Daily Intune News
Aboutmerill.net
Microsoft Intune
Device enrollment

Tutorial - Use Apple Business to Enroll iOS/iPadOS Devices in Intune - Microsoft Intune | Microsoft Learn

4 November 2026Doc update+19 / −20 lines

In brief

The tutorial was revised for clearer, consistent wording and formatting. Setup guidance for MDM servers, device assignment, RBAC permissions, User Affinity, and authentication options was clarified, and Apple Business links were updated.

What Intune admins need to know

No action is required. Administrators can use the revised tutorial for clearer enrollment setup guidance.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Tutorial - Use Apple Business to enrollEnroll iOS/iPadOS devicesDevices in Intune - Microsoft Intune | Microsoft Learn

Use Apple Business with Microsoft Intune to simplify and automate device enrollment for iOS/iPadOS devices procured through Apple Business. In this tutorial, you set up Automated device enrollment, which we'll set up in this tutorial,. This feature enables secure automatic enrollment the first time the user turns on the device by deploying the enrollment policy to the device over-the-air.air the first time the user turns on the device.

In this tutorial, you'll learn how to:

  • Get an Apple device enrollment token
  • Sync managed devices to Intune
  • Create an enrollment policy
  • Assign the enrollment policy to devices

At the end of this tutorial, devices will beare ready to distribute for enrollment.

Prerequisites

Step 1: Add MDM server

Create an MDM server profile for Microsoft Intune in Apple Business. The token you download in this step will enableenables the connection between Microsoft Intune and Apple Business in a later step.

  1. Sign in to the Microsoft Intune admin center.

  2. Go to Devices.

    Important

    While you're in Apple Business, don't close the browser tab with Microsoft Intune. You'll return to it later.

  3. Add an MDM server called TestMDMServer and download the server token for it in Apple Business. For details and instructions,more information, see Link to a third-party MDM server( (link opens Apple Business User Guide). Save the server token locally as a P7M file (.p7m). Then continue to Step 2: Assign devices.

Step 2: Assign devices

While you're in Apple Business, assign devices to your new MDM server (server, TestMDMServer or whatever you named it)., in this example. For details and instructions, see Assign, reassign, or unassign devices in Apple Business(opens Apple Business User Guide). When you're done assigning devices, continue to Step 3: Upload MDM server token.the next step.

Step 3: Upload MDM server token

  1. Select Next.

  2. On the Device group tab, optionally select a Microsoft Entra security group to use for enrollment time grouping. The group maps directly to this enrollment policy, and you can edit it after policy creation.

    Only static Microsoft Entra security groups are available for selection. To configure this setting, you must have the enrollment time device membership assignment permission in a custom RBAC role (underrole, under Enrollment programs).

    For more information about how enrollment time grouping works, see Enrollment time grouping in Microsoft Intune.

  3. Select Next.

  4. On theIn Configuration settings tab,, decide if you want your devices to enroll with or without User Affinity. User Affinity is designed for devices that will be used by particular users. If your users will want to use the Company Portal for services like installing apps, choose Enroll with User Affinity. If your users don't need the Company Portal or you want to provision the device for many users, choose Enroll without User Affinity.

  5. If you chosechoose to enroll with User Affinity and Authenticate with Company Portal, the Install Company Portal with VPP option appears. If you install the Company Portal with a VPP token, your user won't have to enter an Apple ID and Password to download the Company Portal from the app store during enrollment. Choose Use Token: under Install Company Portal with VPP to select a VPP token that has free licenses of the Company Portal available. If you don't want to use VPP to deploy the Company Portal, choose Don't use VPP.

    • If you chosechoose to enroll with User Affinity, Authenticate with Company Portal, and Install Company Portal with VPP, decide if you want to run the Company Portal in Single App Mode until Authentication. With this setting, you can ensure the user doesn't have access to other apps until they finish the corporate enrollment. If you want to restrict the user to this flow until enrollment is completed, choose Yes under Run Company Portal in Single App Mode until authentication.

  6. Choose Yes under Locked enrollment to ensure your users can't remove device management from their corporate device.

  7. By default, Apple names the device with the device type, such as iPad. If you want to provide a different name template, choose Yes under Apply device name template. Enter the name you want to apply to the devices, where the strings {{SERIAL}} and {{DEVICETYPE}} will substitute each device's serial number and device type. Otherwise, choose No under Apply device name template.

  8. Under Setup Assistant, enter Tutorial department for Department Name. This string is what users see when they tap About configuration during device activation.

  9. For Department Phone, enter a phone number. This number appears when users tap the Need help button during activation.

  10. You can Show or Hide various screens during device activation. For the most seamless enrollment experience, set all screens to Hide.

  11. Choose Next.

  12. Review the policy settings. To save the policy, select Create.

Step 5: Assign an enrollment policy to iOS/iPadOS devices

Note

Ensure that Device Type Restrictions, found within your tenant's Enrollment Restrictions, does notdoesn't have the default All Users policy set to block the iOS/iPadOS platform. This setting will causecauses automated enrollment to fail and your device will showto appear as an invalid profile, regardless of user attestation. To permit enrollment only by company-managed devices, block only personally owned devices, which will permitpermits corporate devices to enroll. Microsoft defines a corporate device as a device that's enrolled via you enroll by using a device enrollment program or a device that's you manually enteredenter in the admin center under Corporate device identifiers.

Step 6: Distribute devices to users

You've set up management and syncing between Apple and Intune, and assigned a policy to let your ADE devices enroll. You can now distribute devices to users. Devices with user affinity require each user to be assigned an Intune license.

Related configurations

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…