Enroll an iPhone in Intune: Company Portal, ADE, MAM · CloudEngineerHub
Device Enrollment10 min read2 views
How to Enroll an iPhone in Intune: Company Portal, Automated Device Enrollment and MAM
Enroll iPhones in Intune: BYOD via Company Portal, supervised Automated Device Enrollment, and MAM without enrollment — setup screens, common blockers, verification.
C
CloudEngineerHub Team
Published: September 23, 2026· Last Updated: October 3, 2026·10 min read
How to Enroll an iPhone in Intune
In most enterprises the iPhone fleet is larger than the laptop fleet, and it holds the crown jewels in miniature: mail, MFA tokens, Teams, and the CRM. Choosing the wrong enrollment strategy — full MDM on a personal phone, or MAM where you needed supervised control — generates either user revolt or a security gap. This guide covers all three Apple/Intune paths end to end, including the exact Setup Assistant screens to configure and the two failure points that cause most tickets.
Visual Walkthrough
Automated Device Enrollment steps that make iPhones zero-touch.
Interactive FlowiOS Enrollment — ABM to Supervised Device6/6
1
ABM/ASM sync
Devices purchased via Apple Business Manager appear in Intune.
iOS Enrollment — ABM to Supervised Device. 1. ABM/ASM sync: Devices purchased via Apple Business Manager appear in Intune. — 2. ADE profile assigned: Supervision, affinity, locked enrollment defaults set. — 3. Setup Assistant runs: User unboxes; Wi-Fi + profile fetch happens in OOBE. — 4. Supervised enrollment: Device enrolls with supervision — richer controls unlocked. — 5. Company Portal + apps: VPP apps, email/Wi-Fi and compliance land. — 6. Managed end-to-end: Locked enrollment prevents un-enrollment; lifecycle clean.
C
CloudEngineerHub Team
Author
The CloudEngineerHub editorial team — Microsoft endpoint management and cloud engineers writing hands-on guides on Intune, Azure, Entra ID, Autopilot, Defender and PowerShell. Every article is reviewed against current Microsoft documentation.
Intune Plan 1 (or Microsoft 365 E3/E5 equivalent) licensed for every enrolling user
Apple MDM push certificate configured in the Intune admin center under Tenant administration > Connectors and tokens > Apple MDM push certificate — mandatory for all device enrollment paths, BYOD included
For Automated Device Enrollment: an Apple Business Manager / Apple School Manager tenant with the Intune MDM server token connected, and device serials assigned to Intune
Company Portal available from the App Store for BYOD users
A Conditional Access design that lets users complete enrollment instead of blocking the very portals they need mid-flight
Pick the right strategy before touching a device
The three methods are not interchangeable, and converting between them later almost always costs a wipe.
Scenario
Method
What IT can see/manage
User experience
Personal phone, work mail and apps only
MAM without enrollment
App-level protection only; no device inventory
Sign in, accept app PIN
Personal phone, broader policy needs
BYOD enrollment via Company Portal
Full MDM policy scope on the device
Install app + MDM profile
Corporate-owned iPhone
Automated Device Enrollment (supervised)
Everything: non-removable MDM, global proxy, Lost Mode
Setup Assistant only
Two rules of thumb: never supervise a personal device, and never rely on MAM alone for a device that must comply with encryption, OS version, or jailbreak posture requirements.
Method 1: BYOD enrollment with the Company Portal app
This is the default for personally-owned iPhones. The device becomes Entra-registered and MDM-enrolled; the user keeps ownership of the device.
User steps, exactly
Step
Where
What happens
1
App Store
Install Intune Company Portal
2
Company Portal
Sign in with the work (Microsoft Entra ID) account
3
Company Portal
Review the privacy information, then tap Begin enrollment / Enroll device
4
Safari (automatic redirect)
The enrollment profile downloads; iOS shows Profile Downloaded
5
Settings > Profile Downloaded
Tap Install, enter the device passcode, confirm
6
Settings > General > VPN & Device Management
The MDM profile shows as installed/verified
7
Company Portal
Compliance check runs; device shows a green status
What you can actually manage on a BYOD iPhone
Policy scope includes password/PIN requirements, encryption enforcement, OS version minimums, Wi-Fi and VPN profiles, mail configuration, app deployment through Company Portal and Volume Purchase Program, and selective wipe of the corporate container. Apple's BYOD surface deliberately hides personal content from IT: no access to photos, messages, call history, or personal app inventories. Publish that boundary verbatim in your onboarding communication — it defuses most privacy objections before they start.
