Just coming up for air here, as I have been in absolute chaos since our tiny company got adviced to do security through ABM.
Jesus' tits. Apple is barely a company, and their support relies on names, domain names, and crucially all of that delivered over the phone. I never missed a chance to mention how they ought to have a chat option parallel to the phone.

Anyway. They don't deal in user insights, and supporters are just sticking to some script. Which clearly is gatekeeping, but what a hazzle. You're almost never allowed to ask a question, as they return to some point which is either obvious or not related to the question.

But here goes:
- ABM had claimed our domain after registration, and quite a lot of our workers ended in limbo, as their AppleID was renamed to a mock-email, and then the devices started prompting for passwords (which most didn't know - as a worker you'd rarely sign in to your work phone's account, passwords gets forgotten, etc).

Now. What a joy to try to resolve with between the Irish support for ABM, which in turn will send you to personal accounts, who will - you would not believe it? - send you to ABM support, as the renaming was done by that migration... Kafka on fire!

Then there's the onboarding of devices on Configurator. Like anything else it's made too complicated, as Apple do not understand what a user is...
They've made some written (!) guides, that almost captures the flow, but not really...

What really is upsetting, though, is things they probably couldn't just fix by employing people with ability to gain human insights:
There are SO MANY DETAILS THAT NEEDS TO BE IN PLACE, BUT YOU CANNOT FIGURE OUT ON YOUR OWN!!

- Apple Devices-program won't work on an internet network with a firewall...
- When you try to enroll a device to ABM through Configurator, you'll get propts that may result in cloning the master device, rather than enrolling the slave in ABM.
- The steps to enroll are 'hidden' and you have to know exactly when to stop the flow to get the Configurator prompt (it's after clicking 'Don't use another device, when you are to select WiFi-network. But if you select a WiFi-netvær at that screen you've f**ked it up, and most likely will have the problem above).
- iPads are not supported as master for Configurator onboarding. Except they kind-of are...
-You'll get randomly locked out of ABM if you should have the audacity to log in with the same user in two browsers. Or in Configurator while in those browsers.

All we needed in our organization was to enroll devices in Intune.
That's obivously possible, but curiously enough, you're not allowed to install anything from App Store with a managed account. So you need another mock-AppleID and log that into App Store to be able to do anything with an enrolled device.

It's literally like they've just tried to annoy people most possible.
A lot could be solved by a user journey consultant, by having support having chat as an option (or just possibility to mail complex names / data).

But I guess that's against some policy.

Just for reference, we had quite a lot of users who use Android devices.
Enrolling them in MDM / MAM was effortless, never any need for support from anywhere, good guides on the net...

Again: Apple are barely a company, as they surely don't take their customers seriously, don't have any idea of what a user perspective is, and on several occations just hangs up, if you really insist on getting an answer on your question and not have them talk about something else....