What automated device enrollment does

Automated device enrollment (ADE) is Apple's zero-touch path for company iPhones. The phone is linked to your device management service before it leaves the box, so on first boot it enrolls in Microsoft Intune, becomes supervised and picks up its settings without a technician touching it.

You need three things first:

• Apple Business (formerly Apple Business Manager), the organization's account that lists its company-owned devices.
• An active Apple MDM push certificate in Intune. Without it, Intune can't talk to Apple devices at all.
• The iPhone in Apple Business. Phones bought from Apple or a participating reseller or carrier are added automatically. Others can be added with Apple Configurator for Mac or Apple Configurator for iPhone (iOS 16 or later).

The enrollment program token

The token is the trust link between Intune and Apple Business. It lets Intune see the phones assigned to it and hand each one an enrollment policy.

Create and upload it

1. In the Intune admin center, go to Devices > Device onboarding > Enrollment, select the Apple mobile tab, then Enrollment program tokens under Bulk Enrollment Methods, and select Add (some pages say Create).
2. Agree to the permission prompt and download the Intune public key certificate, a .pem file. Keep this browser tab open: closing it invalidates the certificate.
3. In Apple Business, go to Devices > Management Services and select Connect external device management (or Get Started for your first service). Name the service, leave Release Devices unchecked, upload the .pem file, select Next, then Download Service Token to get a .p7m file.
4. Back in Intune, enter the Managed Apple Account you signed in to Apple Business with in the Apple ID field, upload the .p7m file under Apple token, and finish the wizard.

Renew it every year

The token expires one year after it's created. Before that date, download a new token in Apple Business (select the service, then Download Token from its Actions menu) and upload it in Intune with Renew token. Renew early if that account's password changes or the person who created the token leaves. An expired token stops syncing and blocks new enrollments.

The enrollment policy

Intune now calls the enrollment profile an enrollment policy. Create one under the token with Enrollment policies > Create policy.

User affinity and sign-in

Choose Enroll with User Affinity when one person will use the phone, and Enroll without User Affinity for shared or kiosk phones. With user affinity, pick how the user signs in:

• Setup Assistant with modern authentication (recommended). The user signs in with their Microsoft Entra account during Setup Assistant, with MFA enforced through Conditional Access, and can use the phone as soon as they reach the Home Screen. Signing in to Company Portal afterward, or to an app that supports just-in-time registration, completes Entra registration and the compliance check.
• Company Portal. The phone can stay locked until Company Portal installs, and the user signs in there to finish enrollment.

Set Install Company Portal with VPP to Yes if you use Apple's Volume Purchase Program. Otherwise the user has to enter an Apple ID to install it. The legacy Setup Assistant method was removed from Intune in October 2026, and existing policies moved to modern authentication. Running Company Portal in Single App Mode until sign-in is no longer supported, so leave it at No.

Supervision and locked enrollment

ADE supervises iPhones automatically on iOS 13 and later, so the policy's Supervised setting no longer changes anything there. Supervision unlocks extra controls, and on a supervised phone Activation Lock stays off unless your device management service allows it.

Set Locked enrollment to Yes to hide the Remove Management button, so users can't unenroll. Phones added with Apple Configurator still show that button for their first 30 days.

Setup Assistant panes

Each pane, such as Passcode, Location Services, Restore, Apple ID, Siri and Apple Pay, is set to Show or Hide. Show only what the user has to decide and hide the rest, so setup takes a minute instead of ten.

Assigning devices

1. In Apple Business, go to Devices > Inventory, select the phones or paste a list of serial numbers, choose Assign Device Management, and pick your Intune service. To send every new purchase to Intune automatically, set it under Management Services > Default Device Assignment.
2. In Intune, open the token, select Devices, then Sync. Intune also runs a delta sync every 12 hours. You can sync manually once every 15 minutes, and a full sync runs at most once every 7 days.
3. Select a policy and choose Set Default Policy, so every phone that syncs gets one. You can also assign specific phones to a different policy. A synced phone with no policy fails to enroll.

What the user sees on first boot

1. They turn the phone on, pick a language and region, and join Wi-Fi.
2. A Remote Management screen says the organization will configure the phone.
3. With modern authentication, they sign in with their work account and complete MFA.
4. Setup Assistant shows only the panes you left visible.
5. The Home Screen appears with management already in place. Signing in to Company Portal finishes registration.

Common failures and fixes

• The phone doesn't show up in Intune. Check that it's assigned to the Intune service in Apple Business, then sync the token. Remember the 15-minute limit on manual syncs.
• Setup runs like a personal phone. The phone was activated before it was assigned, and ADE only applies during Setup Assistant. Erase it and start again.
• The phone syncs but won't enroll. It has no enrollment policy. Set a default policy on the token or assign one to the phone, then erase and retry.
• The token expired. Syncing stops and new phones can't enroll. Renew the token, then sync.
• Sign-in fails in Setup Assistant. Check the user's Entra account, their MFA methods and the Conditional Access policies that apply. Phishing-resistant MFA isn't supported in Setup Assistant on iOS, so a policy that requires it will fail there.
• The phone isn't in Apple Business at all. Add it through the reseller or carrier, or with Apple Configurator, then assign, sync and erase it. A phone added with Apple Configurator has a 30-day provisional period, during which the user can release it from Apple Business and management.

Technician checklist

• Apple Business account in place and the Apple MDM push certificate active in Intune.
• Enrollment program token valid, with its renewal date on the calendar.
• The phone's serial number in Apple Business and assigned to the Intune service.
• Token synced, and the phone listed under the token's devices.
• Enrollment policy with user affinity, modern authentication and locked enrollment, set as the default.
• Phone new or erased before its first boot.
• The user's Entra account and MFA tested.