Intune Apple and Android enrollment: which method to use

Pick the route by who owns the device

Ownership decides almost everything. A company-owned device can be registered with the vendor before it ever reaches the user, locked into management and given broad controls. A personal device gets a separated work area and a much shorter list of things you can see or do. Apple and Google built it that way deliberately, and so did Microsoft.

The choice also sticks. An iPhone enrolled with account-driven user enrollment cannot be switched to full device enrollment without unenrolling and starting again. Android corporate modes need a factory reset before enrolment, so changing your mind later means wiping the device. Choose before you touch hardware.

Names have shifted recently, which is why older guides and screenshots may disagree with what you see. Apple's Device Enrollment Program is now Automated Device Enrollment (ADE), and Apple replaced the Apple Business Manager portal with a combined service called Apple Business when it launched on 14 April 2026. Microsoft's pages now say "Apple Business" too. Android's COBO, COPE and COSU abbreviations are now called fully managed, corporate-owned work profile and dedicated devices.

• Company-owned iPhone or iPad, new or wiped, bought through Apple or an authorised reseller: Automated Device Enrollment (ADE). Devices are supervised, which gives you the widest set of controls. Existing company devices that can't go through ADE can be enrolled with Apple Configurator, which needs a Mac and a USB cable.
• Personal iPhone or iPad: account-driven user enrollment on iOS/iPadOS 15 or later, which creates a managed work partition and no supervision. If you only need to protect Outlook or Teams data, app protection without enrollment (MAM) is lighter and often enough.
• Company-owned Android used only for work by one person: fully managed. Company-owned Android where the person may also use it personally: corporate-owned work profile. Shared scanners, kiosks and similar: dedicated devices.
• Personal Android: personally owned device with a work profile.
• Mac owned by the company: ADE. Personal Mac: Company Portal device enrollment (Microsoft also calls this user approved enrollment). Direct enrollment is for userless Macs only.

Apple: create the push certificate (APNs) first

Intune cannot talk to an iPhone, iPad or Mac without the Apple Push Notification service (APNs). The Apple MDM push certificate is what proves to Apple that your Intune tenant is allowed to send management commands. Every Apple route in this article needs it, including ADE and macOS.

You need an account with the Intune Administrator role and an Apple ID that belongs to the organisation. Do not use a personal Apple ID. The certificate is tied to the one you create it with, so use a shared company mailbox that more than one person can read. Agreeing in step 2 lets Microsoft send user and device information to Apple, so tell whoever owns data protection in your organisation before you click it.

The certificate lasts 365 days and Microsoft allows a 30-day grace period after expiry. Renew it with the same Apple ID rather than creating a new one. Microsoft notes that changing the APNs certificate, as opposed to renewing it, forces devices to re-enrol, which is not a conversation you want to have with a fleet.

1. Sign in to the Microsoft Intune admin center and go to Devices. Expand Device onboarding, select Enrollment, open the Apple tab and select Apple MDM Push Certificate. Some tenants label the tab Apple mobile; it is the same area.
2. Select I agree to give Microsoft permission to send data to Apple.
3. Select Download your CSR and save the request file.
4. Select Create your MDM push Certificate. The Apple Push Certificates Portal opens. Sign in with the organisation Apple ID, select Create a Certificate, accept the terms, choose the CSR file and select Upload.
5. Select Download to save the certificate file, which has a .pem extension.
6. Back in Intune, enter the Apple ID you used, browse to the .pem file and select Upload.
7. Reopen Apple MDM Push Certificate. The status should show as active. Record the Apple ID and the expiry date somewhere your colleagues can find them.

Android: link Intune to Managed Google Play

Every Android Enterprise mode, personal and corporate, depends on a link between your tenant and Managed Google Play. It creates the Google enterprise that holds your approved apps and policy, and it pulls in the Microsoft Intune, Microsoft Authenticator, Intune Company Portal and Managed Home Screen apps for you.

