Apple Business Essentials now available for small businesses(apple.com)
apple.com
Apple Business Essentials now available for small businesses
https://www.apple.com/newsroom/2022/03/apple-business-essentials-now-available-for-small-businesses/
42 comments
When I called them about this exact issue what they told me is to register the second contact with your name reversed (last name as the first name and first name as the last name). Also use a different business email with the same domain for the second contact.
That seemed to do the trick.
One thing to take note of though is be very careful if you set up managed IDs and a verified domain through Apple Business Essentials. It locks devices down pretty heavily. I'm not familiar with this area of IT and didn't know that, although it might be pretty obvious to those who work in the space.
That seemed to do the trick.
One thing to take note of though is be very careful if you set up managed IDs and a verified domain through Apple Business Essentials. It locks devices down pretty heavily. I'm not familiar with this area of IT and didn't know that, although it might be pretty obvious to those who work in the space.
I'm guessing this is for those "our key contact went on vacation / died / quit years ago" scenarios. Unfortunate that you can't bypass it by acknowledging that risk.
All you have to do is open a separate Apple ID and open a business account with your local Apple store. They will happily bill you in alternate ways. As a one man band, you have no use for MDM. Apple Business Essentials simply has no value for a one-person company. I don’t blame Apple for adding a level of fraud protection to something like this and for not solving the problem for a one person business. Good non-use of engineering money.
As the MDM manager for my family, I must whole-heartedly disagree.
One common but sophisticated attack involves getting your victims to install your own MDM certificate on their machines, because you've convinced them that they're getting some sort of free lunch. After they install your MDM certificate, you own their machines, and you can do anything with them that you want -- make them into your own private bot army to rope in more victims, or whatever.
But if the devices in question already have an MDM certificate installed, that prevents this kind of attack.
Running my own MDM profile also means that I can ensure that my wife's devices are always up to date, because I can enforce this at the MDM level. And that's an important issue for her employer, since her law firm uses BYOD. So, I can use my MDM profile to ensure that all their requirements are met and enforced by my own MDM.
One common but sophisticated attack involves getting your victims to install your own MDM certificate on their machines, because you've convinced them that they're getting some sort of free lunch. After they install your MDM certificate, you own their machines, and you can do anything with them that you want -- make them into your own private bot army to rope in more victims, or whatever.
But if the devices in question already have an MDM certificate installed, that prevents this kind of attack.
Running my own MDM profile also means that I can ensure that my wife's devices are always up to date, because I can enforce this at the MDM level. And that's an important issue for her employer, since her law firm uses BYOD. So, I can use my MDM profile to ensure that all their requirements are met and enforced by my own MDM.
Can you please explain what benefits you will get from this as a sole proprietor (assuming you are one)?
Sole proprietorship can be simpler to set up and manage, but Single Member LLCs are also very common. One person doesn't imply sole proprietorship.
They're from the UK, so I doubt "LLC" specifics are relevant to them.
There is probably a market for being a trusted second contact for systems like this. Wonder if that would pass muster for Apple.
This could actually be a nice job category for lonely people with no social life; providing a “second contact” for other lonely people.
If you can have one of those colo business addresses or colo mailbox/po box type of places, why not this? There's also several board members that are on several boards. Seems like it might be better served in having a trusted attorney with instructions on how to handle cases when sole proprieter is no longer able to propriet.
[deleted]
I guess a one/two person shop isn't large enough to be small business. Maybe we should be using microbusiness/microcorp to go along with megacorp/evilcorp
> Apple has a deep and decades-long commitment to helping small businesses thrive.
I realize this is basic PR messaging, but it's a weird/ironic take from a company that regularly competes as "the richest company in the world". Usually, Big loves Big. Big companies usually telegraph how Enterprisey they are, how the biggest of the big use their bigly products. But Apple continually messages this inverse relationship. We are the biggest, and we serve the hordes of the little. It's a weird/unusual message.
(and I'm making zero claims as to the credibility of this messaging, just noticing that it's different)
I realize this is basic PR messaging, but it's a weird/ironic take from a company that regularly competes as "the richest company in the world". Usually, Big loves Big. Big companies usually telegraph how Enterprisey they are, how the biggest of the big use their bigly products. But Apple continually messages this inverse relationship. We are the biggest, and we serve the hordes of the little. It's a weird/unusual message.
(and I'm making zero claims as to the credibility of this messaging, just noticing that it's different)
When you provide the platform, a win for small businesses is just more individual consumers really. Now people have double the iCloud accounts, Apple gets more money per account, more in app purchase revenue, etc.
Apple is good at making individuals want to use their products for work, where as Microsoft is good at making workplaces use their products, so consumers know their OS and choose it for home. Different ideologies.
Apple is good at making individuals want to use their products for work, where as Microsoft is good at making workplaces use their products, so consumers know their OS and choose it for home. Different ideologies.
oh I have a totally different reaction to that line, and I thought this was where you were going at first.
