Apple Business Manager is the central portal for buying, assigning, and distributing both App Store and private apps across your organisation's devices. Link it to a mobile device management (MDM) platform first, before touching licences or enrolment settings, because nothing else in the workflow functions without that connection. Once linked, you can push apps silently, reassign licences when staff move roles, and manage custom in-house apps without ever touching an end user's device.
TL;DR:
- Apple Business Manager holds licenses centrally, enabling volume purchases and license reassignments without requiring users' Apple IDs.
- Linking ABM to MDM is mandatory and requires renewing the device management token annually to prevent deployment failures.
- Private apps distributed via ABM can be configured for silent or forced installs and are easier to reassign or revoke when staff roles change or they leave.
- Automated Device Enrollment is recommended for company-owned hardware, allowing silent app pushes and device setup, while User Enrollment suits BYOD with limited management.
- Building deployment-ready private apps with proper packaging and support greatly improves the efficiency of internal workflows compared to off-the-shelf solutions.
Table of Contents
- What is Apple Business Manager for app distribution?
- How do you deploy apps through Apple Business Manager?
- Distributing private or in-house apps through Apple Business
- Automated Device Enrollment or User Enrollment?
- How do you add and push an app in Apple Business Manager?
- When does a bespoke app make more sense than off-the-shelf?
- How Pocketapp supports your Apple Business deployment
- Where to go for the official detail
- Sources
- FAQ
What is Apple Business Manager for app distribution?
Apple Business Manager (ABM) isn't an app store. It's the ownership and inventory layer that sits above one. Think of it as the ledger that records which app licences your organisation owns, which devices belong to you, and which identity system your staff sign in with. The actual pushing of software onto devices happens through your MDM. ABM decides who's entitled to what.
That distinction matters for how you plan a rollout. Because your organisation owns the licences rather than individual employees, IT can reassign or revoke an app the moment someone leaves a project or the company, with no App Store login or personal Apple ID involved anywhere in the process.
ABM does three jobs that make everything downstream possible:
- Maintains a live device inventory, so your MDM knows which hardware is corporate-owned versus personal
- Holds purchased app licences centrally, letting you buy in volume rather than expensing individual App Store transactions
- Supports Managed Apple Accounts and identity provider integration, so sign-in for apps and services ties back to your existing directory, not a personal Apple ID
The practical upshot: nobody in your organisation needs their own Apple ID to receive a managed app, and nobody can simply walk off with a licence when they leave.
How do you deploy apps through Apple Business Manager?
Deployment is a chain of four dependencies, and skipping a link breaks the whole thing. Here's the order that actually works.
- Connect ABM to your MDM. In ABM, create (or locate) your device management service entry, then generate and upload the MDM server token. This token is what authorises your MDM to talk to ABM on your organisation's behalf, and linking Apple Business with a third-party MDM is the mandatory first step before any app purchasing or assignment can happen.
- Buy or register the app. For App Store titles, purchase licences in volume directly through ABM's app catalogue. For internally built software, add the custom app entry instead, usually supplied by your developer via App Store Connect.
- Choose your assignment target. You can assign licences to individual users, to groups defined in your identity provider, or directly to devices, which suits shared or kiosk-style hardware better than user-based assignment does.
- Push and monitor. Your MDM handles the actual install, and it can enforce a silent install, a forced install that a user cannot skip, or a background redownload when a device is wiped and re-provisioned. Revoking a licence pulls the app from the assigned target on the MDM's next check-in cycle.
The one detail that trips up almost every IT team eventually: device management service tokens expire after about one year, and an expired token halts every management task, not just app pushes, until you generate and upload a replacement.
Pro Tip: Put the token renewal date in a recurring calendar reminder with an owner assigned, not just a note in a wiki. Token expiry is silent until it isn't, and it typically surfaces as a mysterious deployment failure weeks after the actual expiry date.
Distributing private or in-house apps through Apple Business
Custom apps aren't a bolt-on feature. Apple Business supports custom app distribution as a first-class path, letting organisations deliver software built specifically for their own workflows to their own staff, or even to a specific client or partner organisation, without ever appearing in the public App Store.
The delivery mechanism runs through your developer's App Store Connect account, which submits the private build into your organisation's ABM catalogue rather than the public listing. From there, the app behaves much like any assigned App Store title, with a few practical differences worth planning around:
- Mac apps assigned directly by an organisation can be configured to auto-install and are often harder for the end user to remove than a standard App Store download.
- Update control sits entirely with IT. Your developer pushes new builds to App Store Connect, and your MDM decides when devices actually receive them, so version rollout is your call, not the user's.
- Reassignment works exactly like licensed App Store apps. If someone changes role or leaves, you revoke and reassign without involving them at all.
This is where a lot of internal tooling lives quietly and effectively. A custom app to support internal operations doesn't need a marketing plan or App Store reviews. It just needs to work for the people using it and stay under your update control.
Automated Device Enrollment or User Enrollment?
The enrolment method you choose decides how much control you actually have once a device is in someone's hands, and getting it wrong in either direction causes real friction.
