MacAdmins community

Apple's Business Manager API does the work; its roles model is what breaks deployments

The expanded API can pull inventory and audit events and assign devices. The 403 error most admins hit first is a permissions problem, and Apple's own docs do not close the gap.