# Deploy DVE Agent with Apple Business Manager

Apple Business Manager (ABM) provides device enrollment and ownership; it does not distribute custom desktop apps like the DVE agent through the public App Store or VPP for non-App-Store packages. **Use ABM together with an MDM such as Jamf Pro** to deliver the DVE agent to macOS fleets.

## Prerequisites

- Apple Business Manager organization with Devices synced to your MDM
- Jamf Pro (or supported MDM) linked via Automated Device Enrollment (ADE)
- DVE backend configured with agent manifest environment variables
- Standard macOS deployment pipeline in your MDM

## Recommended pattern: ABM + Jamf

```
ABM (device ownership / ADE)
        ↓
   Jamf Pro (enrollment profile, policies, packages)
        ↓
   DVE Agent installed at enrollment or check-in
        ↓
   User unlocks agent with passphrase → DVE credentials accessible
```

This is the standard enterprise pattern for non-App-Store Mac software.

## Step 1: Enroll devices through ABM

1. In ABM: add devices (purchase, DEP, or Apple Configurator 2).
2. Assign devices to your MDM server (Jamf).
3. Configure ADE profile: skip Setup Assistant steps as appropriate, assign to Jamf site/ group.

## Step 2: Deploy agent at enrollment

In Jamf, create a policy scoped to **ADE enrollment** or **All Computers**:

- Run `install-dve-agent.sh` with `DVE_API_BASE_URL`, **or**
- Deploy pre-built DMG/pkg from manifest URLs per [Jamf guide](mdm-jamf.md)

Enrollment-time installation ensures the agent is present before users request DVE access.

## Step 3: VPP note (not applicable)

The DVE agent is **not** distributed via Mac App Store or VPP volume codes. Do not search App Store Connect for the agent package. All distribution uses your manifest download URLs or MDM-hosted packages.

## Step 4: Configure DVE org settings

```json
PUT /api/orgs/{org_id}/deployment/config
{
  "deployment_mode": "mdm",
  "mdm_platform": "apple_business_manager",
  "mdm_notes": "ABM + Jamf ADE; policy Install DVE Agent at enrollment"
}
```

Confirm policy: `POST /api/orgs/{org_id}/deployment/confirm-agent-policy`.

## Step 5: Verify on a test device

1. Wipe or enroll a test Mac through ABM → Jamf.
2. Confirm agent app in `/Applications`.
3. User signs into DVE and unlocks agent.
4. Validate credential access.

## Troubleshooting

| Issue | Fix |
|-------|-----|
| Agent missing after ADE | Add enrollment-triggered Jamf policy; check policy logs |
| User bypassed install | Set policy to **Required** not Self Service only |
| ABM devices not in Jamf | Re-sync ABM token; verify MDM server assignment |

## Related guides

- [Jamf Pro deployment](mdm-jamf.md) — detailed policy and package steps
- [Overview](overview.md) — agent-required model and manifest API

## API reference

- `GET /api/deployment/agent-manifest` — public version and download metadata