Daily Intune News
Aboutmerill.net
Microsoft Intune
Device enrollment

Ref Automated Authentication Methods

9 November 2026Doc updateAction required+29 / −27 lines

In brief

The article now explicitly directs administrators to use Option 2: Setup Assistant with modern authentication for successful automated enrollments involving account-driven Apple User Enrollment. It also clarifies Company Portal, MFA, and phishing-resistant MFA guidance.

What Intune admins need to know

For affected enrollments, configure Setup Assistant with modern authentication; the other authentication method blocks enrollment for targeted users.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • M365-identity-device-management ms.reviewer: annovich ms.subservice: enrollment description: Describes the Intune-supportedLearn about authentication methods you can use withfor Apple automated device enrollment.enrollment in Intune include Company Portal and Setup Assistant. ms.date: 2026-10-28T00:11-02T00:00:00.0000000Z ms.topic: how-to locale: en-us document_id: 7783d6be-1e76-78c8-6203-18ab252d1b26

Applies to iOS/iPadOS

This article describes the authentication methods available for iOS/iPadOS devices enrolled in Intune viaby using automated device enrollment. Available authentication methods include:

  • Intune Company Portal app
  • Setup Assistant with modern authentication
  • Prompt users to change their passwords when they first sign in.
  • Prompt users to reset their expired passwords during enrollment.
  • Register devices in Microsoft Entra ID and use features available with Microsoft Entra ID, such as Conditional Access.
  • Automatically install the Company Portal app during enrollment. If your company uses the Volume Purchase Program (VPP), you can automatically install the Company Portal app during enrollment without user Apple IDs.
  • You want to lockLock the device until the Company Portal app installs.

Caution

Intune will blockblocks an enrollment that uses this authentication method if the device user is targeted with an account driven Apple user enrollment policy type. This behavior is expected. The user receives an error message that says their account doesn't support enrollment through the Company Portal app, and that they need to enroll through the Company Portal website.

To ensure successful enrollments viaby using automated device enrollment, use Option 2: Setup Assistant with modern authentication as the authentication method when working with account driven Apple User Enrollment policy types.

Option 2: Setup Assistant with modern authentication

This option provides the same security as Intune Company Portal authentication but is different because it lets the device user access parts of the device even if the Company Portal hasnisn't been installed. Use this option for authentication when you want to:

  • Wipe the device.
  • Use multifactor authentication (MFA).

If you don't use the VPP option, the device user must enter their Apple ID during Setup Assistant or when Intune tries to install Company Portal.

In both scenarios, the Company Portal installation option is hidden from the device user, and theuser. The Company Portal becomes a required app on their device. When the user reaches the home screen, Intune automatically applies the correct app configuration policy to the device.

Caution

Don't send a separate app configuration policy to the Company Portal for iOS/iPadOS devices after enrolling with Setup Assistant with modern authentication. Doing so will resultresults in an error.

Multifactor authentication

Caution

Phishing-resistant MFA isn't supported on Setup Assistant for iOS/iPadOS.iPadOS doesn't support phishing-resistant MFA. Users enrolling iOS/iPadOS devices viaby using Automated Device Enrollment usingwith Setup Assistant withand modern authentication must have an alternate MFA method available to complete device enrollment. For more information about choosing an alternate MFA method, see Requiring multifactor authentication.

Multifactor authentication (MFA) will beis required if you apply a Conditional Access policy that requires it is applied at enrollment or during Company Portal sign-in. However, MFA is optional, based on the Microsoft Entra settings in the targeted Conditional Access policy.

External authentication methods are supported in Microsoft Entra ID,ID supports external authentication methods, which means you can use your preferred MFA solution to facilitate MFA during device enrollment. If you choose to use a third-party MFA provider, before you deploy enrollment policies to all devices, do a test run to ensure that both the Microsoft Entra MFA screen and MFA work during enrollment. For more information and support details about external authentication methods, see Public preview: External authentication methods in Microsoft Entra ID.

Company Portal action required

After they go through the Setup Assistant screens, the device user lands on the home page. At this point, their user affinity is established. However, untilUntil the user signs in to the Company Portal by using their Microsoft Entra credentials and selects Begin, the device:

  • Won’Isn't be fully registered with Microsoft Entra ID.
  • Won’Doesn't show up in the user’user's device list in Microsoft Entra ID.
  • Won’Doesn't have access to resources protected by Conditional Access.
  • Won’Isn't be evaluated for device compliance.
  • Will beIs redirected to the Company Portal from other apps if the user tries to open any managed applications that are protected by Conditional Access.

Option 3: Just in Just-in-Time Registration for Setup Assistant with modern authentication

This option is the same as Setup Assistant with modern authentication, except that Company Portal isn't required for Microsoft Entra registration or compliance. Instead, Microsoft Entra registration and compliance checks are fully integrated in a designated Microsoft or non-Microsoft app that's configured with the Apple single sign-on (SSO) app extension. The extension reduces authentication prompts and establishes SSO across the whole device. JIT Registration prompts users to authenticate twice:

Note

If your organization uses Microsoft Defender for Endpoint, for JIT registration and compliance remediation to work as expected, make sure the Microsoft Defender for Endpoint app isn't the first app users open.

OnceWhen the device user reaches the home screen, they can sign in to any work or school app that's configured with the SSO extension to complete Microsoft Entra registration and compliance checks. SSO signs the user into all apps that are a part of your SSO extension policy. At that point, they can also manually sign in to any app that isn’isn't configured to use the SSO extension.

To set up JIT Registration with automated device enrollment:

  1. Create a device configuration policy and configure the settings under the Single sign-on app extension category. For steps, seeSee Set up just-in-time registration.
  2. Create an Apple enrollment policy and select Setup Assistant with modern authentication as the authentication method. An active automated device enrollment token from Apple Business or Apple School Manager must be present in Intune to complete this step.
  3. When you get to the Assignments page in the enrollment policy, assign the policy to the devices synced from Apple Business and Apple School Manager. After you assign the policy, employees and students can complete setup and authentication on their devices.

Example of successful authentication

The following sequence of events describes an example of what a successful authentication looks like with JIT Registration for Setup Assistant withby using modern authentication. Your organization's experience maymight be different depending on your automated device enrollment configurations.

  1. The device user turns on the device.

  2. Setup Assistant begins.starts. The device user authenticates withby using their Microsoft Entra credentials in Setup Assistant.

  3. The device user completes multifactor authentication if that's required in the Conditional Access policy.policy requires it.

  4. The device finishes enrolling in Intune and user-device affinity is established.

  5. The device user lands on the home screen and opens Microsoft Teams or another Office app and signs in withby using their work account. If the device meets all compliance requirements, the device user will havecan access to their messages and calendar right away.

    Note

    During Microsoft Entra registration, the device user maymight see a short spinner while Intune finishes the compliance checks. This behavior is expected behavior.expected.

  6. The SSO extension establishes single sign-on in all other targeted apps and all Microsoft apps.

  7. The device is registered with Microsoft Entra ID and compliant. You can view the status of the device in the admin center and Microsoft Entra ID. The device user can view the status in Intune Company Portal and use Company Portal for compliance, app inventory, device syncs, and log sharing.

  8. The device user opens Teams and is automatically signed in.

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…