Which is: Apple is really not a business-user focused company. Windows-based PCs have long dominated the business world. And as someone who does use Macs for both personal use and at work, setting up a work computer is always an awkward, sup-par experience. There are so many features (like iMessage, Facetime, and iCloud) that are exclusively designed for personal use, and no good way to e.g. configure which parts of my personal data should be available on my work computer. Or I can use a totally separate apple id on my work computer, but then I can't get access to things like my Apple Music account that I am subscribed to on my personal account.
Which is: Apple is really not a business-user focused company. Windows-based PCs have long dominated the business world. And as someone who does use Macs for both personal use and at work, setting up a work computer is always an awkward, sup-par experience. There are so many features (like iMessage, Facetime, and iCloud) that are exclusively designed for personal use, and no good way to e.g. configure which parts of my personal data should be available on my work computer. Or I can use a totally separate apple id on my work computer, but then I can't get access to things like my Apple Music account that I am subscribed to on my personal account.
Agreed. While the iCloud ecosystem provides a smooth experience for personal users, it's super awkward to integrate into a business environment. Activating iMessage for instance, will leave personal text messaging history on the device that can be easily accessed. Same for photo albums, etc.
If the devices are managed (in an MDM) then the assumption should be that anything and everything happening on the device can be seen at any time. The conundrum is that Mac OS is such a personal user-centric operating system that it appears to be difficult for users not to take advantage of those features. It's almost like when you put a treat in front of someone - even if they didn't want it before, once it's right in front of them they suddenly want it.
Edit: Clarification / expounding
If the devices are managed (in an MDM) then the assumption should be that anything and everything happening on the device can be seen at any time. The conundrum is that Mac OS is such a personal user-centric operating system that it appears to be difficult for users not to take advantage of those features. It's almost like when you put a treat in front of someone - even if they didn't want it before, once it's right in front of them they suddenly want it.
Edit: Clarification / expounding
Apple has never grokked the Enterprise market. Never.
At best, they understand the workgroup market reasonably well. Anything above the workgroup is an alien concept to them.
Apple is nothing but a massive collection of workgroups, and workgroups of workgroups.
At best, they understand the workgroup market reasonably well. Anything above the workgroup is an alien concept to them.
Apple is nothing but a massive collection of workgroups, and workgroups of workgroups.
It makes a bit more sense when you understand that Apple employees genuinely dogfood on their work devices with personal data.
I've always wondered about that, that's interesting. Apple definitely makes it look like this is the expected use case in the WWDC demos and stuff but I can't imagine every employee is happy to give their employer access to their personal text messages.
I've had some limited experience with Apple as a small business.
My observation is that Apple's commitment varies a lot from year to year, and especially from city to city.
Chicago was great. Seattle (well, Bellevue) not at all.
My observation is that Apple's commitment varies a lot from year to year, and especially from city to city.
Chicago was great. Seattle (well, Bellevue) not at all.
I don’t think it’s unusual considering 99% of their business is B2C
Music, cinema, photography, design — all the businesses that have historically represented the stereotypical core Apple markets are composed of smaller businesses. I expect the vast majority of those to be SMEs (at least in headcount if not turnover), and even very large players like ILM and Weta fall under 1500ish employees.
I thinks it's one of their strengths. They really do seem to focus more on the individual than organisations. We all know who to go to for the enterprise alternative and the baggage that comes with that.
"with Google Workspace identity services, allowing employees to log in to their device with a single business username and password"
This is huge, especially if it will work easily without the need for intermediary identity services to make it all work.
This is huge, especially if it will work easily without the need for intermediary identity services to make it all work.
> "Managed Apple IDs can be created by federating with Microsoft Azure Active Directory and, coming later this spring, with Google Workspace identity services, allowing employees to log in to their device with a single business username and password. Apple Business Essentials works with company-provided and personally owned devices"
Just to temper your expectations, I don't believe they're talking about signing into Apple devices using Google identity services directly. Google identity services (and other identity providers) can be used to provision managed Apple ID's that can be used to log into the devices. It's basically just pulling the username from LDAP and creating a <[email protected]> account that can be used in place of your normal Apple ID. All of the accounts created this way will still reside in Apple Business Manager / on Apple's servers, so if you disconnected the IdP connection Google would have no power there.
Just to temper your expectations, I don't believe they're talking about signing into Apple devices using Google identity services directly. Google identity services (and other identity providers) can be used to provision managed Apple ID's that can be used to log into the devices. It's basically just pulling the username from LDAP and creating a <[email protected]> account that can be used in place of your normal Apple ID. All of the accounts created this way will still reside in Apple Business Manager / on Apple's servers, so if you disconnected the IdP connection Google would have no power there.