Registration versus enrollment
Company Portal performs two logically separate actions: the device registers with Microsoft Entra ID (which is what Conditional Access evaluates) and then enrolls into MDM (which is where compliance policies apply). A device can get stuck between the two — registered but with the MDM profile never installed. That state is the single most common BYOD failure, and it is invisible unless you know to look.
Field note: Users routinely stop at step 4 because Safari closes and they assume they are done. The profile sits unopened in Settings > Profile Downloaded. Put that exact path in your enrollment email — it eliminates the majority of "my device shows pending" tickets.
Method 2: Automated Device Enrollment for corporate iPhones
ADE gives you supervised devices with non-removable MDM, configured before the user touches anything.
Wire the serials and build the profile
Connect the ABM/ASM token in the Intune admin center (Devices > Enrollment > Apple > Apple enrollment program tokens). Devices bought through a linked reseller or carrier appear automatically; otherwise import serials. Assign serials to the Intune MDM server, then create an iPadOS/iOS enrollment profile under the token: choose User affinity for shared-with-a-user corporate phones (users authenticate with their work account through Setup Assistant or Company Portal) or without user affinity for pooled devices. Leave supervision on and MDM profile removal off — that combination is the point of ADE.
Key profile fields Apple exposes under the hood look like this (the enrollment URL is set automatically by Intune):
Prevents personal data cascading onto corporate devices
Diagnostics
Hide
Corporate data should not flow to third parties
iMessage / FaceTime
Hide
Corporate policy call, not a user choice
Passcode
Show
Pairs with your compliance policy requiring a PIN
Terms and Conditions
Show
Apple requires acceptance for management
Ship it
Any iPhone already in use must be erased first (Settings > General > Transfer or Reset iPhone > Erase All Content and Settings). On next boot the device pulls the assigned profile during Setup Assistant, enrolls silently, and prompts only for the steps you left visible. If the device sits at "profile not assigned," sync the ABM token in Intune and confirm the serial maps to the correct MDM server.
Visual Walkthrough
Protect the data, not the device: the BYOD-friendly contract.
Interactive FlowApp Protection Policies — MAM Without Enrollment6/6
1
APP policy authored
PIN, encryption, cut/copy/save-to rules per platform.
Intune MAM service brokers policy — no MDM needed.
enforce
4
Policy enforced
Work data sandboxed; clipboard/save restricted as designed.
wipe
5
Selective wipe
Offboarding wipes work data only — personal content untouched.
6
Data never leaves policy
Screenshots/save-as rules keep corporate data inside the sandbox.
App Protection Policies — MAM Without Enrollment. 1. APP policy authored: PIN, encryption, cut/copy/save-to rules per platform. — 2. User signs in with work ID: Intune SDK inside Outlook/M365 app detects identity. — 3. MAM channel established: Intune MAM service brokers policy — no MDM needed. — 4. Policy enforced: Work data sandboxed; clipboard/save restricted as designed. — 5. Selective wipe: Offboarding wipes work data only — personal content untouched. — 6. Data never leaves policy: Screenshots/save-as rules keep corporate data inside the sandbox.
Method 3: MAM without enrollment for protects-only scenarios
Not every scenario justifies full MDM on a phone. App protection policies (MAM-WE) apply data controls inside managed apps — Outlook, Teams, Edge, and any Intune SDK-enabled app — without enrolling the device at all.
In the Intune admin center, go to Apps > App protection policies > iOS/iPadOS > Create policy.
Target the public apps or custom apps your users need; pick your data-protection level.
Assign to the user group, then create a Conditional Access rule granting access only to apps protected by app protection policies.