Check that Android Enterprise is available in your country or region (it is in the UK) and use an Intune Administrator account whose Microsoft Entra identity has a working mailbox, because Google validates it. Since August 2024 you can link your Microsoft Entra account rather than a Gmail account, and that is what Microsoft recommends for new connections. The sign-in flow crosses Microsoft and Google domains, so if it stalls, put portal.azure.com, play.google.com and enterprise.google.com in the same browser security zone.

Do not treat Disconnect as tidying up. Disconnecting Managed Google Play disables Android Enterprise management for the whole tenant and unenrols every Android Enterprise device.

1. In the Microsoft Intune admin center, go to Devices, then Enrollment, and select the Android tab.
2. Under Prerequisites, choose Managed Google Play.
3. Select I agree, then Launch Google to connect now. Managed Google Play opens in a new tab.
4. Confirm the prefilled Microsoft Entra account is the one you want tied to all Android Enterprise work in this tenant. Follow the prompts to create the Google Admin account, then select Allow and create account.
5. Return to Intune and reopen Managed Google Play under Prerequisites. It should show as connected, and the Intune and Authenticator apps should now be present in your app list. In the Google admin console, add a second owner so the link does not depend on one person.

iPhone and iPad owned by the company: ADE checklist

ADE is the route for company-owned iPhones and iPads. You register the device serial numbers in Apple Business, assign them to Intune, and enrolment starts the moment someone switches the device on and reaches Setup Assistant. No one needs to touch it beforehand. Devices are supervised by default, which unlocks controls such as blocking AirDrop or screenshots and managing updates.

Requirements: Intune Plan 1 or better, the active push certificate from the previous section, access to Apple Business, and a physical iPhone or iPad that is new or wiped and listed in your Apple Business account. Devices bought through Apple or an authorised reseller can be added automatically. This is not something a simulator or virtual device can do, so you need real hardware.

Decide how users sign in before you build the policy. Microsoft recommends Setup Assistant with modern authentication together with JIT registration (just-in-time registration), which completes Microsoft Entra registration inside an app that uses Apple's single sign-on extension. The alternative is the Company Portal app. The older Setup Assistant (legacy) option was retired in the October 2026 Intune service release (2610), and existing profiles that used it have been converted to modern authentication automatically.

Two warnings before you start. A device with no enrollment policy assigned will fail to enrol when someone switches it on. And once a policy is assigned, later changes do not reach those devices until they are factory reset and set up again; only the device name template is exempt.

1. Create the enrollment program token. In Intune go to Devices, then Enrollment, select the Apple mobile tab, then Enrollment program tokens under Bulk Enrollment Methods, and select Add. Select I agree, then Download the Intune public key certificate required to create the token. Keep this browser tab open; closing it invalidates the download and you start again.
2. In the Apple Business portal link shown in Intune, sign in with the organisation Apple ID. Go to your account profile, then Preferences, then MDM server assignments, and add an MDM server. Name it anything sensible, upload the .pem file from step 1 and download the server token, which has a .p7m extension.
3. Still in Apple Business, go to Devices, select your test device, choose Edit device management and pick the MDM server you just added.
4. Back in Intune, enter the same Apple ID, browse to the .p7m file and select Create. Intune syncs the device list from Apple Business.
5. Create the enrollment policy. Go to Devices, Enrollment, Apple mobile tab, Enrollment program tokens, choose your token and select Enrollment policies, then Create policy, then iOS/iPadOS. Name it, then on Configuration settings set User Affinity to Enroll with User Affinity and choose Setup Assistant with modern authentication. Set Supervised to Yes. For a test device you may want Locked enrollment set to No so the management profile stays removable; Yes hides the remove option. Leave Await final configuration on Yes so critical settings land before the home screen appears, and select Create.
6. Assign the policy to your single test device only. Open the token, select Devices, tick the test device, select Assign policy and choose your new policy. Avoid Set Default Policy while the token holds devices you are not ready to enrol, because it applies to everything on that token.
7. Check that your Enrollment Restrictions do not block iOS/iPadOS for the default All Users policy. If they do, ADE enrolment fails and the device shows as Invalid Profile. Blocking only personally owned devices still lets corporate devices through.
8. Switch the test device on, connect it to the network and work through Setup Assistant, signing in with a lab user's Microsoft Entra account when asked. With Await final configuration enabled, the device holds on a final screen while policies install. Microsoft's own validation saw most devices released within about 15 minutes, but more policies and apps means longer, so leave it powered and connected.
9. Confirm success. The device reaches the home screen, Settings shows a message that the device is supervised and managed by your organisation, and the device appears in the Intune device list against your test user. If you did not set up JIT registration, expect Microsoft Entra to show it as non-compliant until the user signs in to Company Portal once. That is expected behaviour, not a failed enrolment.

