Apple devices¶

Managing Apple devices with Intune depends on three Apple-side connections. If any of them lapse, enrollment or management stops. Get them right first, then choose an enrollment method.

The three Apple connections¶

Connection	What it does	Where in Intune	Lifetime
Apple MDM push certificate	Lets Intune wake Apple devices so they check in. Required for any Apple MDM.	Devices > Enrollment > Apple > Apple MDM Push Certificate	365 days, plus a 30-day grace period
Automated Device Enrollment (ADE) token	Links your Apple Business or Apple School Manager MDM server to Intune, so purchased devices enroll automatically	Devices > Enrollment > Apple > Enrollment program tokens	365 days
Apps and Books location token (VPP)	Lets Intune assign apps you've licensed in Apple Business	Tenant administration > Connectors and tokens > Apple VPP tokens	365 days

Renew the push certificate with the same Apple account

The push certificate is tied to the Apple account that created it. Renew it from the Apple Push Certificates Portal with that same account, by selecting Renew on the existing certificate. If you create a new certificate instead, or let it lapse past the grace period, every enrolled iPhone, iPad and Mac must re-enroll. Use a shared, IT-owned Apple account and record who can access it.

Other renewal triggers:

Renew the ADE token if the password changes for the Apple account that created it, or that person leaves. Changing the Apple account behind an ADE token doesn't force re-enrollment, unlike the push certificate.
Renew the VPP token if the Managed Apple Account behind it changes, its password expires, or the account is disabled. Intune shows the token as Invalid.
In Apple Business, don't select Download Token for an MDM server unless you're renewing. Downloading a new token invalidates the one Intune is using.

Put all three dates in the admin calendar, with reminders a month ahead.

Apple Business replaced Apple Business Manager

In April 2026 Apple combined Apple Business Manager, Apple Business Essentials and Apple Business Connect into Apple Business. Existing organizations migrated automatically. Device assignment, MDM servers and Apps and Books work as before, but menus and names differ from older guides. Apple Business also includes Apple's own basic MDM; you don't need it when you use Intune.

Choosing a method¶

iPhone and iPadMac

Method	Ownership	Supervised	Use for
Automated Device Enrollment with user affinity	Corporate	Yes	Standard corporate iPhones and iPads (recommended)
Automated Device Enrollment without user affinity	Corporate	Yes	Shared, kiosk and single-app devices
Shared iPad	Corporate	Yes	Several users sharing iPads, for example in education or frontline work
Apple Configurator	Corporate	Optional	Devices bought outside Apple's programs. Add them to Apple Business with Apple Configurator, then use ADE.
Account-driven user enrollment	Personal	No	BYOD with a separate, protected work volume and strong privacy for the user
Device enrollment (Company Portal or web-based)	Personal	No	BYOD where you need more control than user enrollment allows
App protection only	Not enrolled	n/a	BYOD where users won't accept enrollment

Method	Ownership	Use for
Automated Device Enrollment with user affinity	Corporate	Standard corporate Macs (recommended)
Automated Device Enrollment without user affinity	Corporate	Shared and lab Macs
Direct enrollment (Apple Configurator)	Corporate	Special cases with no user affinity
Device enrollment with Company Portal	Personal	Personal Macs, or corporate Macs not in Apple Business

Automated Device Enrollment¶

ADE is the right choice for every device the organization buys. The device is supervised, the management profile can be locked so users can't remove it, and enrollment happens during Setup Assistant.

Set up ADE¶

In Intune, go to Devices > Enrollment > Apple > Enrollment program tokens > Add, and download the Intune public key.
In Apple Business, create an MDM server for Intune and upload the public key. Download the server token.
Back in Intune, upload the token with the Apple account you used.
In Apple Business, assign devices to the Intune MDM server by serial number or order number. Better still, set Intune as the default MDM server for each device type so new purchases are assigned automatically.
In Intune, create an enrollment profile and set it as the default profile for the token, so newly synced devices get it automatically.

Intune syncs with Apple regularly. To pull in new assignments sooner, select Sync on the token page.

Enrollment profile settings that matter¶

Setting	Recommendation
User affinity	Enroll with user affinity for one-user devices
Authentication method	Setup Assistant with modern authentication. The user signs in with their Entra account during Setup Assistant and Company Portal installs automatically.
Install Company Portal with VPP	Yes. Licensing it through Apps and Books means no Apple account is needed on the device.
Locked enrollment	Yes, so users can't remove the management profile
Await final configuration	Yes. Holds the device at the end of Setup Assistant until critical policies are installed.
Setup Assistant screens	Hide the ones you don't need (for example Apple Pay, Siri, Screen Time) to shorten setup
Device name template (iOS/iPadOS)	For example `{{DEVICETYPE}}-{{SERIAL}}`

Devices bought elsewhere

Use Apple Configurator (on a Mac for iPhone and iPad, or the Apple Configurator app on iPhone for Macs) to add devices to Apple Business. For 30 days after adding a device this way, the user can remove it from management in Settings, so finish setup promptly.

Account-driven user enrollment (BYOD)¶

Account-driven user enrollment is Apple's privacy-preserving BYOD method for iOS/iPadOS 15 and later. Work apps and data live in a separate encrypted volume. Intune can't see personal apps or data, can't wipe the device, and only removes the work volume when the user unenrolls.

Profile-based user enrollment is deprecated

User enrollment with Company Portal (the profile-based method) is no longer available for new enrollments. Existing devices keep working. Use account-driven user enrollment for new BYOD enrollments.

Setup:

Publish a service discovery file. Host a JSON file at https://<your domain>/.well-known/com.apple.remotemanagement (no file extension, content type application/json) on the domain users sign in with:
```
{"Servers":[{"Version":"mdm-byod", "BaseURL":"https://manage.microsoft.com/EnrollmentServer/PostReportDeviceInfoForUEV2?aadTenantId=<your-tenant-id>"}]}
```
Set up just-in-time registration with the Microsoft Enterprise SSO plug-in so users authenticate once. Microsoft Authenticator is required on the device.
Create Managed Apple Accounts for users. Federating Apple Business with Microsoft Entra ID is the easiest way.
Create the enrollment profile under Devices > Enrollment > Apple > Enrollment types and choose Account driven user enrollment (or Determine based on user choice). Assign it to user groups. Device groups aren't supported.

Users enroll from Settings > General > VPN & Device Management by signing in with their work account.

Mac specifics¶

Macs have a few extra pieces beyond iPhone and iPad:

Intune management agent: installs automatically when you assign shell scripts, custom attributes or PKG/DMG apps. It needs network access to the macOS script endpoints for your tenant's region (see Network requirements).
Platform single sign-on: lets users sign in to the Mac with their Entra credentials or a Secure Enclave key, and gives single sign-on to apps. You can register Platform SSO during Setup Assistant on ADE devices. See Passwordless sign-in.
FileVault: enable it with Intune and escrow the personal recovery key. See Disk encryption.
Updates: use declarative device management update policies on macOS 14 and later. See Apple and Android updates.

Day-to-day tips¶

Activation Lock: on supervised devices, Intune can keep an Activation Lock bypass code so returned devices aren't bricked by a user's personal Apple account. Allow Activation Lock only through Intune policy.
Lost Mode: on supervised iOS/iPadOS devices you can enable Lost Mode with a message and phone number, then locate the device.
Supervision can't be added later without erasing the device. Enroll corporate devices through ADE from the start.
App assignment for ADE devices without user affinity must be to device groups, with apps licensed to the device through Apps and Books.