need to do the domain lock part if you plan to use MAIDs. For 20 people you probably didn't need to do that, at least not at the same time as the rest. You can do it as a later step, not the first step.