Apple Business free MDM in 2026: what small IT teams add on top
Apple Business's free MDM sets up Macs and App Store apps. What to add to install other apps and create accounts for new hires: 7 add-ons ranked.
Updated 27 October 2026 by Simon Mestdagh, founder of Caspian.
TL;DR
- Apple Business Manager is now Apple Business, and its free MDM handles the device: zero-touch enrollment, Blueprints with settings and apps, App Store app distribution, remote lock and wipe, and Managed Apple Accounts created from Google Workspace or Microsoft Entra (Apple Newsroom, checked 27 October 2026).
- Small IT teams add two things on top. First, a way to install and update Mac apps that are not in the App Store. Second, a way to create accounts for new hires in each SaaS app and set their access inside it.
- If you need the second one, add an IT management platform such as Caspian. If you only need a fuller MDM, the usual add-ons are Mosyle, Jamf Now, Kandji (now Iru) and Microsoft Intune.
- Apple's announcement does not describe creating accounts in third-party apps such as Slack or GitHub. Its account automation is for Managed Apple Accounts.
Caspian publishes this article and sells a product in this space. We rank Caspian first for the fit described below, and we say where another tool is the better pick. Facts were checked on 27 October 2026.
Who this is for
You are the one IT person at a Mac-first company of 100 to 1,500 people. Sign-in runs on Google Workspace or Microsoft Entra, and people work in Slack. You have heard that Apple Business includes a free MDM, and you want to know what you still have to add to install apps and create accounts for new hires.
Your current state: a new Mac arrives, and you set it up by hand or with a script. Then you install the apps the App Store does not carry, create the person's accounts in each SaaS app, and add them to the right channels and teams. The future state: the Mac sets itself up on first boot, the apps arrive on their own, and the accounts exist before the person logs in.
What Apple Business's free MDM does
Apple announced Apple Business on 24 March 2026, and it went live on 14 April 2026 in more than 200 countries and regions. It replaces Apple Business Manager, Apple Business Essentials and Business Connect, and Apple offers it "as a free service" (Apple Newsroom).
From Apple's announcement:
- Device management is built in, with one view of devices and settings. It used to be a paid part of Apple Business Essentials, available in the US only.
- Blueprints set up devices "with preconfigured settings and apps".
- Zero-touch enrollment works for devices bought through Apple or an Apple Authorized Reseller.
- Apps: admins "acquire and distribute apps to employees and teams through the App Store". A companion app lets staff install work apps and ask for support.
- Managed Apple Accounts are created automatically for new employees through an identity provider, "including Google Workspace, Microsoft Entra ID, and more".
- Also included: email, calendar and directory with a custom domain, custom roles and groups, and an Admin API.
- Paid add-ons from Apple: iCloud storage and AppleCare+ for Business.
Apple's business page adds that the MDM can push updates and lock or wipe a lost device (Apple Business, checked 27 October 2026). The companion app and email features need macOS 26 or iOS 26.
Our view: for a Mac-first company buying new Macs from Apple, this is a good start. Try it before you pay for an MDM.
What it leaves to you
9to5Mac called the free MDM "a baseline, not a finish line" (9to5Mac). For a new hire, here is where the baseline stops.
| New-hire job | Apple Business free MDM | What small teams add |
|---|---|---|
| Set up the Mac on first boot | Yes, zero-touch for Macs bought from Apple or a reseller | Nothing |
| Wi-Fi, VPN and security settings | Yes, through Blueprints | Nothing |
| Install App Store apps | Yes | Nothing |
| Install apps from outside the App Store (vendor installers) | Not described in Apple's announcement | An app installer, such as Caspian Desktop or a paid MDM |
| Keep those apps up to date | Not described | Same |
| Create the Managed Apple Account | Yes, from Google Workspace or Entra | Nothing |
| Create accounts for new hires in Slack, GitHub, Notion, Figma and the rest | Not described | A provisioning tool such as Caspian |
| Add the person to the right teams, channels, repos and roles | Not described | Same |
| Start all of this from the HR system on day one | Not described | Same |
| Remove access when someone leaves | Wipe or lock the device | Account removal in each app, with approval |
"Not described" means Apple's announcement and business page do not mention it. Apple's Platform Deployment guide has the full detail on what an MDM can do.
