Plan Apple Device Enrollment with Intune and Apple Business Manager

Choose the enrollment method before creating profiles. A reliable design separates corporate-owned devices from personal/BYOD devices and uses Apple Business Manager whenever the organisation owns and procures the hardware through supported channels.

Corporate-owned devices: Automated Device Enrollment

For new organisation-owned iPhone/iPad and supported Apple platforms, Automated Device Enrollment (ADE) is the scalable default. The device is assigned to the Intune MDM server in Apple Business Manager, Intune synchronises the serial number, and an enrollment profile controls Setup Assistant and management behaviour.

1. Maintain a valid Apple MDM push certificate in Intune.
2. Connect Apple Business Manager to Intune with the Apple enrollment token.
3. Assign devices to the Intune MDM server in Apple Business Manager.
4. Sync devices in Intune and create/assign the correct ADE profile.
5. Test a wiped pilot device before releasing the profile broadly.

Existing corporate devices: Apple Configurator

Apple Configurator is useful when an existing organisation-owned device was not automatically available in Apple Business Manager or when a wired preparation workflow is needed. Expect to erase the device during preparation and test the final MDM assignment.

Personal devices

Do not supervise personal devices. Use one of Intune’s supported personal-device enrollment/application-protection designs so corporate management is appropriate to the ownership model.

Operational checks

• Track certificate/token expiry dates.
• Use separate pilot and production assignment groups.
• Document whether profiles use user affinity and how authentication occurs.
• Test Setup Assistant after any major profile/token change.
• Keep screenshots free of serial numbers, tokens, tenant IDs and user data before publishing documentation.

References: Microsoft Learn – Automated Device Enrollment overview and Apple device enrollment guide for Intune.