Microsoft Intune
Device enrollmentTutorial Automated Ios
In brief
The tutorial now recommends Setup Assistant with modern authentication or Company Portal for User Affinity enrollment, with just-in-time registration recommended for modern authentication. Legacy Setup Assistant guidance was removed, and metadata was updated.
What Intune admins need to know
Administrators following the tutorial will see the revised authentication recommendations.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Select Next.
On the Configuration settings tab, decide if you want your devices to enroll with or without User Affinity. User Affinity is designed for devices that will be used by particular users. If your users will want to use the Company Portal for services like installing apps, choose Enroll with User Affinity. If your users don't need the Company Portal or you want to provision the device for many users, choose Enroll without User Affinity.
- If you chose to enroll with User Affinity, the Select where users must authenticate option appears.
Decide if you want to Authenticate with Company Portal or AppleSelect Setup Assistant(legacy),with modern authentication (recommended) orCompany Portal. We recommend configuring just-in-time (JIT) registration with Setup Assistant with modern authentication. For more information about authentication methods, see Authentication methods for automated device enrollment in Intune.
- If you chose to enroll with User Affinity, the Select where users must authenticate option appears.
If you chose to enroll with User Affinity and Authenticate with Company Portal, the Install Company Portal with VPP option appears. If you install the Company Portal with a VPP token, your user won't have to enter an Apple ID and Password to download the Company Portal from the app store during enrollment. Choose Use Token: under Install Company Portal with VPP to select a VPP token that has free licenses of the Company Portal available. If you don't want to use VPP to deploy the Company Portal, choose Don't use VPP.
- If you chose to enroll with User Affinity, Authenticate with Company Portal, and Install Company Portal with VPP, decide if you want to run the Company Portal in Single App Mode until Authentication. With this setting, you can ensure the user doesn't have access to other apps until they finish the corporate enrollment. If you want to restrict the user to this flow until enrollment is completed, choose Yes under Run Company Portal in Single App Mode until authentication.
@@ -14,7 +14,7 @@ ms.collection: ms.reviewer: annovich ms.subservice: enrollment description: In this tutorial, you'll set up Apple corporate device enrollment features with Intune to enroll iOS/iPadOS devices purchased through Apple Business.-ms.date: 2025-03-05T00:00:00.0000000Z+ms.date: 2026-10-28T00:00:00.0000000Z ms.topic: tutorial Customer intent: As an Intune admin, I want to set up automated device enrollment for iOS/iPadOS devices I purchased through Apple Business. locale: en-us@@ -36,10 +36,8 @@ item_type: Content source_path: intune/device-enrollment/apple/tutorial-automated-ios.md cmProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/a72e95ff-4b4f-4cc1-90c6-7dcba67ff05f-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/68e4b2d8-b70c-4019-b49a-d1f8881e2aea spProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/24dc3ccd-591a-4415-a1fe-8759afafcb12-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/67b2ba1a-6f74-4044-a48a-f0f8ad076b8f platformId: a75d8f85-c3b0-6e2f-2159-143ed63d0a77 --- @@ -117,7 +115,7 @@ Create an enrollment policy for corporate-owned iOS/iPadOS devices. A device enr 6. Select **Next**.
7. On the **Configuration settings** tab, decide if you want your devices to enroll with or without **User Affinity**. User Affinity is designed for devices that will be used by particular users. If your users will want to use the Company Portal for services like installing apps, choose **Enroll with User Affinity**. If your users don't need the Company Portal or you want to provision the device for many users, choose **Enroll without User Affinity**.
- - If you chose to enroll with User Affinity, the **Select where users must authenticate** option appears. Decide if you want to Authenticate with Company Portal or Apple Setup Assistant (legacy), or Setup Assistant with modern authentication. For more information about authentication methods, see [Authentication methods for automated device enrollment in Intune](ref-automated-authentication-methods).
+ - If you chose to enroll with User Affinity, the **Select where users must authenticate** option appears. Select **Setup Assistant with modern authentication** (recommended) or **Company Portal**. We recommend configuring [just-in-time (JIT) registration](setup-just-in-time-registration) with Setup Assistant with modern authentication. For more information about authentication methods, see [Authentication methods for automated device enrollment in Intune](ref-automated-authentication-methods).
8. If you chose to enroll with User Affinity and Authenticate with Company Portal, the **Install Company Portal with VPP** option appears. If you install the Company Portal with a VPP token, your user won't have to enter an Apple ID and Password to download the Company Portal from the app store during enrollment. Choose **Use Token:** under **Install Company Portal with VPP** to select a VPP token that has free licenses of the Company Portal available. If you don't want to use VPP to deploy the Company Portal, choose **Don't use VPP**.
- If you chose to enroll with User Affinity, Authenticate with Company Portal, and Install Company Portal with VPP, decide if you want to run the Company Portal in Single App Mode until Authentication. With this setting, you can ensure the user doesn't have access to other apps until they finish the corporate enrollment. If you want to restrict the user to this flow until enrollment is completed, choose **Yes** under **Run Company Portal in Single App Mode until authentication**.