AFAIK, this has been possible with Azure AD for a while. I think the service on Apple's end was called something like Apple for Business and you could cut a cert from it to link to Intune (an MDM) and get pre-enrolled devices directly from Apple with single sign on.
I might also be mis-remembering this, it's been a hot minute since I've dealt with this stuff.
I might also be mis-remembering this, it's been a hot minute since I've dealt with this stuff.
[deleted]
[deleted]
I wonder how this will affect MDMs like Jamf. So far it seems that Jamf is what most Mac-centric organizations use.
It might clobber Jamf... however, compared to Fleetsmith or Small Business Essentials, Jamf is a Massive PITA to use and configure. If they had a better product, honestly, we might not see Apple making moves to replace a messy supplier that does plenty to embarrass Mac in the enterprise.
Jamf is onerous to use. Are they still requiring two days of training with a purchase? Last time I tried to purchase the product, they would not let me skip two days of training. As a fast growing <10-engineer startup at the the time, I had negative time to spare — spending two working days in training for a glorified CPanel-like mishmash of obtuse software was a non-starter.
We ended up going with a small MDM vendor, which was just barely passable enough to compliantly manage a fleet of Macs with somewhat minimal time investment. Still, it came with fully employee spy mode turned on (website monitoring on by default) and had promised features, such as FDE key escrow, that barely ever worked in practice.
So thank god for Apple Business Essentials, this is a blessing for every startup that runs a fleet of Macs.
We ended up going with a small MDM vendor, which was just barely passable enough to compliantly manage a fleet of Macs with somewhat minimal time investment. Still, it came with fully employee spy mode turned on (website monitoring on by default) and had promised features, such as FDE key escrow, that barely ever worked in practice.
So thank god for Apple Business Essentials, this is a blessing for every startup that runs a fleet of Macs.
JAMF Now doesn't make you do that. It is missing some features, nothing that important for provisioning Macs (I believe there's shell script support?).
I don't know how many small companies are using Jamf, but they may lose some of that business. I doubt Apple is going to make Essentials powerful enough for medium-large companies though, so Jamf is likely ok for a while.
Anecdotal, but I recently picked Jamf over Essentials for a ~30 person company because Essentials was just too limited. I really, really wanted it to work. Not having another company involved felt so nice. But I just couldn't do most of what I needed.
They have been adding features, but it's still way, way short of what Jamf can do. Particularly around enrollment options, although it seems they've finally added the ability to do user-based enrollment without wiping the machine?
Anecdotal, but I recently picked Jamf over Essentials for a ~30 person company because Essentials was just too limited. I really, really wanted it to work. Not having another company involved felt so nice. But I just couldn't do most of what I needed.
They have been adding features, but it's still way, way short of what Jamf can do. Particularly around enrollment options, although it seems they've finally added the ability to do user-based enrollment without wiping the machine?
Probably some? I used to work in client platform engineering. Most teams recognized that this was going to happen back when Apple acquired Fleetsmith in 2020. It will most likely compete with non-enterprise MDM space (think Jamf Now) at first.
Yeah, one issue with Jamf is that they were at the whim of Apple's OS updates (certain features would become deprecated). This has huge potential considering how many tech companies have fleets of Apple products
We've recently binned Jamf in favour of Kandji and couldn't be happier
I think jamf is trying to be multi platform. Unfortunately for them MDM is a pretty crowded market, so they're probably going to struggle as Apple commoditizes their niche.
I've read that Apple allows certain types of users, I think corporate users and some developers, to have a root of trust (cryptographic security root) other than Apple. Essentially it gives the customer full control of their own devices, at least from a security perspective.
Do I have that right and is it available with Business Essentials, does anyone know?
Do I have that right and is it available with Business Essentials, does anyone know?
I hope they have fixed the bugs in this because I tried it out and we had problems on at least half of the enrollments. This whole thing smells like an aqui-hire with an aggressive rollout schedule.
Ironically, I receive a “browser not supported” message when attempting to sign up via Safari on iOS. May be due to the fact that I’m on public beta.
Thats great, but what if my employees don't have iPhones?
As a one man band, this basically means I cannot use Apple Business Essentials unless I lie/make up details during the application process (which includes phone verification with a real Apple human - so this is not a trivial thing to bypass).
Utterly baffling, as I could really use some of the features of this program, but I can’t.
This doesn’t just affect me. I work with larger companies on IT projects so am in a position to advocate (or not) for products and services, and so this is one I will obviously not be recommending if I can’t get into it myself!
Edit: one of the things I was trying to achieve was to setup some way to buy apps on the App Store under my company (different card and billing address etc), which presumably needs a separate Apple ID. At the moment I normally have to buy apps outside of the App Store (where possible) in order to be able to pay with my company rather than personal details (important for tax/accounting etc for business expenses).
Does anyone have a solution (as a sole trader) for running two Apple IDs, one for personal and one for business?