Apple Business

Connect Furl to Apple Business to import your organization’s Apple device inventory and its Managed Apple Account directory.

Apple Business is the service formerly called Apple Business Manager. It combines what were previously Apple Business Manager, Apple Business Essentials, and Apple Business Connect.

Description

Apple Business is the system of record for the Apple hardware your organization owns. Furl’s integration imports every Mac, iPhone, iPad, and Apple TV in your inventory as an endpoint, imports your Managed Apple Account directory as people, and attributes each enrolled device to the person signed in on it.

Because the inventory comes from Apple rather than from a scanner or an agent, it includes devices nothing else has seen yet — hardware that has been purchased and assigned but never checked in. Devices already known to Furl are enriched rather than duplicated: they are matched on serial number and MAC address, both of which Apple reports and both of which are reliable identifiers for Apple hardware.

Required Role

The API account you create for Furl must have the IT Administrator role.

A lesser role can list some collections and then fail or return nothing on others. That surfaces as a partial sync — devices without their details, or a directory that imports empty — rather than as a clear error, so it is worth confirming before you connect.

Configuration Steps

1. Create an API account in Apple Business

   • Sign in to Apple Business as an Administrator.
   • Go to Preferences → API.
   • Add an API account and give it the IT Administrator role.

2. Generate a private key

   • Generate a key for the account.
   • Download the .pem file. Apple shows the key once and never again — if you leave the page without downloading it, you will need to generate a new one.
   • Copy the Client ID and Key ID shown alongside the key.

   Apple’s own walkthrough is Create an API account.

3. Configure in Furl

   Enter the Client ID, Key ID, and the contents of the .pem file in the Furl integration settings.

Required Configuration

API Account Connection

• Client ID — Shown in Apple Business after you create the API account. It looks like BUSINESSAPI.c75c0a8a-a026-4dae-99aa-89ea1e1103e5.
• Key ID — Shown when you generate the private key.
• Private Key — The full contents of the downloaded .pem file.

Paste the private key exactly as it appears in the file, including the BEGIN and END lines. Furl repairs the formatting on the way in, so the key is accepted whether or not its line breaks survive the paste.

If any of the three values is wrong, the connection fails immediately when you save it rather than silently at the first sync.

Supported Capabilities

Datasources

• Devices and Users → Import the Apple device inventory as endpoints, the Managed Apple Account directory as people, and the link between them
  • Primary Source: Can be configured as the primary source of people in your organization

Each sync imports:

From Apple	What Furl gets
Organization devices	Serial number, product family and model, Wi-Fi, Bluetooth, and Ethernet MAC addresses
Enrolled devices	The device name, the operating system version, and the person enrolled on the device
Device details	FileVault and firewall state, storage capacity, last check-in time
Users	Name, work email, Managed Apple Account, department, and job title

Actions

Currently no actions are supported for this integration.

Device Ownership

Furl links a device to a person using the account enrolled on that device. Apple reports this only for devices enrolled in Apple’s built-in device management with a Managed Apple Account signed in.

This means:

• Devices with a user signed in appear on the People page under their owner, and show that owner on the Endpoints page.
• Devices enrolled without a user signed in — for example, hardware enrolled through Automated Device Enrollment and handed out without a Managed Apple Account sign-in — import normally, but with no owner attached. Apple Business may still show an Assignment for such a device in its own interface. That value is not currently available through Apple’s API, so Furl cannot import it.
• Organizations using a third-party MDM such as Jamf or Intune get their full device inventory and their full directory from this integration, but no ownership, because the enrolled account only exists for Apple’s built-in device management.

Where ownership is unavailable from Apple, it can still come from another source that identifies the same device by serial number, such as the Furl agent.

Limitations

• No IP addresses. Apple does not report them. Endpoints import with MAC addresses instead.
• No software or vulnerability data. This is an inventory and directory source. Findings come from the Furl agent or a vulnerability scanner.
• Devices released from your organization stop appearing once Apple removes them from the inventory.

Troubleshooting

• The connection will not save. Check the Client ID and Key ID for extra spaces, and confirm the private key belongs to the API account you are configuring. A key from an account that was deleted or had its key regenerated is rejected.
• Devices import but nobody owns them. This is expected when devices are enrolled without a Managed Apple Account signed in. See Device Ownership above.
• The directory imports but no devices do, or the reverse. Confirm the API account has the IT Administrator role. A narrower role can read some collections and not others.
• Some endpoints have no operating system version. Apple did not return details for those devices. The rest of the device record still imports, and the endpoint is still matched to devices seen by other sources.
• Some endpoints have no name. Only devices enrolled in Apple’s built-in device management report a device name. Endpoints imported without one are still matched on serial number and MAC address.