KY3095

Posted on Sep 14

How to connect Intune with Apple Business Manager (ABM) and enroll iPhones with Automated Device Enrollment (ADE)

#intune #iphone #ios #mdm

About this article

Intended audience: IT and endpoint management admins who want to manage corporate-owned iPhones / iPads with Intune
What you'll learn
- The concrete steps for the prerequisites (MDM authority and the APNs certificate) you need before you can start with ADE
- How to issue the enrollment program token that connects ABM and Intune
- How to create an enrollment profile for Automated Device Enrollment (ADE)
- What actually happens from the moment you power on an iPhone until it becomes managed
Test environment: Microsoft Intune admin center / Apple Business Manager (as of September 2026)
Assumptions: The devices are new, purchased through ABM, or have been wiped

With Automated Device Enrollment (ADE), a device enrolls in Intune automatically during the initial setup the first time it's powered on. No manual staging is required, and because the device becomes Supervised, you can apply stronger controls such as restricting app installation, automatically configuring Wi-Fi, and disabling features you don't need.

Why use ADE

When you hand out corporate-owned iPhone, you could set each one up by hand and have users enroll them from the Company Portal. But that approach has problems.

Staging effort grows linearly with the number of devices
Users can remove the management profile on their own
The devices don't become supervised, so the range of what you can control is limited

ADE solves all of these at once. Once devices are linked to ABM, you can get to a state where you take them out of the box and hand them straight to the user.

Overall workflow

Getting the order wrong means rework, so let's take in the big picture first.

#	Where	What
1-1	ABM	Set up the ABM account and register purchase information
1-2	Intune	Set the MDM authority to Intune
1-3	Intune ⇔ Apple	Get the APNs certificate (Apple MDM push certificate)
1-4	Intune	Check licenses
2	Intune ⇔ ABM	Create the enrollment program token (exchange the public key and the token)
3	ABM	Assign devices to the MDM server
4	Intune	Create the enrollment profile
5	Intune	Assign the profile to devices
6	Intune	Create a dynamic group
7	iPhone	Initial setup → verify automatic enrollment

[Step 1] Prerequisites

If this is your first time building this out, this is where you can get stuck. Let's walk through it one operation at a time.

1-1. Set up the ABM account and register purchase information

If you don't have an ABM account at all, sign up at business.apple.com. You need a D-U-N-S Number (a company identifier), and because Apple reviews the request it can take anywhere from a few days to a few weeks. If you're planning for ADE, start here first.

Once you have the account, you need to link your devices to ABM. There are two main ways to do that.

Route	Description
Through a reseller (recommended)	Devices purchased from Apple, an Apple Authorized Reseller, or a carrier are automatically added to your ABM account at the time of purchase
Through Apple Configurator	Devices you already have on hand are added to ABM manually using Apple Configurator on a Mac

If you go through a reseller, you need to register the reseller's customer number (purchase information) in ABM under Settings → Enrollment Information → Device Management Settings. If that isn't registered, the devices you purchase never flow into ABM.

If you add devices you already purchased to ABM later using Apple Configurator, the user gets a 30-day provisional period, and during that window they can release the device from management themselves. Devices procured through a reseller don't have this provisional period. If you want to manage corporate-owned devices properly, the rule of thumb is to assume ABM integration from the procurement stage.

1-2. Set the MDM authority to Intune

The MDM authority is the setting that declares which service manages the devices in this tenant. Until an IT admin sets the MDM authority, users can't enroll any devices at all.

First, check the current setting

Sign in to the Microsoft Intune admin center
Tenant administration → Tenant status
Open the Tenant details tab
Check the MDM authority entry

If it shows Microsoft Intune, you're already set. Move on to 1-3 below.

In relatively recently created tenants, the MDM authority is almost always already set to Intune.

Note that you also need an Intune license assigned in order to set the MDM authority.

1-3. Get the Apple MDM push certificate (APNs certificate)

The APNs certificate is a hard requirement for managing iOS/iPadOS/macOS with Intune. It's what Intune uses to deliver instructions to devices through Apple's push notification service. Without it you can't do ADE — you can't even do regular enrollment.

You'll be going back and forth between the Intune side and the Apple side, so let's follow it step by step.

① Open the settings page in Intune and give consent

Sign in to the Microsoft Intune admin center
Go to Devices
Select Device onboarding → Enrollment
Select the Apple tab
Select Apple MDM Push Certificate
Select I agree to give Microsoft permission to send data to Apple

② Download the CSR (certificate signing request)

Select Download your CSR and save the request file locally. You upload this file on the Apple side to have the certificate issued.

