guides-apple-intune

📋 Overview & Licensing

Intune manages Apple devices via three channels: APNS (push commands to enrolled devices), Apple Business Manager (ABM) for zero-touch enrollment, and Volume Purchase Program (VPP) for app licensing.

iOS iPhone & iPod

ADE supervised enrollment
BYOD User Enrollment
MAM without enrollment
Per-app VPN support

iPadOS iPad

Shared device mode (multi-user)
Student device scenarios
Managed Home Screen
Kiosk / Single App Mode

macOS Mac

Platform SSO (Entra ID auth)
ADE with Setup Assistant
Shell scripts deployment
Rosetta 2 / custom PKGS

Feature	License Required	Platforms
MDM Enrollment (ADE, BYOD)	Intune P1	iOS, iPadOS, macOS
MAM (app protection, no enrollment)	Intune P1	iOS, Android
VPP App Licensing	Intune P1 + ABM	iOS, iPadOS, macOS
Platform SSO (macOS)	Entra ID P1	macOS 13+
Conditional Access	Entra ID P1	All platforms

🏢 Apple Business Manager

Apple Business Manager (ABM) is required for zero-touch ADE enrollment and VPP app purchasing. Set up ABM at business.apple.com before connecting to Intune.

🔗 Linking ABM to Intune

1

Generate MDM Server Token

In ABM → Settings → MDM Servers → Add MDM Server → Download token (.p7m file).

2

Upload to Intune

Intune admin center → Devices → iOS/iPadOS → Enrollment → Apple MDM Push Certificate → upload token.

3

Set Default MDM Server

In ABM, set Intune as the default MDM server for newly purchased or assigned devices.

4

Assign Devices

In ABM, assign purchased devices (or devices added via Apple Configurator) to the Intune MDM server.

🛒 Device Acquisition Methods

New purchase from Apple: Auto-assigned via reseller order
Apple Configurator 2: Add existing devices via USB pairing
Reseller: Reseller adds via Apple DEP portal
Carrier: Carrier adds cellular devices

Devices added to ABM can be re-assigned to a different MDM server within ABM — Intune doesn't need to be involved until the device actually enrolls.

📡 APNS Configuration

APNS certificate renewal must happen annually using the same Apple ID used to create it. If you renew with a different Apple ID, all enrolled Apple devices will lose management and must re-enroll!

📜 APNS Setup Steps

1

Download CSR from Intune

Intune → Devices → iOS/iPadOS → Enrollment → Apple MDM Push Certificate → Download CSR.

2

Sign with Apple

Go to identity.apple.com/pushcert → Upload CSR → Download .pem certificate.

3

Upload to Intune

Upload the .pem file back to Intune. Certificate is valid for 1 year.

⏰ Renewal Best Practices

Set calendar reminder 30 days before expiry
Document the Apple ID used (store in password manager)
Renew — do NOT create a new certificate
Intune will alert when expiry is approaching
Expiry does NOT immediately unenroll devices — but commands stop working

⚡ ADE – Automated Device Enrollment

ADE (formerly DEP) provides zero-touch supervised enrollment. The device is associated with your organization the moment it's powered on — Setup Assistant guides the user through enrollment automatically.

📱 iOS ADE Features

Supervised mode: Enabled by default via ADE
Blocks user from removing MDM profile
Supports Activation Lock bypass
Allows screen time restrictions
App installation without user approval
Per-app VPN enforcement

⚙️ Setup Assistant Customization

Skip or show specific Setup Assistant panes
Skip: Location Services, Siri, iCloud, etc.
Lock language and locale
Require user authentication at enrollment
Await final configuration (block until policies apply)

💻 macOS ADE Features

Bootstrap token support (FileVault escrow)
Platform SSO with Entra ID
Silent app install via PKG
Shell script deployment at enrollment
System Preference lock capabilities
Automatic MDM enrollment on first boot

🔐 Platform SSO (macOS 13+)

