Apple replaced Apple Business Manager with Apple Business on April 14, 2026. This page keeps the name Apple Business Manager, the setup is the same for both.
Capabilities
Provisioning
AccessOwl creates users in your Apple Business Manager organization with the requested role during access requests.
Deprovisioning
AccessOwl deactivates users in your Apple Business Manager organization during access revocations.
Prerequisites
- Organization Administrator access to your Apple Business Manager organization, so you can add the integration account with the same role.
- Your organization and its domain are verified in Apple Business Manager. Users can only sign in once the organization is verified.
Setup
1
Add Apple Business Manager in AccessOwl
Either add a new application or open Applications and click the +-symbol, then continue.
2
Add the integration account as Organization Administrator
AccessOwl shows you the integration account’s email address. In Apple Business Manager:
- Go to People > Users and click Add.
- Enter a first and last name, and use the integration account’s email address as the Email address.
- Under Role, select Organization Administrator.
- Click Save.
The integration account needs Organization Administrator because it is the only role that can manage every other role, including other Organization Administrators. An IT Administrator cannot manage Organization Administrators, so requests or revocations for that role would result in a reassignment error.
3
Send the sign-in information with Create Sign-In
Apple Business Manager doesn’t send any email when you add a user, so you need to send the sign-in information yourself.
- In People > Users, select the integration account.
- Click Create Sign-In, choose to email the information to the user, then click Continue.
FAQ
Why didn't the integration account receive the sign-in email from Apple?
Why didn't the integration account receive the sign-in email from Apple?
Apple only sends the sign-in email when you select Create Sign-In and choose email. Adding the user doesn’t send anything. If the integration account’s inbox was disabled when the email went out, the email is lost and enabling the inbox afterwards doesn’t bring it back. Open the integration account in People > Users, select Create Sign-In again and choose email. Retrying the setup in AccessOwl doesn’t resend it. The temporary password is valid for 90 days, and the account stays inactive until the integration account signs in and changes it.
Are revoked users deleted from Apple Business Manager?
Are revoked users deleted from Apple Business Manager?
No. AccessOwl deactivates the user, which signs them out and blocks sign-in with their Managed Apple Account. Apple deletes a manually created account automatically once it has been deactivated for more than 30 days. To delete it earlier, open the user in People > Users, click More and select Delete.
Does this manage users synced from Google Workspace or Microsoft Entra ID?
Does this manage users synced from Google Workspace or Microsoft Entra ID?
No. Users that Apple Business Manager syncs from your directory are created and deactivated by that sync. AccessOwl manages the users that are added directly in Apple Business Manager.