Intune Apple Enrollment Explained: iPhone, iPad and Mac

A brand-new iPhone lands on your desk, next to a new MacBook. You turn them on, pick your language, join the Wi-Fi, and then a screen you might not expect: Remote Management. This iPhone is owned by your company.

You sign in with your work account, and a few minutes later your email, apps and security settings are already there. Nobody from IT touched them. That’s enrollment, and this article walks through the main ways to enroll iPhones, iPads and Macs in Microsoft Intune.

Apple sits in the middle

With Windows, enrollment is mostly a conversation between the device and Microsoft. Apple devices work differently, because Apple sits in the middle.

• Apple’s push notification service. Management services like Intune use it to stay in touch with iPhones, iPads and Macs. That’s how a device learns a new policy or app is waiting. To use it, Intune needs a certificate from Apple.
• Apple Business and Apple School Manager. Apple’s portals for the devices an organization buys (Apple Business was called Apple Business Manager). Buy through them, and a new device knows who it belongs to before it leaves the box.

Two ideas then decide which method fits:

1. Ownership. A company iPhone can be fully managed. A personal iPhone should keep its owner’s photos and messages private.
2. Supervision. A supervised device is one the organization owns, so it gets extra control. Blocking AirDrop, turning off the App Store or locking an iPad to a single app only work on supervised devices. iPhones and iPads become supervised through Automated Device Enrollment, or through Apple Configurator, which erases them first. Personal devices aren’t supervised. Macs have their own rules (see below).

Before you start

• Licenses. Users need at least an Intune Plan 1 license. Check Microsoft Learn to see what your plan includes.
• The Apple MDM push certificate. Without it you can’t manage any Apple device. You create it on Apple’s Push Certificates portal and it’s valid for one year, with a 30-day grace period if it expires. Always renew it with the same Apple account you created it with, or your devices have to re-enroll. Use a company mailbox more than one person watches, not someone’s personal Apple account.
• An enrollment token if you buy through Apple Business or Apple School Manager. It connects the portal to Intune and also needs renewing once a year.
• Managed Apple IDs for User Enrollment on personal devices, or federate Apple Business with Microsoft Entra ID so users sign in with their work account.
• Supported versions. Intune supports the three most recent versions of iOS, iPadOS and macOS. When the video was recorded that meant iOS/iPadOS 18 and later and macOS 15 and later; check Learn for the current list.

Five ways in

Device	Method
Company iPhone, iPad or Mac bought through Apple Business / School Manager	Automated Device Enrollment (ADE)
Company iPhone or iPad bought elsewhere	Apple Configurator
Company Mac with no single user	Direct enrollment
Personal iPhone or iPad	User Enrollment or device enrollment
Personal Mac	Company Portal

Automated Device Enrollment (ADE)

ADE (formerly DEP) is the zero-touch route. Devices you buy show up in Apple Business, you assign them to Intune, and Intune gives them an enrollment policy. The box ships straight to the user, Setup Assistant shows the Remote Management screen, and the device enrolls itself during setup. These devices are supervised by default.

• Setup Assistant with modern authentication is Microsoft’s recommendation for devices with a user. The user signs in with their work account during setup, with MFA when your Conditional Access policies require it. The device registers in Microsoft Entra ID when the user signs in to Company Portal or a work app.
• Await final configuration pauses Setup Assistant before the home screen until Intune has installed your device configuration policies.
• Hidden setup screens and locked enrollment. You choose which screens to skip, and locked enrollment stops users from removing management in Settings.
• No user? ADE also covers kiosks, shared iPads and point-of-sale devices. On the Mac the flow is the same.

Apple Configurator and direct enrollment

For company iPhones and iPads that didn’t come through Apple Business, IT connects them by cable to a Mac running Apple Configurator:

• Setup Assistant enrollment wipes the device, can supervise it and supports a user.
• Direct enrollment keeps the data, but the device has no user and the profile file is valid for only two weeks.

Apple Configurator can also add devices to Apple Business (Apple Configurator for iPhone can add Macs too). After that they enroll through ADE, but the user gets 30 days to release the device from your organization, a window devices bought through Apple Business don’t have.

Macs outside Apple Business use direct enrollment: export a profile from Intune and open it on the Mac with admin rights. It doesn’t wipe the Mac, and there’s no user.

The device enrollment manager is a special account that can enroll up to 1,000 devices through Company Portal, handy for labs and shared hardware. It doesn’t work with ADE or Apple Configurator.

Personal iPhones and iPads

Here privacy matters as much as control, and Intune offers two routes:

• Account-driven User Enrollment (iOS/iPadOS 15 and later). The owner goes to Settings > VPN & Device Management and signs in with a Managed Apple ID, or their Entra account once Apple Business is federated. Work apps and data live in a separate space. IT manages only that space, with a limited set of settings, can’t wipe the phone and can’t see personal apps or data. Unenrolling erases the work space and leaves everything personal.
• Device enrollment. The profile covers the whole device, so IT gets more control, but the device still isn’t supervised. Users enroll with the Company Portal app or with web-based enrollment in Safari, which doesn’t need Company Portal. Microsoft recommends the web-based route.

A policy option can also let users choose at enrollment: the whole device, or only work apps and data. In short: User Enrollment for privacy, device enrollment for control.

Personal Macs

Intune lists one personal route for Macs: device enrollment through Company Portal. Company Portal for Mac isn’t in the App Store; users download it from Microsoft or start on the Company Portal website, sign in, then install the management profile in System Settings and confirm with their Mac password.

That approval is user-approved enrollment, and every Mac enrollment in Intune counts as one. It gives the same level of control as a supervised Mac, and on macOS 11 and later Intune turns on supervision automatically. The Mac registers in Entra ID and Intune marks it as personal.

The catch: the user can remove the profile, and its settings and managed apps go with it. That’s why company Macs belong in ADE with locked enrollment.

Which one should you pick?

• Company devices from Apple Business: ADE. Supervised, and locked enrollment keeps management in place.
• Company devices bought elsewhere: add them to Apple Business with Apple Configurator so they get ADE too. Direct enrollment for devices without a user.
• Personal iPhones and iPads: User Enrollment when privacy comes first, device enrollment when you need more control.
• Personal Macs: Company Portal.

Whatever you pick, the Apple MDM push certificate comes first. Which method do you use, and why? Tell me in the comments.