Managing company Macs: Apple Business Manager, MDM and FileVault

In many small offices the Macs arrive one at a time. A designer needs one, then a new hire asks for a MacBook Air, then the owner switches. Each one gets set up by whoever unboxes it, signed in with that person's own Apple Account, and left to update itself whenever it gets around to it. That works until someone leaves, a laptop goes missing from a car, or an auditor or insurer asks how company data on those machines is protected. This guide covers what a small business needs to manage Macs properly, from the free Apple account that ties it all together to what happens when an employee hands their Mac back.

Start with Apple Business Manager

Apple Business Manager is Apple's free web portal for organizations. It is the foundation for everything else in this guide, and it is worth setting up even if you only have a handful of Macs. You enroll the business, not a person, so expect Apple to verify the organization. You will need a D-U-N-S number for your legal entity and a contact who can confirm you are authorized to sign up on its behalf.

Once the account is approved, Apple Business Manager does three useful things:

• It records which devices belong to the company. Macs bought from Apple's business channel, or from an authorized reseller or carrier that you have linked to your account, can appear in the portal automatically as company devices.
• It hands those devices to your management tool. You assign them to a mobile device management (MDM) service, so a new Mac enrolls itself the first time it connects to the internet during setup.
• It lets you create Managed Apple Accounts for staff, owned by the business rather than the individual. These can be connected to Microsoft Entra ID or Google Workspace so people sign in with their work credentials.

Macs you already own can usually be added too, using Apple Configurator on an iPhone during setup. Expect to erase the Mac to do it, and note that manually added devices have a 30-day provisional period during which the user can remove the enrollment. So plan it as a refresh, not a quick change.

Choose an MDM and enroll every Mac

An MDM is the service that pushes settings, apps and security policies to your Macs and reports back on their state. Microsoft Intune is included in some Microsoft 365 plans and suits offices that already run on Microsoft. There are also Mac-focused MDM products that support Apple features in more depth. The right choice depends on how many Macs you have, what else you manage, and who will look after it day to day.

What matters more than the brand is how the Macs get enrolled. With automated device enrollment through Apple Business Manager, the Mac is supervised, enrollment happens during the setup screens, and the user can't simply remove the management profile. A Mac that was enrolled by downloading a profile by hand is much easier to unenroll, and you get fewer controls over it.

Settings worth enforcing from day one

A sensible baseline for most small businesses is short:

• FileVault turned on, with the recovery key escrowed in the MDM. FileVault encrypts the startup disk, so a lost or stolen Mac doesn't expose client files. Escrowing the key means IT can unlock the Mac if an employee forgets their password or leaves. Without it, that data can be gone for good.
• macOS and app updates with a deadline. Modern MDMs can require updates by a set date and give users notice before forcing a restart. That beats relying on people to click "Later" less often.
• Firewall on, a screen lock after a short idle time, and a password policy that matches what you use elsewhere.
• Standard user accounts for daily work where practical, with a managed way to grant admin rights for specific tasks, rather than everyone running as an administrator.
• Work apps and settings delivered by the MDM: Microsoft 365 apps, your security software, Wi-Fi profiles and printers, so a replacement Mac can be ready in hours rather than days.

If staff sign in to Microsoft 365 from their Macs, these settings also let you require that only managed, compliant devices can reach company email and files. That pairs well with the identity controls covered on our Microsoft 365 page.

Apple Accounts: personal versus company

A common source of trouble is a company Mac that is tied to an employee's personal Apple Account. If Find My is on with that account, Activation Lock can stop anyone else from erasing and reusing the machine after the person leaves. iCloud Drive and Photos may also have pulled personal and work files together in ways that are hard to untangle.

On a supervised Mac, the MDM can manage Activation Lock so the business keeps control of its own hardware. Decide on a clear rule for whether staff may sign in with a personal Apple Account on company Macs, and whether work files may live in personal iCloud storage. Write the rule down and explain it at onboarding.

When a Mac is lost or stolen

With management in place, a missing Mac becomes a short checklist instead of a crisis:

1. Confirm in the MDM when the Mac last checked in, and whether FileVault was on.
2. Send a remote lock with a PIN, or a remote erase if it is clearly not coming back.
3. Reset the user's Microsoft 365 password and sign them out of active sessions, in case the thief had access to an open, unlocked session.
4. Note the serial number for the police report and your insurer.

If you are not sure whether a missing laptop exposed sensitive data, our cybersecurity team can help you work out what was on it and what to do next.

Offboarding and retiring Macs

When someone leaves, collect the Mac and check in the MDM that its recovery key is escrowed before you change anything. Back up any work data that isn't already in OneDrive, SharePoint or another company system. Then erase the Mac remotely or with Erase All Content and Settings, and let it re-enroll itself for the next person.

When a Mac is sold, recycled or returned at the end of a lease, release it from Apple Business Manager first. Otherwise the next owner will find it trying to enroll in your management service during setup.

Getting started

If your Macs were set up one at a time, the usual order is: create the Apple Business Manager account, choose and connect an MDM, link your reseller so new purchases enroll automatically, then bring existing Macs in one at a time during planned refreshes. Creative IT USA provides Mac support for Apple-only and mixed Windows and macOS offices across Los Angeles County, Ventura County and the Inland Empire. We can plan and run this setup alongside your existing managed IT services.