Apps outside the App Store
Many tools a company Mac needs ship as a download from the vendor's site, not through the Mac App Store. Apple's announcement describes app distribution "through the App Store" only. If your list includes such apps, you need something that installs them and keeps them current. Microsoft's own Intune guide shows the same pattern: its Company Portal app for macOS "isn't available in the App Store" (Microsoft Learn, checked 27 October 2026).
Accounts and access inside each app
The Managed Apple Account is the person's Apple identity. It is not their Slack, GitHub or Notion account. Your identity provider handles sign-in, and some apps can create accounts from it over SCIM. Many apps have no SCIM, or keep it on an enterprise plan. Slack, for example, offers SCIM provisioning only on Business+ and Enterprise (Slack help, checked 15 October 2026). Even with SCIM, someone still has to put the person in the right channels, teams and roles.
The leaver
NIST SP 800-53 control PS-4, Personnel Termination, asks organizations to "disable system access within [Assignment: organization-defined time period]" of termination and to revoke the person's credentials (NIST SP 800-53 Rev. 5; control text via CSF Tools, checked 27 October 2026). Wiping the Mac does not close the accounts in each SaaS app. Verizon's 2026 Data Breach Investigations Report says breach causes "continue to heavily involve the human element", including stolen credentials (Verizon DBIR, checked 27 October 2026).
How we picked
We ranked add-ons on what a one-person IT team needs on top of Apple Business:
- Installs and updates Mac apps from outside the App Store.
- Creates and removes accounts in SaaS apps, including apps without SCIM.
- Sets the resources inside apps: teams, repos, channels, roles.
- Starts joiner and leaver work from the HR system.
- Works on Macs that are not enrolled, for BYOD and contractors.
- Keeps sign-in on Google Workspace or Microsoft Entra.
We checked each vendor's own pages on 27 October 2026. "Not stated" means the page does not say, not that the tool cannot. We sell Caspian and rank it first for teams that need accounts and access on top of Apple Business. If you only need a fuller MDM, pick one of the next four.
The ranked list of add-ons
1. Caspian
Best for: small IT teams that want Apple Business for the device and need apps, accounts and access handled on top.
This section describes our own product. Caspian is an IT management platform: one place for all of IT, so a one-person IT team works like a team of five. It covers three layers, in and out: the apps on the laptop, the account in each SaaS app, and the resources inside each app.
- On the laptop. Caspian Desktop installs and updates Mac apps, including ones outside the App Store. People can ask the assistant for an app and install it through Self Service. It also checks FileVault, firewall, Gatekeeper, screen lock, macOS version and app versions. It works next to Apple Business's MDM, and on Macs that are not enrolled in any MDM.
- In each app. A new hire in HiBob, Personio, BambooHR, Workday or Rippling starts a joiner workflow. Caspian makes the account and the access through the route each app allows: the app's API first; if not, Caspian's cloud browser signed in as an admin, which works with your laptop off and for apps with no API and no SCIM; if not, the browser extension in an admin's Chrome; and last, an Inbox task for a person.
- Checked afterwards. Caspian reads each app back to confirm the change.
- Access requests are answered in Slack.
- When someone leaves, removals are never automatic. A person approves each one in "Access beyond the rules", and Caspian proposes the least destructive step, such as deactivating before deleting.
- If you outgrow the free MDM, Caspian MDM, Caspian's own Apple MDM, is in early access. It can move Macs from another MDM without a wipe on macOS 26 and later.
Limits: Caspian is not an identity provider; sign-in stays with Google Workspace or Microsoft Entra, and Apple Business keeps creating the Managed Apple Account. Caspian does not manage Windows PCs or iPhones, and it does not run a helpdesk. Caspian.
2. Mosyle
Best for: Apple-only fleets that want a fuller MDM with Mac security built in.
