How to Enroll a Personal iPhone in Intune with Company Portal (BYOD)

A personal iPhone can join Microsoft Intune with the Company Portal app. There’s no reset and no supervision: the user keeps their own iPhone, and Intune manages it for work. This guide follows a real lab tenant, first everything the admin prepares in the Intune admin center, then every screen on the iPhone, and finally what Intune shows once it’s enrolled.

Enrolling your own iPhone? Do this.

1. Install Intune Company Portal from the App Store and open it.
2. Sign in with your work account and finish the sign-in (here it finished in Microsoft Authenticator).
3. On Set up access, select Begin, read the privacy screen, then Continue and Allow the profile download in Safari.
4. Open Settings > General > VPN & Device Management, select the downloaded Management Profile, then Install, your passcode, Install again and Trust.
5. Go back to Company Portal, select Continue, wait for the device settings check and select Done.

The rest of this guide is the admin side, and what each step looks like.

What is Company Portal enrollment?

Microsoft Learn calls it Apple device enrollment: a way for employees and students to enroll their own iPhones and iPads for work. It comes in two flavors:

• Device enrollment with Company Portal uses the app. This guide covers it.
• Web based device enrollment happens in Safari, without the Company Portal app.

Learn compares them side by side. Both need no device reset, the user starts the enrollment, there’s one user per device, and there’s no supervision. Just-in-time registration works with both. The app way needs two apps, Intune Company Portal and Microsoft Authenticator, and it happens in three places: Company Portal, Safari and the Settings app.

Learn also recommends web enrollment with just-in-time registration as the most secure method for device attestation, so keep that in mind when you choose.

Learn’s comparison table still says iOS 14 and later for the app. Intune’s supported operating systems page is the one to follow: devices with user affinity, like these personal iPhones, are supported from iOS/iPadOS 18 (checked November 2026).

After enrollment, users can rename, remove, remote lock and check the status of their device in Company Portal. Rename only changes the name in Company Portal, not in Intune.

Before you start

Learn’s guide for personal iPhones lists three things: supported devices, an active Apple MDM push certificate, and an enrollment policy. In the lab it looks like this:

1. Apple MDM push certificate. Devices > Enrollment > Apple: ours shows Active, with 365 days until it expires. It’s valid for one year and it’s renewed with the same Apple account that created it. No certificate yet? Here’s how to create one.
2. MDM authority. Tenant administration > Tenant status shows Microsoft Intune. In a new trial tenant it’s set by default.
3. License. Each user who enrolls needs at least Intune Plan 1. In the Microsoft 365 admin center, the user’s apps list shows Microsoft Intune Plan 1 turned on. See Microsoft Learn for which plans include it.
4. Groups. A security group for users with assigned membership (our tutorial user is its only member), and a dynamic device group with the rule device OS type equals iPhone, or iPad. Enrolled iPhones and iPads land in it on their own.
5. Assignment filter. A filter for iOS/iPadOS with device ownership equals Personal. Policies assigned to users can use it to reach only personal devices.

Enrollment restrictions

Learn lists two kinds: device platform restrictions and device limit restrictions.

Device platform restrictions. Devices > Enrollment > Device platform restrictions, then the iOS restrictions tab. Out of the box there’s one policy, the Default, assigned to all users. Create restriction, and Platform settings has three choices:

• MDM: Allow or Block.
• Allow min/max range: the oldest and newest iOS version that can enroll.
• Personally owned devices: Allow or Block.

The lab keeps MDM and personal devices on Allow, with a minimum of 18.0. The page notes that version restrictions only apply to devices enrolled with the Company Portal. Assign it to the pilot user group, review and create. The new restriction lands at priority 1, above the Default, and a device follows the highest priority restriction assigned to its user.

Device limit restrictions. The default allows 5 devices per user, and a new restriction can go from 1 up to 15. The lab uses 10 for the same user group, and it also sits above the default.

One note from Learn: enrollment restrictions aren’t security features. A compromised device can misrepresent itself; they’re a best-effort barrier for non-malicious users.

The enrollment type profile

Enrollment > Enrollment types: the list starts empty. Create profile, iOS/iPadOS. On Basics, a name and a description (users don’t see these). On Settings, the Enrollment type dropdown has four options:

• Web based device enrollment: enrollment happens on the web version of Company Portal, without the app.
• Account driven user enrollment: the user adds their work account in Settings, and Intune manages a specific set of features and work apps.
• Device enrollment with Company Portal: the typical enrollment in the Company Portal app. The whole device is managed, not just specific apps.
• Determine based on user choice: the user picks during enrollment, and either user enrollment or device enrollment is used.

The lab picks Device enrollment with Company Portal. Learn’s guide lists what comes with it: certificates can apply to the whole device, users install updates themselves, and a user must be associated with the device. Assign the pilot user group, review and create. The profile shows up at priority 1. If a user gets more than one profile, Intune applies the higher priority one, and you can drag to reorder.