Data protection level
Typical contents
Fits
Level 1 — enterprise basic
App PIN, simple PIN, block save-as to unmanaged
Minimum viable baseline
Level 2 — enterprise enhanced
Encrypt app data, block copy/paste to unmanaged apps, require OS minimum
Most organizations
Level 3 — enterprise high
Restrict web content to managed browser, block keyboard third parties
Regulated industries
The user experience is just a sign-in gate and an app PIN; there is no profile, no device inventory, and no compliance state. The trade-off is real: you cannot enforce device-level encryption, jailbreak detection, or OS currency with MAM alone. Use it where BYOD friction outweighs device risk, and pair it with a policy that forbids unmanaged mail apps from touching corporate mail (via Conditional Access).
Verification steps
On the iPhone: Company Portal shows the device with green compliance; Settings > General > VPN & Device Management lists the MDM profile.
Intune admin center:Devices > iOS/iPadOS — device record present, supervised column shows Yes for ADE devices, primary user correct, compliance policies reporting.
Microsoft Entra admin center:Devices > All devices — device registered/joined as expected.
Functional test: on a noncompliant or unprotected device, opening Outlook web or the Outlook app should be blocked by Conditional Access. If it is not, the CA rule — not the enrollment — is your gap.
Common blockers and fixes
Blocker
Cause
Fix
Company Portal stuck at "MDM payload pending"
Profile downloaded but never installed in Settings
Guide user to Settings > Profile Downloaded > Install
Enrollment fails at sign-in
No Intune license or user excluded from enrollment group
Verify license and group membership, retry
Configuration profile never downloads
Safari content blockers or corporate proxy filtering enrollment endpoints
Allow the Microsoft/Apple endpoints listed on Microsoft Learn
ADE device shows "not assigned"/loops
Token out of sync or serial on the wrong MDM server
Sync the token; reassign serial in ABM
"Unable to verify device" across many devices
Apple MDM push certificate expired or renewed on a different account
Renew the push certificate under Tenant administration > Connectors and tokens
Device enrolled but not supervised
Enrolled via Company Portal instead of ADE
Supervision cannot be added without a wipe — re-enroll through ADE
Conditional Access blocks Company Portal itself
Device-based CA rule evaluated before enrollment
Exclude the Company Portal/Intune apps or use app-based CA conditions
Field note: Renew the Apple MDM push certificate with a calendar reminder 30 days ahead, not when devices stop checking in. An expired certificate halts every Apple platform at once — Macs, iPhones, and iPads — and the renewal must be completed from the same Apple ID that created it.
Key takeaways
Choose the method before the rollout: MAM for app-level protection, Company Portal BYOD for personal devices needing policy, ADE for corporate phones.
BYOD enrollment is a two-step flow (Entra registration + MDM profile install), and the unopened Profile Downloaded entry is where most users stall.
ADE delivers supervision and non-removable MDM but requires ABM serial assignment, an enrollment profile, and a wipe for devices already in use.
Configure Setup Assistant screens deliberately — hiding Restore, Diagnostics, and iMessage keeps personal data and corporate policy choices out of the flow.
MAM without enrollment cannot enforce device posture; pair it with Conditional Access rules that require app protection policies.
Verify in three places: Company Portal/Settings on the device, the Intune device record, and the Entra device object — then prove CA blocks a noncompliant device.
The Apple MDM push certificate is a single point of failure for all Apple platforms; track its expiry centrally.
Frequently asked questions
Can I convert a BYOD iPhone to a supervised corporate device without wiping it?
No. Supervision can only be established during Automated Device Enrollment (or with Apple Configurator), and both require erasing the device. Plan ownership changes as a wipe-and-re-enroll event with data migration handled at the app or iCloud level.
Does MAM without enrollment protect Safari and other native apps?
Not meaningfully. App protection policies govern Intune SDK-enabled apps; for web content you should route users through Microsoft Edge with policy that restricts corporate links to the managed browser. Native Safari on a non-enrolled device is outside your control, which is exactly why protects-only scenarios pair MAM with strict Conditional Access.
Do corporate iPhones need an Apple ID at all?
Often no. For user-affinity ADE devices an Apple ID is convenient but much of the setup works with a Managed Apple ID or without one if you hide the Apple ID pane and deploy apps via Volume Purchase Program through Intune. For pooled devices without user affinity, skip the personal Apple ID entirely and manage everything through MDM.
Comments
0No comments yet — be the first to share your thoughts.