GoKawiilApple @ Work is exclusively brought to you by Mosyle, the only Apple Unified Platform. Mosyle is the only solution that integrates in a single professional grade platform all the solutions necessary to seamlessly and automatically deploy, manage, and protect Apple devices at work. Over 45,000 organizations trust Mosyle to make millions of Apple devices work ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.
At this year’s WWDC, Apple announced an expanded Apple Business API. This update allows IT admins to retrieve device information, review audit events, and assign or unassign devices directly via the API. It is a fantastic update for enterprise IT folks building on Apple and Apple Business, but properly configuring the API can be a bit frustrating according to reports from developers.
About Apple @ Work: Bradley Chambers has been an Apple IT admin since 2009. Through his experience deploying and managing firewalls, switches, a mobile device management system, enterprise grade WiFi, 1000s of Macs, and 1000s of iPads, Bradley will highlight ways in which Apple IT managers deploy Apple devices, build networks to support them, train users, share stories from the trenches of IT management, and ways Apple could improve its products for IT departments.
Navigating Apple Business roles
When testing these new APIs, it’s been reported that you are likely to encounter a 403 Forbidden error when using the Audit Events API. The API returns a message stating that the currently used API key does not allow the request.
Apple provides pretty detailed documentation for creating an API account in Apple Business. The data access section says you need permission to access audit events via the Admin API, but it’s not clear how to apply that same permission to your account.
While digging through the official API docs, you will find some limitations you should be aware of. Organizations can have up to 50 API accounts and create up to 15 custom roles in Apple Business Manager. Any user who can view, edit, and delete roles can change specific permissions for all default roles.
To fix the 403 error, you need to adjust the permissions on your API account. To create or edit a custom role, navigate to Settings> Roles and Permissions. When creating a custom role, you can base it on an existing role and simply add permissions.
The Roles Checker tool
The default Apple Business Manager roles include IT Administrator, Marketing Administrator, People Manager, Device Enrollment Manager, and Content Manager. Checking all the individual organization permissions for each role is incredibly tedious.
... continue reading