ACSP Network Services Management 2 — Questions and Answers
Question 1: What is Apple Business Manager (ABM) and what does it provide for enterprise Mac deployment?
- ABM is Apple's web portal for business that enables Automated Device Enrollment (ADE), Volume Purchase Program (VPP), and Managed Apple IDs for enterprise Mac management (Correct answer)
- ABM is Apple's on-premise server software for managing enterprise Macs without internet connectivity
- ABM is an MDM solution that provides device management features directly without requiring a third-party MDM server
- ABM is Apple's enterprise Wi-Fi management system for configuring secure wireless networks
Correct answer: ABM is Apple's web portal for business that enables Automated Device Enrollment (ADE), Volume Purchase Program (VPP), and Managed Apple IDs for enterprise Mac management
Apple Business Manager is a web-based portal that enables: Automated Device Enrollment (ADE/DEP) for zero-touch MDM enrollment, Volume Purchase Program for bulk app and book purchasing, and Managed Apple IDs for organizational accounts separate from personal Apple IDs.
ABM (business.apple.com) integrates with third-party MDM solutions (Jamf, Microsoft Intune, Mosyle, Kandji, etc.) via an MDM server token. Automated Device Enrollment (formerly DEP) means new Macs purchased through authorized Apple resellers are automatically enrolled in ABM and will auto-enroll in MDM at first boot — users cannot skip or remove MDM. Apps purchased via ABM Apps and Books can be licensed to devices without requiring an Apple ID on the device. Managed Apple IDs allow organizational accounts with IT-controlled passwords. Schools use Apple School Manager (ASM), the education equivalent.
Question 2: What is MDM (Mobile Device Management) enrollment and what types are supported on macOS?
- MDM enrollment registers a Mac with a management server; types include Automated Enrollment (via ADE/ABM), User Enrollment, and Device Enrollment (profile-based) (Correct answer)
- MDM enrollment is only available for iOS devices; Macs use a separate Apple Remote Desktop protocol for management
- MDM enrollment is a one-time process; once enrolled, the device cannot be unenrolled without reformatting
- MDM enrollment requires macOS Server running on-premises to manage the enrolled devices
Correct answer: MDM enrollment registers a Mac with a management server; types include Automated Enrollment (via ADE/ABM), User Enrollment, and Device Enrollment (profile-based)
macOS MDM enrollment types: Automated Device Enrollment (ADE, via ABM — supervisor-level, cannot be removed by user), Device Enrollment (user installs profile — can be removed), and User Enrollment (privacy-preserving BYOD enrollment that separates personal/managed data).
ADE (Automated Device Enrollment): Mac is pre-enrolled via ABM; MDM profile is installed automatically at setup; is MDM-supervised; user cannot remove the profile. Device Enrollment: user or admin manually installs an enrollment profile; not supervised; user can remove if not protected. User Enrollment (BYOD): uses Managed Apple ID; creates separate partition for managed data; has limited MDM capabilities to protect user privacy; user can unenroll anytime. For corporate-owned Macs, ADE is strongly recommended for full management capabilities including supervised features like content filtering, always-on VPN, and restricting system settings.
Question 3: What macOS feature allows administrators to distribute configuration profiles, and what can these profiles configure?
- Configuration profiles (.mobileconfig files) are XML-based files that configure Wi-Fi, VPN, email accounts, certificates, restrictions, and many system settings, distributed via MDM or manual installation (Correct answer)
- Configuration profiles are only used for distributing Wi-Fi and VPN settings and cannot configure other system features
- Configuration profiles are binary files that can only be created and distributed through Apple's own MDM solution
- Configuration profiles require the Mac to be in supervised mode before any profile can be installed
Correct answer: Configuration profiles (.mobileconfig files) are XML-based files that configure Wi-Fi, VPN, email accounts, certificates, restrictions, and many system settings, distributed via MDM or manual installation
Configuration profiles are XML-based .mobileconfig files that can configure virtually any manageable macOS setting including Wi-Fi, VPN, email/calendar accounts, certificates, passcode policies, system restrictions, app configurations, and security settings.
Configuration profiles can be distributed via MDM (pushed silently) or manually (by emailing the .mobileconfig file, hosting it on a web server, or installing directly via command line with 'profiles install -path ...'). Payload types: Wi-Fi (auto-configure enterprise Wi-Fi), VPN (pre-configure VPN connections), Certificate (install trusted CAs or user certificates), Email/CalDAV/CardDAV, Passcode (enforce password complexity), Restrictions (block AirDrop, App Store, screen recording), and many more. Profiles are viewed/removed in System Settings > Privacy & Security > Profiles. Profiles from MDM may be 'locked' and require MDM unenrollment to remove.
