Apple has changed their tune, in so far as they probably need some level of identity management on the Mac, crypto-key escrow, restrictions, and so on. Their Device Management framework is quite capable.

For large enough businesses Apple will let you do your own self-service repairs too. On-site. Order the part and you're still in warranty.