Compliance policy

Before any policy, there are the tenant-wide Compliance policy settings:

• Mark devices with no compliance policy assigned as: the default is Compliant. The lab uses Not compliant, the value Learn points to when you use Conditional Access.
• Compliance status validity period: 30 days by default.

Then the policy: Create policy, platform iOS/iPadOS, a name and a description. Compliance settings has five groups: Email, Device Health, Device Properties, Microsoft Defender for Endpoint and System Security. The lab sets:

• Device Health: block jailbroken devices.
• Device Properties: minimum OS version 18.0.
• System Security: require a password, minimum length 6.

Actions for noncompliance has Mark device noncompliant, immediately; every policy includes that action by default. Assign it to the pilot user group, review and create.

What the user needs

Learn’s user guide lists the Safari web browser, a supported iOS version (for Intune today, iOS 18 or later), a stable Wi-Fi connection, the Intune Company Portal app and the latest Microsoft Authenticator. Learn also notes that pausing for more than a few minutes can make Company Portal close or end setup.

In the lab, the user is tutorial with one assigned license, and Microsoft Authenticator is already registered as a sign-in method, so the sign-in on the iPhone can finish there.

On the iPhone: the app and the sign-in

1. Open the App Store, search for Company Portal and install Intune Company Portal from Microsoft. Then Open.
2. Sign in with the work account, here on our branded sign-in page.
3. Choose Face, fingerprint, PIN or security key. iOS offers a QR code to use a passkey from another device, and Microsoft Authenticator opens and finishes the sign-in.
4. Company Portal asks to send notifications, so the user doesn’t lose access to work resources: Ok, then Allow.
5. Set up howtomecm access lists four steps: review privacy information, download the management profile, install it, and check the device settings. Begin.

The privacy screen. What the company cannot see: browsing history, personal email, documents, contacts and calendar, passwords, photos, and the location of a personal device. What it can see: the model, serial number and operating system, the device name, and information from work apps and networks. It can also reset a lost or stolen device. If the company sets it up, it can see the full phone number, every installed app and the location of a lost device. Continue.

On the iPhone: the management profile

1. Download. Continue opens Safari, which asks to download a configuration profile: Allow, Touch ID, and Close. Back to Company Portal.
2. Install. In Settings > General > VPN & Device Management there’s the downloaded Management Profile. Install, the passcode, and Install again. Our iPhone asked for Touch ID to enroll in MDM.
3. Trust. The warning says it installs Microsoft’s root certificate and lets the administrator manage the iPhone remotely. Install, then Trust.
4. The profile enrolls its certificates and shows Profile Installed. It contains Mobile Device Management, two certificates, and an ACME device identity certificate.
5. Check. Back in Company Portal, Continue. Checking device settings took about twelve seconds in the lab, then You’re all set: Done. Company Portal registers the device: Success! You’re registered!

Under Devices in Company Portal, the iPhone shows Can access company resources and Ownership type: Personal.

After the profile downloads, install it within a limited time. If it expires, download it again from Company Portal.

Verify in Intune

• Apple mobile devices: the iPhone is managed by Intune, ownership Personal, compliant, iOS 27.0.1, with tutorial as the primary user.
• Device overview: the same badges, Compliant and Personal, and the compliance status: two policies, both compliant.
• Device compliance: our iOS compliance policy and the built-in Default Device Compliance Policy. Open ours, and each setting reports Compliant: minimum OS version, minimum password length, the password requirement and jailbroken devices.
• Dynamic device group: it picked the iPhone up on its own. One member, and the dynamic rules processing status says Succeeded.
• Assignment filter: the Personal filter’s preview now matches the device.

Can I enroll a personal iPhone without Company Portal?

Yes. Web based device enrollment runs in Safari and the Settings app, and it only needs Microsoft Authenticator. Account driven user enrollment starts from the work account in Settings. Company-owned iPhones use other methods, like Automated Device Enrollment or Apple Configurator. See our Intune Apple enrollment explainer for every Apple method side by side, and Microsoft’s iOS/iPadOS enrollment guide.

Sources

• Microsoft Learn, Overview of Apple device enrollment
• Microsoft Learn, iOS/iPadOS enrollment guide
• Microsoft Learn, What are enrollment restrictions?, device platform restrictions and device limit restrictions
• Microsoft Learn, iOS/iPadOS compliance settings
• Microsoft Learn, Set up your personal iOS device
• Microsoft MD-102: Microsoft 365 Endpoint Administrator course (Module 4, enroll iOS/iPadOS devices; enrollment restrictions)

That’s the whole path: an active push certificate, Intune as the MDM authority, at least Intune Plan 1, groups and a filter, enrollment restrictions, the enrollment type profile and a compliance policy, then Company Portal, the sign-in, the profile in Settings, and Success. Company Portal or web enrollment, which one do your users get? Tell me in the comments.