Android owned by the company: fully managed checklist

Three corporate modes exist and they differ in what the user keeps. Fully managed is the whole device for work, one user, with controls such as allowing installs from Managed Google Play only and blocking factory reset. Corporate-owned work profile is also single user but allows personal use, split into a work profile that you manage and a personal side you cannot see into. Dedicated is for userless kiosk-style devices. This checklist uses fully managed because it is the simplest to verify.

You need a physical Android device you are free to wipe, running Android 10 or later for user-based modes (Android 8 or later for dedicated), with Google Mobile Services, plus the Managed Google Play link from earlier. Any manufacturer will do if those conditions hold. Factory reset is required before enrolment, so use a device with nothing on it that matters.

If you have a Conditional Access policy that requires a compliant device and covers All cloud apps, Android and Browsers, exclude the Microsoft Intune cloud app first. Android setup uses a Chrome tab to authenticate the user, and the policy would otherwise block the device from ever becoming compliant.

The QR code is Microsoft's recommended method for most cases. Other options exist for scale or special hardware. Zero-touch enrollment provisions devices from the box, but only for devices bought from an authorised zero-touch reseller. Knox Mobile Enrollment does the same job for supported Samsung devices. NFC tags and typing a token (afw#setup as the Google account on setup) are not supported for corporate-owned work profile devices running Android 11. AOSP devices without Google services and Android device administrator are outside this article; device administrator is no longer available on devices with Google Mobile Services, so do not build anything new on it.

1. In Intune go to Devices, then Enrollment, and select the Android tab. Under Android Enterprise, then Enrollment Profiles, choose Corporate-owned, fully managed user devices. Intune already creates a Default Fully Managed Profile and token; to create your own, select Create policy.
2. Give the profile a name you will recognise and keep the token type as Corporate-owned, fully managed (default). Move through Device group and Scope tags, which are optional, and select Create on Review + create. Once a profile is assigned, do not rename it; Microsoft warns that renaming can prevent future enrolments.
3. Open the profile and select Token to display the QR code.
4. Factory reset the test device. On the first setup screen, tap the screen repeatedly to launch the QR reader, then scan the code from the Intune admin center. Zoom in on the browser if the camera struggles.
5. Follow the prompts and sign in with a lab user's work account. Do not restart the device during enrolment, as it may look enrolled while no policy reaches it.
6. Confirm success. The device appears in Intune against the lab user, the Microsoft Intune and Microsoft Authenticator apps are installed and cannot be removed, and the lock screen can show that the device is managed by your organisation name.
7. When you have finished enrolling, return to the profile, select Token and choose Revoke token if you no longer need it. Revoking stops anyone else using the code and does not affect devices already enrolled.

Personal iPhone or iPad: account-driven user enrollment

User enrollment is the privacy-friendly route. It creates a managed work partition on the phone, kept apart from personal apps and data. You cannot supervise it, wipe the phone, or see personal apps. Admins can retire, delete, remote lock and sync the device. Removing management erases only the work volume and its keys.

You need iOS/iPadOS 15 or later, the active push certificate, a Managed Apple Account for each person (or federated authentication between Apple Business and Microsoft Entra ID, so people use their work sign-in), JIT registration with Microsoft Authenticator deployed as a required app, and a service discovery file on your web domain. Whoever manages your website or DNS will need to publish that file.