Mosyle's site lists MDM, OS updates and the installation and patching of "virtually any compatible application", a Mac antivirus, privilege management with "Admin On-Demand", encrypted-DNS web filtering, and Mosyle Auth 2, which creates local Mac accounts from your identity provider (Mosyle, checked 27 October 2026).
Limits: Mosyle handles the device and the Mac login. Accounts and resources inside SaaS apps are Not stated.
3. Jamf Now
Best for: a small Apple fleet that wants simple MDM with Blueprints and Self Service.
Jamf Now lists app distribution, zero-touch deployment, Blueprints, inventory, OS updates, Self Service, FileVault, malware prevention and remote lock. It manages up to 3 devices for free (Jamf Now, checked 27 October 2026).
Limits: it is a device tool. SaaS accounts and HR-triggered joiners are Not stated.
4. Kandji, now Iru
Best for: teams that want endpoint, identity and compliance from one vendor, across Apple and other platforms.
Iru, formerly Kandji, sells Endpoint (endpoint management, EDR and vulnerability management "in a single agent" across Apple, Windows and Android), Workforce Identity and Compliance Automation (Iru, checked 27 October 2026).
Limits: Iru's identity product is a sign-in layer, so using it means moving sign-in off Google Workspace or Entra. Account creation in apps without SCIM is Not stated. Caspian reads Iru if you run it.
5. Microsoft Intune
Best for: companies on Microsoft Entra and Microsoft 365 that want one console for Macs and Windows.
Microsoft's macOS guide covers Apple Automated Device Enrollment for Macs bought through Apple Business, BYOD enrollment, compliance policies, configuration profiles, FileVault, firewall and Gatekeeper settings, and line-of-business app deployment (Microsoft Learn, checked 27 October 2026). The guide lists assigning licenses to users as a prerequisite.
Limits: Intune manages devices. Accounts and resources inside third-party SaaS apps are Not stated in the macOS guide. It suits Entra shops; on Google Workspace it adds a Microsoft licence to manage.
6. Jamf Pro
Best for: larger Apple fleets with someone who knows Jamf.
Jamf Pro lists zero-touch deployment, Smart Groups, Blueprints on Declarative Device Management, inventory, app lifecycle management, Self Service+ and compliance benchmarks (Jamf Pro, checked 27 October 2026).
Limits: device-focused; its page does not describe accounts inside SaaS apps.
7. JumpCloud
Best for: teams willing to move sign-in to JumpCloud and get directory, SSO and MDM together.
JumpCloud's pricing page sells Device Management, SSO and Device Identity Management bundles, plus Platform packages with user lifecycle management; SaaS Discovery is in the top package, Platform Prime (JumpCloud pricing, checked 27 October 2026).
Limits: HR integration is not listed in the pricing table. Apps without SCIM are Not stated.
Compared
| Tool | Apps outside App Store | SaaS accounts | Resources inside apps | Apps without SCIM | BYOD Macs, no enrollment | HR-triggered joiner and leaver | Sign-in |
|---|---|---|---|---|---|---|---|
| Apple Business free MDM | Not described | No | No | No | No | Not described | Managed Apple Accounts from Google or Entra |
| Caspian | Yes | Yes | Yes | Yes | Yes | Yes | Google Workspace or Entra |
| Mosyle | Yes | Not stated | Not stated | Not stated | Not stated | Not stated | Mosyle Auth 2 for the Mac login |
| Jamf Now | Custom apps listed | Not stated | Not stated | Not stated | Not stated | Not stated | Not stated |
| Iru (Kandji) | Yes | Not stated | Not stated | Not stated | Not stated | Not stated | Iru Workforce Identity |
| Microsoft Intune | Yes, line-of-business apps | Not stated | Not stated | Not stated | No, BYOD enrolls | Not stated | Microsoft Entra |
| Jamf Pro | Yes | Not stated | Not stated | Not stated | No, needs enrollment | Not stated | Integrates with Entra, Google, Okta |
| JumpCloud | Yes, MDM | Yes, in lifecycle packages | Not stated | Not stated | Not stated | Not stated | JumpCloud SSO |
Sources are the vendor pages linked in each entry, checked 27 October 2026.
