Wednesday, 22 April 2026

Day in brief

Apple TV and Vision Pro ADE guidance adds enrollment prerequisites and limits

Apple Automated Device Enrollment (ADE) dominates the meaningful Intune changes: two new Learn how-to pages describe userless enrollment procedures for corporate Apple TV and Apple Vision Pro devices, while related guidance adds platform-specific limits, scope-tag behavior, and a macOS Platform SSO prerequisite. These are documentation additions and clarifications, not evidence of a separate product launch. The rest of the period is largely editorial: Apple pages replace “enrollment profile” with “enrollment policy,” Linux compliance guidance changes Ubuntu Desktop from 22.04/24.04 to 24.04/26.04, and a Configuration Manager application-deployment troubleshooting reference was removed.

Intune · Device enrollment
tvOS ADE setup guidance is newly documented for userless Apple TV enrollment
A new Intune Learn how-to describes creating a tvOS ADE enrollment policy for devices without user affinity. Its prerequisites are Apple Business or Apple School Manager access, an active .p7m token, an Intune Apple MDM push certificate, and new or wiped Apple TV hardware. It also states a limit of 1,000 enrollment profiles per token and says devices must be assigned an enrollment policy before activation. This is a documentation addition, not evidence of a separate product launch.
Intune · Device enrollment
visionOS ADE guidance requires Intune deployment of Company Portal
A new visionOS how-to describes userless ADE for corporate Apple Vision Pro devices. It directs administrators to deploy Company Portal through Intune as a required VPP app with device licensing, not through the App Store. Setting Automatic app updates to Yes enables automatic updates, while the App Store version is described as incompatible with ADE.
Intune · Device enrollment
tvOS ADE limitations now specify custom .plist configuration instead of Settings Catalog
Updated tvOS guidance says enrollment is without user affinity; compliance policies and Setup Assistant screen configuration aren't supported. Settings catalog–based configuration profiles also aren't supported, so administrators must use uploaded custom .plist files. The page additionally warns that tvOS ADE hardware inventory currently reports storage capacity as 0 rather than actual device storage.
Intune · Device enrollment
macOS ADE requires a Platform SSO policy before Setup Assistant enrollment
A new section says administrators who want Microsoft Entra ID single sign-on during Setup Assistant must create a Platform SSO policy before devices enroll. The policy is deployed to enrolling macOS devices during ADE and enables users to sign in with organizational credentials during setup.
Intune · Device enrollment
tvOS and visionOS ADE policies inherit token scope tags only at creation
Updated token guidance says tvOS and visionOS ADE policies inherit the scope tag assigned to the enrollment program token when the policy is created. Later changes to the token's scope tag aren't reflected in existing policies, so the intended tag should be assigned before policy creation to preserve correct RBAC visibility.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Wednesday, 22 April 2026

Apple TV and Vision Pro ADE guidance adds enrollment prerequisites and limits

93 updates