Apple Business
Apple Business (formerly Apple Business Manager) is where your organization manages its Managed Apple Accounts, the roles people hold, and the Apple devices you own. Connecting it lets Ploy show who holds which Apple Business role at each organizational unit, who belongs to each organizational unit and user group, and which devices your organization owns.
This integration is in beta. It was built from Apple's API documentation and has not yet run against a live Apple Business organization. Everything it reads works the same way as any other integration, and Ploy only reads: it changes nothing in Apple Business.
What Ploy reads
People: everyone in your Apple Business directory, including external users, with their status (active, new, locked, deactivated or released).
Roles: each role a person holds and the organizational unit it covers, for example "People Manager (Sales)".
Organizational units and user groups: each one, and who belongs to it.
Devices: each Apple device your organization owns, with its model, serial number and whether it is assigned to a device management service. Apple Business does not record who uses a device; your MDM (such as Kandji, Jamf or Intune) does.
Ploy does not read sign-in history, two-factor status or passwords. Apple Business does not provide them.
Before you start
You need to sign in to Apple Business as an Organization Administrator. Only that role can create API accounts.
Step 1: Create an API account in Apple Business
Sign in to Apple Business at business.apple.com.
Open Settings, then API.
Choose Add API Account. Enter a name, such as "Ploy".
Choose a role for the API account that can view users, user groups, organizational units and devices. Then choose Next.
Choose Generate & Download to download the private key. Keep the .pem file safe: Apple lets you download it only once.
Choose Edit on the new API account to see its client ID (it starts with BUSINESSAPI.) and its key ID.
If your organization moved over from Apple Business Manager, older API accounts usually have a role that can only see devices. Create a new API account for Ploy, or give the existing one a role that can view users.
Step 2: Connect in Ploy
In Ploy, open Integrations and choose Apple Business.
Because this integration is in beta, the first page asks you to agree to share redacted error data. If Apple Business returns an error while Ploy reads it, Ploy keeps a copy of the error with names, email addresses and other personal details removed, so we can fix the integration quickly. Tick the box to continue.
Enter the client ID and key ID.
Open the .pem file in a text editor and paste all of it into Private key, including the BEGIN and END lines.
Choose Connect. Ploy checks it can list your people before saving.
How often Ploy reads Apple Business
People, roles and organizational units every 2 hours, user groups every 6 hours, and devices once a day.
Troubleshooting
"Apple Business rejected these credentials": check the client ID and key ID belong to the same API account, and that the private key is the one generated for it. If someone regenerated or revoked the key in Apple Business, paste the new one.
"Connected, but the API account cannot list users": the API account's role cannot view users. Change the role in Apple Business under Settings, then API.
Access stops updating: contact Ploy support. When Apple Business returns something Ploy cannot read, such as a role at an organizational unit Ploy could not name, Ploy keeps the last good picture and removes nobody's access, rather than guess.