Comments on: How to start with iOS User Enrollment using Microsoft Intune

By: Richard

Richard — Fri, 21 Apr 2023 05:24:54 +0000

Hi Peter, I’m a bit confused about signing in to Company Portal on the device, then signing in with Managed Apple Id on the device. I sign in to Company Portal ok, but when signing in with Managed Apple Id, it displays my corporate email address that I login to Company Portal with. The Managed Apple Id cannot be edited to change it to my @company.appleid.com address. Do I need to add my corporate email address domain in Apple Business Manager as a Managed Apple Id domain?

By: John

John — Sat, 23 Jan 2021 09:46:57 +0000

In reply to CS. Great article. Thank you for the info. Just a few questions about deployment of apps. As you said IOS devices do not have the work container. Currently we have deployed Defender ATP as well and made appd available in Company portal. However, the apps installed is being downloaden from app store. How does this separate work and prvate dats when using the same app? Example Word or Outlook, you add a private account in the app. Can the company also manager or see this info?

By: Peter Klapwijk

Peter Klapwijk — Mon, 27 Jul 2020 18:26:45 +0000

In reply to Nils. Hi Nils, This article describes the User enrollment management option. This is intended for personal owned devices and yes the user should use his personal to install the Company portal app.

By: Nils

Nils — Wed, 08 Jul 2020 15:13:16 +0000

HI Peter, Many thanks for the write up on how to deploy IOS Devices via Intune. I have configured the works (Register with ABM, Setup VPP Token Setup) so I do not need to create fake company apple id’s but do it via the ABM. I imported several apps via the ABM into Intune and that worked fine. Now my biggest question is; I enroll a user (based on the ABM setup) and this user cannot install anything from the apple store (that is what we want eh?) but how can I then let the user deploy the very first app needed to control the device? If I am not allowed to download Intune Company Portal as an app, then how can I deploy the device? My workaround now is to temporarily use my private apple id to sign into the apple store, download the Intune app and then remove the account again but this is a crude workaround. What am I doing wrong here?

By: Peter Klapwijk

Peter Klapwijk — Tue, 28 Apr 2020 19:05:51 +0000

In reply to CS.

Hi CS,

If you enable User enrollment and the end-user chooses that the iOS device is owned by the company during enrollment, no factory reset is needed. The enrollment is not completely equal to above, but a wizard like enrollment is started like above. Some steps differ and more info is visible for the IT admin in the Endpoint Manager portal.

If you want a zero-touch deployment of your iOS devices, you should use Apple Business Manager (formerly known as DEP). In that case, when a new device is started (or after a factory reset), enrollment starts.

By: CS

CS — Tue, 28 Apr 2020 18:39:48 +0000

Basically, if I clarify above a little more step wise…

• So basically, I start my enrollment process in the same way as you showed in the demo, meaning I will open Company portal app and sign-in.
• I have been assigned a particular Enrollment-profile already created in Intune
• This Enrollment-profile has enrollment-type as “Device Enrollment” (this is different from your blog)
• This is to enroll the device as CORPORATE in Intune
• So though the device serial-id is NOT in Intune, Intune point of view this is CO (corporate owned fully managed) device.
• So In general when I am doing CO type of enrollment, the MDM would ask to factory reset the device.
• So the Company portal app will show me a message to factory-reset the device and kick off enrollment.

• If it was Android, I could have factory-reset and then I would scan the QR-code or feed in the token manually (precreated on Intune) to kick start the enrollment process from the brand new device.

• I do not know, how to kick start enrollment process in case of iOS once I factory-reset the device.

• Do I have to manually install the “company portal” on the factory-reset device and then it kick off ?
Will Intune sense out that this is brand new device and ready to be enrolled as CORPORATE ?

By: CS

CS — Tue, 28 Apr 2020 15:21:29 +0000

I totally understand “iOS User Enrollment”
The other way of creating enrollment profile for user is “iOS Device Enrollment”
As the word suggests, this is to register the device as CORPORATE in Intune

So if install and sign in “company portal” on my running iOS device, Intune will realize that this device has to be treated as CORPORATE
So my understanding is , I will be asked to factory-reset the device.
If I factory-reset the device, I want to know what is the next step to enroll the device.
It’s like a brand-new device which I want to enroll into Intune.
Do I have to again install “company portal” and sign-in and will Intune sense out that this is brand new installation ?

Thanks.

By: Peter Klapwijk

Peter Klapwijk — Tue, 03 Mar 2020 19:16:28 +0000

In reply to Steven Siu. It is a big disadvantage ABM (DEP) accounts need to be used for this. Google has done a better job with Work profile.

By: Steven Siu

Steven Siu — Tue, 03 Mar 2020 18:42:26 +0000

We had to abandon User based enrollment back in November 2019 and go back to Device based enrollment because Apple did not allow us to have an ABM account. During the verification process, we were told ABM is for corporate owned devices only; since we have a BYOD environment, ABM is not for us.

By: Peter Klapwijk

Peter Klapwijk — Fri, 06 Dec 2019 11:42:45 +0000

In reply to RT. I have not used federation, but with federation the accounts should be created automatically in ABM. User enrollment should be visible when federation is used as far as I know. but as it is a preview, things might not work as expected.