I recently tried setting Apple Business Manager for our ≈20 people SME.

The first step was "Domain Lock/Capture" which takes over all Apple accounts for a specific domain.

I've never had a worse experience from Apple.

The process is buggy, filled with foot-guns and dead ends. It expects huge amounts of work from users who have had their account for more than a few weeks and are expected to remove a lot of their personal data before their account can be migrated (e.g. do you know how to delete all your Health data?). The process is also impossible to cancel.

Phone support was par for the course, e.g. tickets escalated to the abyss, suggestions to restore workstations to factory settings, etc.

Be warned.

The domain lock process was an absolute fiasco at our company. I think this could work if you did this at the time your company launched, but the moment you have employees who have Apple IDs tied to their work email that aren't from the Business Essentials system you are stuck in an impossible-to-mange place.

There are several cheap MDM solutions for Apple devices that I would rather pay for than be dependent on this. (We've used SimpleMDM and love them.)

FWIW, my experience doing this process for a ~130 person org last year was pretty painless compared to other Domain Claims I've initiated for other SAAS vendors (Docusign in particular), and MDM nightmares (expired JAMF certificates, I'm looking at you).

We had to do it as ppl had made personal Apple accounts using our domain, meaning if they logged in with such an account and left, their iPhone magically transformed into an expensive, elegant paperweight. Due to a setting in our previous MDM we were unable to migrate data cleanly using Apple Biz Manager without committing to use ABM as our MDM (we couldn't) so we told people to "move it yourself following these detailed instructions, otherwise it can't be migrated." Regarding personal data like health on company-managed devices, I certainly don't share that type of info with my employer, and make it clear to staff that it's not our responsibility to migrate such data.

Yes, as an IT professional at a company where a few people have insisted on using Macs, the ABM workflow is by far the most frustrating, half baked product I've had the displeasure of using. People love to complain about Entra/Azure AD, but ABM is another level of obtuse.

Apple's cloud software has been buggy as hell for a long time, at least for me.

I'm in a family iCloud group with my parents... one day I just woke up and had all my podcasts and music replaced with my Mum's :/

Would not want this anywhere near a "business" experience

We use Apple Business Manager. Locking a domain is not a requirement if you're just doing basic MDM, I'm pretty sure. (I also had a negative experience with it, so we didn't use it and everyone just uses their personal apple IDs). Is it no longer possible to skip this step in setting up the account?

Same here, I never even got in. I never managed to get in. My account is good enough to take my money for other things but somehow I can't manage to onboard into the damn thing so that I can actually manage devices for my company. I just gave up in the end. Couldn't get it done.

I'll try again next month see how far I get with this. This needs to be way simpler than it currently is. Hopefully they fixed a few things there.

I gave up when it wanted a Dun and Bradstreet number (whoever they are) and the website to get one didn't work.

AFAIK, it works with subdomains, so you can use something like employees.example.com as your domain, and capture over that.

This was my experience switching from GMail to Apple’s mail service. I switched back after a few days.

you only need to do the domain lock part if you plan to use MAIDs. For 20 people you probably didn't need to do that, at least not at the same time as the rest. You can do it as a later step, not the first step.