Apple Business Manager

The Corma and Apple Business Manager integration keeps the accounts, roles and app licenses behind your Apple fleet in line with your workforce. Apple Business Manager is now part of Apple Business: Apple announced it on March 24, 2026, and from April 14 the new free service replaced Apple Business Manager, Apple Business Essentials and Apple Business Connect. For IT, the job stays the same: decide who can enroll devices, buy apps and administer the organization.

Key takeaways

• Apple Business Manager is now Apple Business, a free service available since April 14, 2026, that replaced Apple Business Manager, Business Essentials and Business Connect.
• Apple Business has five default roles, from Organization Administrator to Staff, plus custom roles such as People Manager, Device Enrollment Manager and Content Manager.
• When a synced user is removed in the identity provider, the Apple Business account is deactivated, signed out of devices and removed after 30 days unless synced again.
• Organization Administrators cannot sign in with federated authentication, so their accounts sit outside your identity provider's offboarding.

Which Apple Business accounts escape your IdP?

Directory sync covers most of the workforce. Apple Business can sync user accounts from an identity provider with OpenID Connect or SCIM, linked to Google Workspace, Microsoft Entra ID or another IdP, one at a time. Synced accounts get the Staff role and their data is read-only, except the role. When a user is removed in the IdP, the matching account is deactivated and flagged for deletion.

Privileged accounts are the exception. Organization Administrators, and any custom role allowed to set up federation, can't sign in with federated authentication, so a departure does not close them through the IdP. Apps are the other asset to watch: licenses obtained through Apple Business can be revoked and reassigned, and the organization keeps ownership. Only Organization Administrators can create API accounts, up to 50 per organization.

How Corma governs Apple Business Manager

• Admin roles under review: Organization Administrators, IT Administrators and custom roles with device or content rights go into automated access reviews.
• Leavers beyond the IdP: a leaver workflow in the IT Workflow Builder asks an Organization Administrator to deactivate any account that is not synced from the IdP, starting with administrators.
• App licenses back in the pool: the same workflow can remind the Content Manager to revoke and reassign a leaver's app licenses, a simple form of license reclaim.
• API accounts with an owner: Apple Business API accounts are non-human identities, so each one needs a named owner and a regular check.

Frequently asked questions

Does Apple Business support SSO and SCIM?

Yes. Federated authentication links Apple Business to Google Workspace, Microsoft Entra ID or another identity provider, and accounts can be synced with OpenID Connect or SCIM. The Activity view in Settings records role assignments, deactivations, deletions and SCIM provisioning events. Read what SCIM automates.

How does Corma connect to Apple Business Manager?

Through the Apple Business API to read user information, or through Corma's browser-based agents for changes, since the API's documented user operations only read user information. Corma governs your device management tools the same way, such as Jamf.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know which Apple admin accounts your IdP cannot close? Book a Corma demo.