Daily Intune News
Aboutmerill.net
Microsoft Intune
Device enrollment

Set up Account Driven Apple User Enrollment - Microsoft Intune | Microsoft Learn

4 November 2026Doc update+26 / −22 lines

In brief

The article now explains that users start enrollment by signing in to their work account in Settings, approve device management, and receive silent policy installation. It also includes wording, capitalization, date, and service-discovery instruction updates.

What Intune admins need to know

Administrators can use the revised guidance to better understand and explain the enrollment experience. No action is required.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Set up account drivenAccount Driven Apple User Enrollment - Microsoft Intune | Microsoft Learn

Set up account driven Apple User Enrollment for personal devices enrolling in Microsoft Intune. Account driven user enrollment provides a faster and more user-friendly enrollment experience than user enrollment with Company Portal.

The device user initiates enrollment by signing in to their work account in the Settings app. After the user approves device management, the enrollment policy silently installs and Intune policies are applied. Intune uses just-in-time (JIT) registration and the Microsoft Authenticator app for authentication to reduce the number of times users have to sign in during enrollment and when accessing work apps.

This article describesLearn how to set up account driven Apple User Enrollment in Microsoft Intune. You will:Intune, including how to:

  • Set up JIT registration.
  • Create an enrollment policy.
    • iOS/iPadOS 15 or later

    If you assign an account driven user enrollment profile to device users running iOS/iPadOS 14.9 or earlier, Microsoft Intune automatically enrolls them viaby using user enrollment with Company Portal.

Tenant configuration requirements

You also need to set up service discovery so that Apple can reach the Intune service and retrieve enrollment information. To complete this prerequisite, set up and publish an HTTP well-known resource file on the same domain that employees sign in to. Apple retrieves the file viaby using an HTTP GET request to "https://contoso.com/.well-known/com.apple.remotemanagement", with your organization's domain in place of contoso.com. Publish the file on a domain that can handle HTTP GET requests.

Note

The well-known resource file must be saved without a file extension, such as .json, to function correctly.

Create the file in JSON format, with the content type set to application/json. We provideYou can copy and paste the following JSON samples that you can copy and paste into your file. Use the one that aligns with your environment. Replace the YourAADTenantID variable in the base URL with your organization's Microsoft Entra tenant ID.

Microsoft Intune environments:

Tip

For more information about the technical requirements for service discovery, see Implementing the simple authentication user-enrollment flowImplementing the simple authentication user-enrollment flow in the Apple Developer documentation.

If the service discovery isn't configured correctly, users receive the following error message:

  • Title: Sign-in Failed
  • Description: Your Apple ID does notdoesn't support the expected services on this device. Contact your administrator to sign in.

In order toTo solve this issue, make sureensure that your webserver is hostingweb server hosts the service discovery file with the content type set to application/json. You can validate thatthis configuration by running the following commands:

   curl -I "https://contoso.com/.well-known/com.apple.remotemanagement"

### Deploy Company Portal web app

Deploy the web app version of the Intune Company Portal website so that users have quick access to device status, device actions, and compliance information. The web app appears on the home screen and functions as a link to the [Company Portal website](https://portal.manage.microsoft.com/).

Without the web app, devicesdevice users can still access the Company Portal website but haveneed to open the browser and type the address into the search field. For more information about how to add a web app, see [Add web apps to Microsoft Intune](../../app-management/deployment/add-web).

### Enable federated authentication

Apple User Enrollment requires you to create and provide managed Apple IDs to enrolling users. If you enable federated authentication, which consists of linking Apple Business with Microsoft Entra ID, you don't have to create and provide unique Apple IDs to each user. Instead, a device user can sign in to their apps with the same credentials they use for their work account. For more information, see [Intro to federated authentication with Apple Business](https://support.apple.com/guide/apple-business-manager/intro-to-federated-authentication-axmb19317543/1/web/1) in the Apple Business User Guide.

## Step 1: Set up just in just-in-time registration and assign Microsoft Authenticator

Configure just-in-time registration and assign Microsoft Authenticator as a required app. For steps, see [Set up JIT registration in Intune](setup-just-in-time-registration). Return to this article when you're done so you can continue to the next step.

## Step 2: Create enrollment profile

Create an enrollment profile for devices enrolling viaby using account driven user enrollment. The enrollment profile triggers the device user's enrollment experience, and it enables them to initiate enrollment from the Settings app.

1. In the Microsoft Intune admin center, go to **Devices** > **Enrollment**.
2. Select the **Apple** tab.

    Your options:

    - **Account driven user enrollment**: Assigned users who initiate enrollment are enrolled viaby using account driven user enrollment.
    - **Determine based on user choice**: Assigned users who initiate enrollment can select how they want to enroll their device. Their options:

        - **I own this device:** More settings appear with this selection. The user has the optioncan choose to secure their entire device or only secure work-related apps and data.
        - **(Company) owns this device:** The device enrolls viaby using Apple Device Enrollment. For more information about this enrollment method,information, see [Device Enrollment and MDM](https://support.apple.com/guide/deployment/device-enrollment-and-mdm-depd1c27dfe6/web) on the Apple Support website.
8. Select **Next**.
9. On the **Assignments** page, assign the profile to all users, or select specific groups. Device groups aren't supported in user enrollment scenarios because user enrollment requires user identities.
10. Select **Next**.

## Step 3: Prepare employees for enrollment

To initiate device enrollment on a personal device, the device owner must go to the Settings**Settings** app and sign in with their work or school account. If they attempt to sign in to an app with their work or school account, the app alerts them to the enrollment requirement and tells them how to proceed.

This section describes the enrollment steps for device users. We recommend using this information in your organization's device onboarding documentation or for troubleshooting and support.

7. Select **Allow Remote Management**.
8. Wait a few minutes while your device is configured and the management profile is installed.
9. To confirm your device is ready to use for work, go to **VPN & Device Management**. Confirm that your work account is listed under **MANAGED ACCOUNT**.
10. You need Microsoft Authenticator is required to access work apps. Wait a few minutes after enrollment for Authenticator to install on your device. An error message appears if you try to sign in to a work app without Authenticator.
11. You might receive more prompts asking for your approval to install work apps. Select **Install** to approve installation.

## Profile priority
Intune applies enrollment profiles in the order you prioritize them. To change the order in which they're applied:

1. Go back to **Enrollment types** to view your profiles.
2. Drag and drop the profiles in the list to reorder their priority.

If a conflict occurs because a user is assigned more than one profile, Intune applies the profile with the higher priority.

## Removing device from management

The\ No newline at end of file
When the device unenrolls from Intune, it erases the volume and cryptographic keys created tothat manage the work data on the device are erased when the device unenrolls from Intune.
\ No newline at end of filedevice.
\ No newline at end of file
Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…