HomeKb › Retail devices not in abm
Knowledge base · Cross-platform

Devices bought retail (or from an unregistered reseller) never appear in Apple Business Manager

Apple Business Manager only lists devices whose purchase can be traced to your organisation. Here is how chain of custody actually works, how to rescue retail and second-hand devices with Apple Configurator, and why a "missing" device sometimes just needs a fresh login.

The problem

You have bought a batch of iPhones, iPads or Macs, signed into Apple Business Manager (ABM), and gone to the Devices section expecting to assign them to your MDM. They are not there. No error, no pending state — the devices simply do not exist as far as ABM is concerned.

Two groups of people hit this:

The result is the same either way: no automated (zero-touch) enrolment, and a pile of hardware that has to be handled by hand on build day.

Why it happens

A contributor on Apple's Support Communities puts the first case bluntly:

"If you purchased devices through retail, they will not appear in ABM, as retail purchases cannot satisfy chain of custody."

ABM's automated device enrolment is built on chain of custody: the seller reports each serial number against your organisation's ABM Organisation ID at (or after) the point of sale. Only two kinds of seller can do that:

A consumer retail transaction records no organisational purchaser at all, so there is nothing for Apple to attribute the serial numbers to. A marketplace or second-hand purchase breaks the chain entirely — even if the device was once in someone else's ABM. This is by design: it is the mechanism that stops a stolen device being silently enrolled into an attacker's organisation.

The second case — devices submitted but not visible — comes from how the console refreshes. From the same thread:

"ABM has a tendency to show you the state of the system at time of login."

Devices assigned to your organisation after you signed in may simply not render until you start a fresh session.

The fix

1. Register every supplier before you order

2. Rescue retail and second-hand devices with Apple Configurator

Devices that missed the channel can still be added manually:

Know the caveat: manually added devices enter a 30-day provisional period during which the person using the device can release it from supervision, management and ABM entirely from Settings. Only after 30 days does it behave like a channel-purchased device. For loosely managed or BYOD-adjacent fleets, that window matters.

3. Ask the reseller about retrospective submission

If the devices came from an Apple Authorised Reseller that you simply had not registered, ask whether they can submit the past order against your Organisation ID. Many can, provided they sold you the devices — which restores proper chain of custody with no Configurator work and no 30-day window.

4. If a device should be there but is not, sign out and back in

Before raising a ticket: log out of ABM and log back in, then re-check Devices (including the unassigned/MDM-server filters). The console shows the state of the system as of login, so newly assigned devices routinely "appear" only on a fresh session.

How Decolla handles it

Straight answer: it does not. Decolla provisions Windows devices over your organisation's own Microsoft Intune/Autopilot tenant — Apple Business Manager and Apple devices are outside its scope, and the steps above are the fix.

It is worth noting that the Windows estate has exactly the same failure mode: devices bought outside a registered OEM or reseller channel do not appear in Windows Autopilot either, and someone ends up harvesting hardware hashes by hand on build day. The lesson is identical on both platforms — sort the paperwork before the hardware arrives.

On the Windows side, Decolla bakes that lesson into the plan itself: the written, itemised provisioning plan you approve before anything runs itemises the procurement channel per batch, so Autopilot chain of custody is verified before build day rather than discovered broken on it. The rest of the plan follows the same "agree it in writing first" principle — delivery method and reversibility class per item, irreversible steps flagged — and deployment then runs unattended in your own tenant with per-item rollback of the changes Decolla itself made. Decolla is pre-launch; there is a waitlist at decolla.app.

Sources

See it on a real device.

Decolla is in private build — early-access members see a build defined, deployed and rolled back first.

Get early access