Create local account at first login with Entra credentials
Entra ID becomes the authentication source
Password changes sync between local and Entra
Touch ID works with SSO extension
Requires: Entra ID P1, Company Portal app

# Create ADE Enrollment Profile via Graph API
POST https://graph.microsoft.com/beta/deviceManagement/depOnboardingSettings/{id}/enrollmentProfiles

{
  "displayName": "ADE Corporate iOS - Supervised",
  "description": "Zero-touch supervised enrollment for corporate iPhones",
  "isDefault": true,
  "requiresUserAuthentication": true,
  "configurationEndpointUrl": "https://contoso.manage.microsoft.com",
  "enableAuthenticationViaCompanyPortal": true,
  "requireCompanyPortalOnSetupAssistantEnrolledDevices": true,
  "isSupervised": true,
  "setupAssistantItems": [
    { "item": "Location", "enabled": false },
    { "item": "Siri", "enabled": false },
    { "item": "iCloudBackup", "enabled": false },
    { "item": "Diagnostics", "enabled": false }
  ]
}

👤 User Enrollment

🔒 User Enrollment Characteristics

Designed for BYOD – personal device privacy
Creates a separate managed APFS volume
Organization data isolated from personal data
IT cannot see personal apps, photos, or device info
Device serial number is NOT visible to IT
User can unenroll at any time (removes managed volume only)

🚫 Limitations vs. ADE

Device is NOT supervised
Cannot enforce VPN for all traffic
Cannot manage system-level settings
Cannot see device hardware details
Cannot perform remote wipe (only selective wipe)
Cannot install certificates into system store

User Enrollment uses a Managed Apple ID linked to Entra ID via federation — or an Apple ID created in ABM for the employee. This is the recommended approach for BYOD iOS devices in organizations that use ABM.

📱 BYOD via Company Portal

📲 Company Portal Enrollment

1

User installs Company Portal

Download from App Store. User signs in with corporate Entra ID credentials.

2

Choose enrollment type

User selects "I own this device" (User Enrollment) or "My company owns this device" (full MDM).

3

Install management profile

User is guided to Settings → General → VPN & Device Management → Install Profile.

4

Policies applied

Compliance, configuration, and app policies apply automatically after enrollment completes.

📵 MAM Without Enrollment

App Protection Policies (APP) without MDM
Protects corporate data in Outlook, Teams, Edge
PIN required to open managed apps
Block copy/paste to personal apps
Remote wipe of app data only
No device-level visibility for IT

MAM-only is ideal for personal devices where full MDM enrollment is undesirable or restricted by policy.

⚙️ Configuration Profiles

📧 Email & Exchange

Native iOS Mail app configuration
Exchange ActiveSync or Modern Auth
S/MIME signing and encryption
Certificate-based authentication

🌐 Wi-Fi & VPN

WPA2/3 Enterprise (EAP-TLS)
Per-app VPN (always-on per app)
Always-On VPN (supervised only)
DNS settings and split tunneling

🔒 Restrictions

Disable App Store, Siri, AirDrop
Block screen capture
Require passcode complexity
Disable USB accessories

💻 macOS-Specific Profiles

FileVault: Enable disk encryption, escrow recovery key to Intune
Gatekeeper: Enforce app notarization
Privacy Preferences (PPPC): Allow/deny app access to camera, mic, etc.
System Extensions: Approve kernel and system extensions
Login Window: Custom message, disable guest account

📜 Custom Configuration Profiles

Deploy any Apple MDM payload as custom XML
Use Apple Configurator 2 to build profile XML
Upload .mobileconfig file to Intune
Useful for settings not yet in Intune UI
Works on iOS, iPadOS, and macOS

📦 App Management (VPP)

Volume Purchase Program (VPP) licenses are purchased in ABM and synced to Intune. Apps are deployed silently without App Store credentials — users don't need a personal Apple ID for managed apps.

🛍️ VPP Setup

1

Purchase in ABM

Buy app licenses in Apple Business Manager for your org's content token location.

2

Download VPP Token

ABM → Settings → Apps and Books → Download VPP Token (.vpptoken).

