Link to a third-party MDM server in Apple Business Manager
In Apple Business Manager you must link to at least one third-party mobile device management (MDM) server before you can begin assigning devices.
Before you create a third-party MDM server, review the certificate, security and naming information below.
MDM server security: every third-party MDM server you create must be known to Apple and must be securely authorised using a two-step verification process. The verification process involves creating and installing a server token on your MDM server. The certificate encrypts the token. For information about how to transfer the token, see your MDM vendor’s documentation.
MDM server names: when you name each third-party MDM server, you do not need to use the fully qualified domain name. For example, you can choose a name based on a specific building, location, room or job function (but you cannot use the same name for multiple servers). You also cannot name your MDM servers Unassigned or Reassigned.
MDM server certificates: before you add a third-party MDM server, get the public key certificate file (ending in .pem or .der) from your MDM vendor for each server you want to add. See the MDM vendor’s documentation for information about getting the server’s public key certificate.
A user with the proper privileges must replace the active token on a third-party MDM server in these situations:
When a new public key is created or if a new token is generated
When the user who downloaded the initial token changes their Managed Apple ID password.
As a security measure, when the user who downloaded the original token leaves your organisation.
Important: Third-party MDM server tokens expire after one year and must be replaced. Depending on the MDM vendor, you may or may not get a warning that a token is going to expire. Well before a token is about to expire, sign in to Apple Business Manager, generate and download a new token for the MDM server and transfer that token to the MDM server for immediate installation. See your MDM vendor’s documentation for information on how to transfer the token.
Link to a third-party MDM server
In Apple Business Manager
, sign in as a user that has the role of Administrator or Device Enrolment Manager.Tap your name at the bottom of the sidebar, tap Preferences
, then tap Device Management 
.Tap the Add button
, then enter a unique name for the server.If you do not want this MDM server to have the ability to release devices, see Release devices.
Upload the public key certificate file, then tap Save.
Tap the Download button
, then tap Download Server Token.Next, upload the server token to a specific MDM solution. Consult your MDM vendor’s documentation to complete this step.
Repeat steps 1 through 6 for any other MDM servers you want to link to.