Apps the person installed before enrolling are the classic trap. If someone has already set up Outlook with personal email in the personal area of the phone, the work policy cannot take control of it, and they must remove the app first.

1. Publish a service discovery file at the path /.well-known/com.apple.remotemanagement on the same domain your users sign in with. It has no file extension and must be served with content type application/json. Replace YOUR_ENTRA_TENANT_ID with your Microsoft Entra tenant ID. This is the version for standard Intune environments.
   jsonCopy

   {"Servers":[{"Version":"mdm-byod", "BaseURL":"https://manage.microsoft.com/EnrollmentServer/PostReportDeviceInfoForUEV2?aadTenantId=YOUR_ENTRA_TENANT_ID"}]}

2. From any computer with curl, check the file is served correctly. This only reads from your website and changes nothing. Both commands should return a Content-Type of application/json. Replace the domain and the example user with your own.
   cmdCopy

   curl -I "https://YOUR_DOMAIN/.well-known/com.apple.remotemanagement"
   curl -I "https://YOUR_DOMAIN/.well-known/com.apple.remotemanagement?user-identifier=YOUR_TEST_USER@YOUR_DOMAIN&model-family=iPhone"

3. Set up JIT registration and deploy Microsoft Authenticator as a required app, following Microsoft's JIT registration article for Intune.
4. Create the enrollment profile. Go to Devices, then Enrollment, open the Apple tab, choose Enrollment types under Enrollment options, then Create profile, then iOS/iPadOS. Under Settings set Enrollment type to Account driven user enrollment. Assign it to a pilot group of users. Device groups are not supported for user enrollment.
5. On the test phone, open Settings, then General, then VPN & Device Management. Sign in with the Managed Apple Account or work account, select Allow Remote Management and wait a few minutes while the management profile installs. Authenticator may need a few more minutes to arrive, and trying a work app before then produces an error.
6. Confirm success. Under VPN & Device Management the work account is listed under MANAGED ACCOUNT, and the device appears in Intune as personally owned.

Personal Android: work profile

On a personal Android phone, enrolment creates a work profile that holds work apps and data. Personal apps and data stay in the rest of the phone and Intune does not manage them. Intune is moving this mode to Google's Android Management API, with a browser-based enrolment flow replacing the Company Portal app.

Read the next sentence twice. Enabling web enrollment applies to the whole tenant, covers all new personally owned work profile enrolments, and cannot be reversed. Try it in a lab tenant or make a deliberate decision first. Migrating phones that are already enrolled uses a separate Move to Android Management API policy, which is not covered here.

Requirements: the Managed Google Play link, a device with Android Enterprise support and Google Mobile Services, and a Chrome, Edge or Samsung browser. If passkeys are the only sign-in method accepted in your tenant, leave web enrollment off for now because users cannot complete it. Users must enrol from the primary user account on the phone, not a secondary one, and must not try to enrol into Android 15's private space, which Intune does not support.

1. In Intune go to Devices, expand Device onboarding, select Enrollment and open the Android tab. Under Enrollment Profiles, select Personally owned devices with a work profile.
2. Select Use web enrollment for all users enrolling into Android personally owned work profile management, then Save.
3. Optional but sensible: under Enrollment options on the same tab, open Device platform restriction, then the Android restrictions tab, and create a restriction that blocks Android device administrator enrolment, so devices can't fall back to it. Do not rely on the Personally owned Block setting to keep personal phones out; Microsoft says it does not apply to devices on the Android Management API.
4. On the test phone, open https://aka.ms/enrollmyandroid in the browser, select Get started, then Accept & continue, and sign in with the lab user's work account. Follow the prompts to install the essential apps, register the device and create the work profile. People can also reach the same page from Teams or Outlook when Conditional Access requires enrolment.
5. Confirm success. The work profile exists, the Microsoft Intune app and Company Portal are installed inside it, and the device appears in Intune as personally owned. If Company Portal is missing, check it installed successfully.

macOS: three routes, one shared prerequisite

Macs also need the Apple MDM push certificate, plus macOS 15 or later for devices enrolling with a user (macOS 13 or later can enrol userless). Which route you pick depends on ownership. For a first test on a spare Mac, Company Portal device enrollment is the quickest because it doesn't need Apple Business.

