Method 1: Automated Device Enrollment (Corporate-Owned)

Automated Device Enrollment (ADE) is the gold standard for corporate-owned hardware. It leverages Apple Business Manager (ABM) to wirelessly enroll devices during the initial Out-Of-Box Experience (OOBE). This method prevents users from removing the management profile and scales effortlessly for large deployments, allowing you to batch-assign hundreds or thousands of devices at once.

Within ADE, you must define the user affinity in your Intune enrollment profile based on how the hardware will be used:

Option A: ADE with User Affinity (1:1 Devices)

This option associates the device with a specific Microsoft Entra ID user, making it ideal for dedicated employee devices.

1. The device is unboxed and powered on.

2. The Apple Setup Assistant runs and prompts the user for their corporate credentials.

3. Upon authentication, the device enrolls in Intune and registers in Microsoft Entra ID [1.1.1].

4. The Intune Company Portal app automatically installs, allowing the user to access line-of-business (LOB) apps and check their compliance status [1.1.1].

Option B: ADE without User Affinity (Shared Mode)

This is the optimal configuration for devices that function as kiosks, point-of-sale terminals, or shared-utility devices across multiple shift workers.

1. The device enrolls automatically during the Apple Setup Assistant without requiring user credentials.

2. The hardware is not tied to a single user identity, preventing personal data contamination across sessions [1.1.5].

3. When configured with Microsoft Entra ID Shared Mode, the device allows single sign-on (SSO) and single sign-out across supporting apps, ensuring secure handoffs between different employees.

Method 2: Bring Your Own Device (BYOD)

For employee-owned hardware, Intune uses Apple User Enrollment to secure corporate data while strictly separating and protecting the user's personal privacy. IT cannot see personal apps, browsing history, or location data.

Option A: Web-Based Enrollment (Recommended)

This modern approach leverages Just-In-Time (JIT) registration and eliminates the need for the user to download the Company Portal app prior to enrollment.

1. The user navigates to the iOS Settings app or Safari to initiate enrollment using their corporate credentials.

2. A management profile is securely downloaded.

3. The user has a limited window to navigate to Settings > General > VPN & Device Management and install the profile [1.1.4].

4. Intune policies apply only to the corporate partition; personal apps and data remain entirely isolated.

Option B: Company Portal App Enrollment

The traditional BYOD method using the native application.

1. The user downloads the Intune Company Portal app from the App Store.

2. They sign in with their corporate account.

3. The app guides the user through downloading and installing the management profile via the iOS Settings app [1.1.4].

4. Once the profile is trusted and installed, the device syncs with Intune to retrieve compliance policies and work resources.

Verifying Enrollment

Regardless of the method used, administrators can verify successful onboarding by navigating to the Microsoft Intune admin center > Devices > iOS/iPadOS to check device compliance, hardware details, and applied policy status.