Apple's own deployment guidance is blunt about the split: choose Automated Device Enrollment for organisation-owned hardware where zero-touch provisioning and forced app installs are the point, and choose User Enrollment when the device belongs to the person using it and privacy has to come first.
- Automated Device Enrollment (ADE) suits company-owned phones, laptops, and kiosk devices. Apps can be silently pushed, forcibly installed, and made non-removable by the user, and Mac devices can even skip most of Setup Assistant entirely with Auto Advance, provided the machine runs macOS 11 or later and is registered by serial number in ABM.
- User Enrollment (UE) suits BYOD. Management is intentionally limited: personal data stays separated from corporate data, and the organisation cannot forcibly install or block removal of apps the way it can under ADE.
Security teams frame the trade-off in similarly stark terms. Enrolling a device and applying policy lets IT enforce passcodes, encryption, and remote wipe, but User Enrollment exists specifically because full device control on someone's personal phone isn't a reasonable ask, and Apple built the split rather than forcing every deployment into one mode.
Pick ADE by default for anything the company purchased outright. Reserve User Enrollment for the BYOD population you can't and shouldn't try to lock down the same way.
How do you add and push an app in Apple Business Manager?
This is the runbook version. Keep it near your deployment documentation.
- Verify your organisation's domain and account setup in ABM before doing anything else; a shaky foundation here causes downstream failures that look like app problems but aren't.
- Set up Managed Apple Accounts for staff who need them, ideally synced from your existing identity provider rather than created manually one by one.
- Generate or refresh your MDM server token and confirm the connection status shows active, not just "connected at some point."
- Purchase the App Store licence, or register the custom app supplied by your developer through App Store Connect.
- Assign the app to the correct target, users, groups, or devices, matching the enrolment type those devices actually use.
- Push the install, then verify on at least one test device before rolling out fleet-wide.
- Revoke or reassign the moment a staff member's role changes, rather than batching licence clean-up for later.
Pro Tip: If an app "goes missing" for a user despite being assigned, check three things in this order: token expiry status, whether the enrolment type actually supports the install behaviour you configured, and whether the App Store is hidden on that device (hidden App Store doesn't block managed installs, but it confuses admins troubleshooting blind).
The most common failure clusters are entirely predictable: an expired MDM token that nobody scheduled a renewal for, a device enrolled under the wrong mode for what the app assignment expects, and licences never reclaimed after a staff departure.
When does a bespoke app make more sense than off-the-shelf?
Most of what lands in Apple Business Manager is App Store software licensed at scale, and that's the right call for common tools. But once your workflow involves proprietary data handling, a bespoke internal process, or integration with systems no commercial app was built to talk to, custom development starts paying for itself fast.
There are companies with years of experience building this category of software, private apps distributed through App Store Connect and handed off cleanly into client MDM environments, across sectors like healthcare and retail. The handover matters as much as the build: an app that's technically excellent but arrives without proper App Store Connect packaging or clear MDM documentation becomes IT's problem on day one. A custom business application built with deployment in mind avoids that entirely.
If you're weighing a quick no-code prototype against a full build, it's worth understanding what no-code platforms can and can't do before committing either way.
— Paul
How Pocketapp supports your Apple Business deployment
If you've read this far, you've likely realised that the technical plumbing, tokens, enrolment modes, licence reassignment, is only half the job. The other half is building software worth deploying in the first place, and packaging it so your MDM team receives something clean rather than a headache.
Some development partners support IT teams when an off-the-shelf App Store title won't cover a genuinely internal workflow, handling discovery, secure app builds, App Store Connect submission, and direct liaison with MDM administrators so private apps arrive ready for assignment. That last step is where a lot of internal projects stall: a technically sound app with no clear deployment path just sits unused. For guidance specific to connecting your build pipeline with device management platforms, our app deployment strategy guide covers the operational side in more depth.
If your organisation needs a private app built and delivered ready for Apple Business Manager assignment, get in touch about mobile app development and we'll talk through what a deployment-ready build looks like for your team.
Where to go for the official detail
For exact screens and the latest feature changes, go straight to Apple's own Business - Apps support guide and the Apple platform deployment guide. For MDM policy and security context beyond Apple's own documentation, Jamf's explainer on MDM is a solid starting point.
FAQ
How do I add apps in Apple Business Manager?
Link your ABM account to an MDM first, then either purchase App Store licences in volume or register a custom private app supplied through App Store Connect, and assign it to users, groups, or devices from there.
What can I do with Apple Business Manager?
You can maintain a device inventory, buy and hold app licences centrally, distribute both App Store and private apps, manage Managed Apple Accounts, and control enrolment through Automated Device Enrollment or User Enrollment.
How do I manage apps in Apple Business?
Manage installs, updates, and revocations through your linked MDM, since ABM handles licence ownership and assignment while the MDM executes the actual push, silent install, or removal on each device.
What is the difference between Apple Business and Apple Business Manager?
"Apple Business" typically refers to Apple's broader enterprise offering and support documentation, while Apple Business Manager is the specific web portal administrators use to buy apps, manage devices, and assign licences.
What happens if my MDM server token expires?
Device management tasks stop working until you generate and upload a new token, so scheduling renewal about once a year, before the token expires, avoids an unplanned service interruption.