Apple Manager

Two panels on the device page, fed by Apple School Manager or Apple Business Manager. No route of its own and no module gate: configure the connectors and the panels appear.

What it answers

Apple Manager is not a device manager. It is the record of what your organisation bought, what cover it holds, and which MDM it is assigned to. Your Jamf, Kandji or Mosyle still owns the device’s behaviour: OS, battery, last check-in, who has it.

Two questions, answered by two connectors sharing one set of credentials:

Question	Connector	Panel
Is this iPad still covered?	Apple School / Business Manager	Warranty
Did we buy it, on what order, and is it pointed at the right MDM?	Apple School / Business Manager (devices)	Enrolment

Coverage

This is the answer Apple GSX could not give. GSX has no public API, because it needs an Apple-approved service provider account and mutual TLS. So “is this iPad still under AppleCare” had no answer at all for an Apple fleet.

The device page shows the status (active, expired or unknown), the date cover runs out, the plan name, and whether accidental damage is covered.

Two limits worth stating plainly:

It knows only devices bought into your organisation. A device a parent bought at a retail store is not in Apple Manager, and comes back unknown rather than uncovered. That is deliberate: sitting beside the Dell and Lenovo connectors, this one has to be able to say “not mine” quietly.

Accidental damage is inferred, not reported. Apple exposes no flag for it. The difference between AppleCare+ (which covers a dropped iPad) and the older AppleCare Protection Plan (which does not) lives only in the plan’s description text. Getting it wrong in the cautious direction means somebody checks manually; the other direction means a family is told a repair is free when it is not.

A device with several coverage records (an original plan, a renewal, a cancelled one) is resolved by dropping the cancelled ones and taking the latest end date of what remains.

Enrolment

The organisation’s own record of the device: order and purchase details, and the MDM server it is assigned to. Where a device is enrolled to the wrong MDM, or to none, the device page can point it at the right one.

This is provenance no MDM knows, because the device was bought before any MDM ever saw it.

Credentials

One API account covers both connectors. In Apple School Manager or Apple Business Manager: Preferences, then API. Create an API account, upload a public key, and Apple returns a Key ID.


Client ID	`SCHOOLAPI.<uuid>` or `BUSINESSAPI.<uuid>`
Key ID	Returned when you upload the public key
Private key	The EC private key, PEM-encoded

All three are secrets and are held in the encrypted store. There is no base URL to configure: Apple’s hosts are fixed, and offering an editable one would put a tenant-supplied URL in front of a signed credential for no benefit.

The connection test mints a token and reads nothing. That proves the Client ID, the Key ID and the private key all agree, which is the whole of what goes wrong at setup.

School against Business

Apple runs the same API on two hosts with two scopes. Which pair you enable depends on which Apple Manager your organisation actually holds:

	Apple School Manager	Apple Business Manager
Who has it	Schools and districts	Businesses, and some independent schools
Warranty connector	`apple-school-manager`	`apple-business-manager`
Enrolment connector	`apple-school-manager-enrolment`	`apple-business-manager-enrolment`

Enable the pair that matches. Enabling both pairs against one set of credentials does not work, because the credentials are issued against one organisation, on one host.

Each pair counts as one integration against your connector allowance, because it is one Apple Manager account answering two questions.

Troubleshooting

Symptom	Cause
`invalid_client` on the connection test	Usually the private key. A key pasted with literal `\n` instead of real line breaks is the commonest way this is misconfigured
Connection test passes, every serial comes back unknown	The wrong pair is enabled: School credentials against the Business host, or the reverse
One device comes back unknown, the rest are fine	It was not bought into your organisation. Check the reseller put it into your Apple Manager
Coverage says active but the plan looks wrong	Several records exist. The latest end date wins and cancelled plans are ignored

Apple GSX is the repair-side integration and needs a service provider account. Dell warranty answers the same coverage question for Dell hardware. A school with a mixed fleet runs several, and the device page asks whichever one owns that serial.