Company Portal device enrollment suits personal Macs. There is no Company Portal in the Mac App Store or through VPP, so the installer package comes from Microsoft. Devices are marked personal unless you add their serial numbers as corporate device identifiers.

ADE suits company-owned Macs bought through Apple or an authorised reseller, with the same Apple Business and token pattern as iPhones, but with a separate macOS token. Existing Macs can be brought into ADE after Setup Assistant. Create the policy under Devices, Enrollment, the macOS tab, Enrollment program tokens, then choose a token and create an enrollment policy. Use Setup Assistant with modern authentication for user affinity. People then sign in to Company Portal to complete Microsoft Entra registration, so deploy it to the Mac first.

Direct enrollment, which uses Apple Configurator, is for company Macs with no user. Intune shows Enroll with user affinity as an option, but it doesn't work in Direct enrollment, so don't pick it.

1. Make sure the Apple MDM push certificate shows as active (see the Apple section above).
2. On the test Mac, download and run the Company Portal installer package from Microsoft and sign in with the lab user's work account.
3. Follow the enrollment prompts and approve the management profile when macOS asks. Until it is approved, the Mac is not enrolled and gets no policy.
4. If the Company Portal window was closed, reopen it so it can finish device registration.
5. Confirm success. The Mac shows as enrolled in Company Portal and appears in the Intune device list under the lab user.

Checking it worked, backing out and where this stops

For every platform, success means the same three things: the device appears in Intune against the right user and ownership type, the expected management app or profile is on it, and a setting or app you assign afterwards actually arrives. Policies and apps are the subject of other chapters, so stop once the device checks in.

Backing out depends on the route, and ownership changes who is allowed to do it. The failure bullets after the rollback list are the usual first-enrolment suspects.

You now have a way to choose a route, the Apple and Google connections in place and a first enrolled device on each platform. Policies, apps, compliance, Conditional Access and updates for these devices are separate jobs, as are specialised routes such as zero-touch at scale, Samsung Knox, shared iPad, Apple Configurator and Jamf-integrated Mac management. If the Apple or Google link is already in use in production, ask someone experienced before touching the push certificate, the token or the Managed Google Play connection. Those three have the longest blast radius.

• Company-owned iPhone or iPad (ADE): an administrator wipes the device from Intune. Users cannot remove an ADE device through Company Portal, and Locked enrollment hides the remove option in Settings. A wiped device that is still assigned an enrollment policy will enrol again, so unassign it in Apple Business if you want it out of management.
• Personal iPhone or iPad: the user can remove management in Settings under VPN & Device Management. Unenrolling erases the managed volume and its keys, and personal data stays.
• Fully managed Android: a factory reset ends management. Revoke the enrollment token after the test.
• Personal Android: the Retire action in the admin center removes work data and makes the device ready to enrol again.
• Mac enrolled through Company Portal: remove the management profile, or retire it from Intune.
• Enrollment fails on first power-on for ADE: the device has no enrollment policy assigned, the token has expired, or iOS is blocked by an enrollment restriction.
• Sign-in Failed with a message that your Apple ID does not support the expected services: the service discovery file is missing or served with the wrong content type.
• Android device enrols but never becomes compliant, or setup stalls on sign-in: look for a Conditional Access policy that needs the Microsoft Intune cloud app excluded.
• Android device looks enrolled but receives nothing: it may have been restarted during enrolment. Reset and try again.
• An ADE iPhone keeps asking for the Company Portal: do not install Company Portal from the App Store on ADE devices; deploy it through Intune instead.
• Apple enrolment suddenly fails across the fleet: check whether the push certificate or ADE token has expired.