3

Upload to Intune

Intune → Tenant Admin → Connectors → Apple VPP tokens → Upload token.

4

Deploy Apps

Intune → Apps → iOS Store App → Select VPP app → Assign to groups with "Required" or "Available".

📱 App Types Supported

App Type	Method
App Store apps	VPP license assignment
Custom in-house apps	LOB (IPA upload)
macOS PKG apps	Direct PKG upload
Web Clips / Shortcuts	Web app (URL)
Microsoft apps (Teams, Outlook)	VPP or direct store

✅ Compliance Policies

📋 iOS Compliance Settings

Minimum OS version (e.g., iOS 17.0)
Passcode required, minimum length
Jailbroken device = Non-Compliant
Threat level (via MDE or MTD partner)
Encryption required (always on iOS)

💻 macOS Compliance Settings

Minimum OS version (e.g., macOS 14.0)
FileVault disk encryption required
System Integrity Protection (SIP) enabled
Gatekeeper enforcement
Firewall enabled

📊 Reports & Monitoring

📈 Device Inventory

OS version distribution
Enrollment type breakdown
Supervised vs. unsupervised
APNS token expiry status

📱 App Reports

VPP license usage and available count
App install status per device
App version compliance
Failed installations

🔒 Compliance Status

Compliant / Non-Compliant / Not Evaluated
Jailbroken device detection
Per-setting compliance detail
Noncompliant device report

🔧 Troubleshooting

❌ Common Issues & Solutions

Issue	Cause	Fix
Device not appearing after ADE setup	Not assigned to Intune MDM server in ABM	Assign device in ABM → sync in Intune
APNS commands not delivered	APNS certificate expired or wrong Apple ID used to renew	Renew APNS with SAME Apple ID; devices may need to re-enroll
VPP apps not installing	VPP token expired or wrong content token location	Re-download and re-upload VPP token from ABM
Profile installation fails	Supervision required but device is unsupervised	Restrict profile to ADE-enrolled (supervised) devices only
Platform SSO not working	Company Portal not installed or old version	Ensure Company Portal 5.2303+ is installed and signed in
FileVault key not escrowed	Bootstrap token not established	Ensure ADE enrollment with SecureToken; run sudo profiles renew

Apple Device Management

📋 Overview & Licensing

iOS iPhone & iPod

iPadOS iPad

macOS Mac

🏢 Apple Business Manager

🔗 Linking ABM to Intune

Generate MDM Server Token

Upload to Intune

Set Default MDM Server

Assign Devices

🛒 Device Acquisition Methods

📡 APNS Configuration

📜 APNS Setup Steps

Download CSR from Intune

Sign with Apple

Upload to Intune

⏰ Renewal Best Practices

⚡ ADE – Automated Device Enrollment

📱 iOS ADE Features

⚙️ Setup Assistant Customization

💻 macOS ADE Features

🔐 Platform SSO (macOS 13+)

👤 User Enrollment

🔒 User Enrollment Characteristics

🚫 Limitations vs. ADE

📱 BYOD via Company Portal

📲 Company Portal Enrollment

User installs Company Portal

Choose enrollment type

Install management profile

Policies applied

📵 MAM Without Enrollment

⚙️ Configuration Profiles

📧 Email & Exchange

🌐 Wi-Fi & VPN

🔒 Restrictions

💻 macOS-Specific Profiles

📜 Custom Configuration Profiles

📦 App Management (VPP)

🛍️ VPP Setup

Purchase in ABM

Download VPP Token

Upload to Intune

Deploy Apps

📱 App Types Supported

✅ Compliance Policies

📋 iOS Compliance Settings

💻 macOS Compliance Settings

📊 Reports & Monitoring

📈 Device Inventory

📱 App Reports

🔒 Compliance Status

🔧 Troubleshooting

❌ Common Issues & Solutions

✅ Implementation Checklist

🏢 ABM & APNS

⚡ ADE Enrollment

📦 Apps & Configuration

✅ Compliance & Access