Before you get started
The Apple Business integration enables allwhere to verify enrollment of new devices against your Apple Business account before they reach your employees, and to fill in missing warranty coverage dates.
Prerequisites
- You must sign in to Apple Business with an Administrator account. Only administrators can create API accounts.
- In allwhere, you must be a Primary Admin role to connect integrations.
How to connect Apple Business to allwhere
Apple Business connects with an API account and a private key. You'll create both in Apple Business first (Steps 1 to 4), then enter them in allwhere (Steps 5 to 8).
Step 1: Open API Settings in Apple Business
Sign in to Apple Business Settings. Under Integrations, click "API".
Step 2: Add an API Account
Click "Add API Account" and enter:
- API Account Name - allwhere
- Role Access - Device API Manager
Click "Next".
Step 3: Generate and Download the Private Key
Click "Generate & Download". The private key downloads as a .pem file.
Important: Apple lets you download the private key only once. Keep it somewhere secure until you've finished connecting. If you lose it, revoke the key in Apple Business and generate a new one.
Step 4: Copy the Client ID and Key ID
Click the new API account to open it, and use the copy buttons to copy:
- Client ID - starts with BUSINESSAPI.
- Key ID - shown under Private Key
Click "Cancel" to close the account. Do not click "Revoke Key". Revoking the key stops the connection from working.
Step 5: Navigate to Integrations
In allwhere, click the Avatar Menu > Select "Integrations"
Step 6: Initiate Apple Business Connection
Click "Connect" next to Apple Business Manager
Step 7: Enter Your Credentials
Enter the Client ID and Key ID you copied in Step 4, and upload the .pem private key file from Step 3. Then click "Connect account".
What happens when you click Connect account:
- allwhere checks your credentials with a single read-only request to Apple
- allwhere stores your Client ID, Key ID and private key, encrypted
- Your first sync runs at the next hourly sync
Step 8: Confirm Connection
You will see the Apple Business Manager settings page.
The page will display:
- Connection status: Connected
- Your Client ID and Key ID
- Private key: Uploaded
The Apple Business Manager card on the Integrations page will also show Connected.
Security and Privacy
What allwhere stores
- Client ID and Key ID, used to identify your Apple Business API account and key.
- Private key, stored encrypted and used only to read your device list and warranty coverage. It is never shown again after you upload it.
- No user credentials - allwhere never sees or stores your Apple Account login.
What allwhere can access
allwhere will only:
- Read the device list from your Apple Business account
- Read AppleCare and warranty coverage for your devices
allwhere will not:
- Add, remove or reassign devices in Apple Business
- Change your Apple Business settings
- Change device enrollment or MDM assignments
How to revoke access
To disconnect Apple Business from allwhere:
- In allwhere, navigate to Integrations > Apple Business Manager and click "Manage"
- Click "Disconnect account"
- Click "Yes, disconnect"
allwhere deletes your stored credentials and stops syncing. Devices that were already matched keep their Apple Business details.
To fully revoke access in Apple Business:
- Sign in to Apple Business API Settings
- Click the allwhere API account
- Click "Revoke Key"
Sync Behavior
allwhere schedules an hourly sync to retrieve the list of devices from your Apple Business account. Devices are matched to your assets in allwhere using the device serial number. If a new match is found, we'll save the enrollment date and run an additional warranty look up to populate the devices' warranty expiration dates.
No new assets or employees will be created from the Apple Business sync. Connect your MDM to add new assets.
No changes are made back to devices in your Apple Business account. This connection is read-only.
Troubleshooting
"Upload a .pem private key file."
Cause: The file you chose isn't a .pem file.
Solution: Upload the private key file you downloaded in Step 3.
"This file isn't a valid private key."
Cause: The file ends in .pem but doesn't contain a valid private key, or it was edited after download.
Solution: Upload the key exactly as Apple downloaded it, without opening or editing it. If you no longer have it, revoke the key in Apple Business and generate a new one.
"We couldn't connect to Apple Business Manager."
Cause: Apple didn't accept the credentials.
Solution:
- Copy the Client ID and Key ID again and check for extra spaces
- Make sure the Client ID, Key ID and private key all come from the same API account
- Make sure the key hasn't been revoked in Apple Business
"You do not have permission to configure integrations"
Cause: Your allwhere account doesn't have the Primary Admin role.
Solution: Ask a Primary Admin in your organization to connect Apple Business.
Devices are not matching
Possible causes:
- The device isn't in allwhere yet
- The serial number in allwhere doesn't exactly match the one in Apple Business
- The first hourly sync hasn't run yet
Solution: Check the device's serial number in allwhere against Apple Business, and wait for the next hourly sync.
Need help?
If you encounter issues not covered in this guide, please contact allwhere support.