A day-one setup for a small IT team
Our view, not a sourced claim:
- Buy Macs through Apple or an authorized reseller, so zero-touch enrollment works.
- Connect Apple Business to Google Workspace or Entra, so Managed Apple Accounts are created for you.
- Build one Blueprint with Wi-Fi, security settings and your App Store apps.
- Add Caspian Desktop for apps outside the App Store and for updates.
- Connect Caspian to your HR system and your SaaS apps, and set who gets what by team.
- Move to a paid MDM, or Caspian MDM, only when the free MDM stops covering a job you need.
Trust and price
Caspian stores data in the EU (AWS Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress. Caspian starts read-only, and you roll it out in stages. The software scan is free and read-only.
Caspian's own prices: See is free. Act, where Caspian does the work on your rules, is €10 per active user per month, excluding VAT, with all their laptops included. There is no minimum, Act is free for 30 days from install with no card, and billing is monthly and can be cancelled anytime. See pricing.
Questions to ask
- Which apps on our standard Mac are not in the App Store?
- Who keeps those apps up to date today?
- How many SaaS apps does a new hire need on day one, and which have SCIM?
- Who puts new hires in the right channels, teams and roles?
- When someone leaves, how do we confirm every account is gone?
- Do we buy Macs through Apple or a reseller, so zero-touch enrollment works?
FAQ
Is Apple Business Manager's MDM free? Yes. Apple Business replaced Apple Business Manager, Apple Business Essentials and Business Connect on 14 April 2026, and Apple offers it as a free service with built-in device management. Paid add-ons from Apple are limited to iCloud storage and AppleCare+ for Business.
What do small IT teams add on top of Apple Business free MDM? Two things. A way to install and update Mac apps that are not in the App Store, and a way to create accounts for new hires in each SaaS app and set their access inside it. An IT management platform such as Caspian covers both; Mosyle, Jamf Now, Iru and Intune add a fuller MDM.
Can Apple Business install apps and create accounts for new hires? It installs App Store apps through Blueprints and creates Managed Apple Accounts from Google Workspace or Microsoft Entra. Apple's announcement does not describe installing apps from outside the App Store or creating accounts in third-party apps such as Slack, GitHub or Notion.
Do I still need Mosyle, Jamf Now, Kandji or Intune if I use Apple Business? Not always. If you buy new Macs from Apple and your apps are in the App Store, the free MDM may be enough to start. Add a paid MDM when you need deeper Mac security, Windows management or app deployment the free MDM does not describe.
Does zero-touch enrollment work for Macs I already own? Apple says zero-touch deployment works for devices bought through Apple or an Apple Authorized Reseller. For Macs bought elsewhere, Apple's Platform Deployment guide lists the other enrollment options, which need more hands-on work.
Request access to add Caspian on top of Apple Business.
Sources
| Source | Publisher | Date | Confidence |
|---|---|---|---|
| Introducing Apple Business | Apple | 24 Mar 2026 | High |
| Apple Business | Apple | Checked 27 Oct 2026 | High |
| Apple Platform Deployment | Apple | Checked 27 Oct 2026 | High |
| Free Apple device management is a baseline | 9to5Mac | 18 Apr 2026 | High |
| Mosyle | Mosyle | Checked 27 Oct 2026 | High |
| Jamf Now | Jamf | Checked 27 Oct 2026 | High |
| Jamf Pro | Jamf | Checked 27 Oct 2026 | High |
| Iru | Iru | Checked 27 Oct 2026 | High |
| Deployment guide for macOS in Intune | Microsoft | Checked 27 Oct 2026 | High |
| Pricing | JumpCloud | Checked 27 Oct 2026 | High |
| SCIM provisioning plans | Slack help | Checked 15 Oct 2026 | High |
| SP 800-53 Rev. 5 and PS-4 text | NIST, CSF Tools | Checked 27 Oct 2026 | High |
| 2026 Data Breach Investigations Report | Verizon | Checked 27 Oct 2026 | High |
| Pricing | Caspian | Checked 27 Oct 2026 | High (our own page) |