Question 4: What is the purpose of a Certificate Authority (CA) certificate and why would a company need to install one on managed Macs?
- A CA certificate establishes trust in the company's own certificate infrastructure, allowing Macs to trust internal HTTPS sites, VPNs, and network authentication without security warnings (Correct answer)
- A CA certificate is required to unlock the Mac App Store for enterprise app distribution
- A CA certificate replaces the need for a VPN by encrypting web traffic at the browser level
- A CA certificate is an Apple-issued document that proves the Mac is enrolled in Apple Business Manager
Correct answer: A CA certificate establishes trust in the company's own certificate infrastructure, allowing Macs to trust internal HTTPS sites, VPNs, and network authentication without security warnings
A root CA certificate, when installed on managed Macs, makes macOS trust all certificates signed by that CA. Companies install their internal CA to enable trusted HTTPS for internal web apps, WPA2-Enterprise Wi-Fi authentication, and VPN certificate authentication without browser warnings.
Enterprise PKI (Public Key Infrastructure) uses an internal CA to issue certificates for internal services. Without the CA cert installed, Macs show 'Your connection is not private' for internal HTTPS sites. Installed via MDM or configuration profile (Certificate payload), the CA cert is added to the macOS System Keychain with full trust. This enables: internal HTTPS without warnings, WPA2-Enterprise (EAP-TLS) Wi-Fi authentication using device certificates, mutual TLS for VPN connections. The Keychain Access app shows installed certificates under 'System' and 'System Roots' keychains. Never install an untrusted CA from an unknown source — it could enable man-in-the-middle attacks.
Question 5: How does macOS directory services integration with Active Directory work for user authentication?
- Macs can join an Active Directory domain via System Settings > Users & Groups > Login Options, allowing AD users to authenticate with their domain credentials (Correct answer)
- Active Directory integration requires installing Apple's macOS Server app on a Windows Server
- Macs can only join Active Directory using the 'dsconfigad' Terminal command; there is no GUI option
- Active Directory integration on macOS is limited to read-only access of the AD user database
Correct answer: Macs can join an Active Directory domain via System Settings > Users & Groups > Login Options, allowing AD users to authenticate with their domain credentials
macOS has built-in Active Directory (AD) integration. Macs can join an AD domain through System Settings > Users & Groups > Login Options > Join, or via the Terminal command 'dsconfigad'. Once joined, AD users can log in to the Mac using their domain username and password.
AD binding in macOS: System Settings > Users & Groups > Login Options > Network Account Server > Join, or 'dsconfigad -add domain.com -username admin -password pass'. This creates a computer account in AD. After binding, domain users can log in via login window. Home directories can be created locally on first login. Group policies (GPOs) are NOT natively supported — use MDM or third-party tools (Jamf, SCCM via co-management). The 'dscl' and 'id' commands can query AD user info. 'dsconfigad -show' displays current binding. Many enterprises use Kerberos for SSO after AD binding — 'klist' shows current Kerberos tickets.
Question 6: What is Zero Touch Deployment for Macs and what technologies enable it?
- Zero Touch Deployment uses Apple Business Manager + MDM to automatically enroll and configure new Macs out of the box, requiring no IT hands-on setup before delivery to the user (Correct answer)
- Zero Touch Deployment uses Apple Remote Desktop to push configuration scripts to Macs as soon as they appear on the network
- Zero Touch Deployment requires the Mac to have macOS Server installed to bootstrap the configuration process
- Zero Touch Deployment is a third-party solution; Apple does not provide native support for hands-free Mac provisioning
Correct answer: Zero Touch Deployment uses Apple Business Manager + MDM to automatically enroll and configure new Macs out of the box, requiring no IT hands-on setup before delivery to the user
Zero Touch Deployment combines Apple Business Manager (Automated Device Enrollment) with an MDM solution (Jamf, Intune, Mosyle, etc.) to automatically configure Macs upon first boot — apps install, settings configure, and the device is fully managed without IT touching the hardware.
Zero Touch workflow: 1) Company purchases Macs through Apple or authorized reseller linked to their ABM account. 2) Macs automatically appear in ABM. 3) ABM assigns Macs to the MDM server. 4) User turns on Mac, goes through Setup Assistant — MDM enrollment happens automatically. 5) MDM pushes configuration profiles, installs apps, configures settings, applies security policies. User gets a fully configured Mac without IT intervention. Tools like Jamf Pro, Microsoft Intune, Mosyle, Kandji, Addigy, and Mosyle enable the MDM side. This approach scales to deploying thousands of Macs globally with consistent configuration and significant IT labor savings.
ACSP Network Services Management 2
What is Apple Business Manager (ABM) and what does it provide for enterprise Mac deployment?