③ Create the certificate in the Apple Push Certificates Portal

Select Create your MDM push Certificate to go to the Apple Push Certificates Portal
Sign in with your organization's Apple ID
Select Create a Certificate
Read and accept the terms and conditions
Select Choose File and choose the CSR file you downloaded in ②
Select Upload
On the confirmation page, select Download and save the certificate file (.pem)

Do not get the choice of Apple ID here wrong.

The certificate is associated with the Apple ID used to create it. You need the same Apple ID to renew it, so if you create it with an individual admin's personal Apple ID, you lose the ability to renew the moment that person changes roles or leaves.

Microsoft's own guidance recommends using a company email address and making sure the mailbox is monitored by more than one person, such as through a distribution list. Avoid using a personal Apple ID.

④ Enter the Apple ID in Intune

Return to the Intune admin center and enter the Apple ID you used to create the certificate. This is needed so you get reminded when the certificate needs to be renewed.

⑤ Upload the certificate

Select the Folder icon
Select the .pem file you downloaded in ③
Select Upload

You're done once the status shows as active.

[Important] The APNs certificate must be renewed every year

The Apple MDM push certificate is valid for 365 days. You must renew it annually to keep managing iOS/iPadOS/macOS.

If it expires, you can still renew it within the 30-day grace period
You must renew it with the same Apple account you used to create it
The renewal steps are nearly identical to creating it (download the CSR → select Renew on the relevant certificate in the Apple portal → upload the new CSR → upload the downloaded certificate to Intune)
When you renew in the Apple portal, entering a unique note about the certificate makes it easier to identify if you have more than one

💡 How to figure out which certificate is which

Each certificate has a unique UID. In the certificate details, look for the subject ID, which shows the GUID portion of the UID.

You can also check from an enrolled iOS/iPadOS device.
Go to Settings → General → Device Management → Management Profile → More Details → Management Profile, and match the GUID contained in the Topic value against the certificate in the Apple Push Certificates Portal.

1-4. Check licenses

If you enroll with user affinity, each user must have an Intune license assigned
If you enroll without user affinity (shared devices and so on), management is per device

That completes the prerequisites. Now we can finally move on to connecting with ABM.

[Step 2] Create the enrollment program token

There's a round trip here: issue the public key in Intune → upload it to ABM → issue the token in ABM → come back to Intune and upload it.

Don't close the Microsoft Intune admin center browser tab while you're doing this.
After you finish the work in ABM, you need to come back to the same tab to upload the token. If you close it, you have to start over.

2-1. Download the public key in Intune

Intune admin center → Devices
Expand Device onboarding → Enrollment
Apple → Enrollment program tokens → Create
Select I agree to grant permission to Microsoft to send user and device information to Apple
Select Download your public key (a .pem file is saved)

2-2. Upload the public key to ABM and get the token

Leave the Intune tab open and open ABM in a separate tab.

In ABM, go to the device management services page ( https://business.apple.com/main/devices/managementservices )
Select Add
Select "Connect external device management" → "Continue"
Enter any service name, upload the public key (.pem) you downloaded in 2-1, and select "Next"
Select "Download Service Token" (a .p7m file is saved)

2-3. Upload the token to Intune

Go back to the Intune tab you left open.

For Apple ID, enter the Apple ID you used to create the token
For Apple token, specify the .p7m file you downloaded in 2-2
Select Next
Apply scope tags if needed (when you want to limit other admins from making changes)
Review + create → Create

That completes the connection between Intune and ABM.

[Step 3] Assign devices to the MDM server in ABM

On the ABM side, assign the devices you want to manage to the MDM server you created. Devices that aren't assigned never sync to Intune.
For how to assign them, see the following Apple documentation.
https://support.apple.com/en-us/guide/business/axmf500c0851/1/web/1

After assigning, run a sync on the Intune side and the device count is reflected under Devices on the enrollment program token.

[Step 4] Create the enrollment profile (enrollment policy)

This defines the settings applied to the device during initial setup.

Select the token you created in [Step 2] → Profiles
Create profile → iOS/iPadOS
Enter a name and description (users don't see these details) → Next

4-1. User affinity and authentication method

First, decide whether to tie the device to a user. The configuration branches from here.

Pattern A: Without user affinity (best when you just want to verify it works)

Setting	Value
User Affinity	Enroll without User Affinity

This is the configuration for use cases that aren't tied to a specific user, such as shared devices or in-store devices. Since it needs neither the Company Portal nor an Intune user license, it's also well suited to isolating and verifying just "is the ADE wiring correct?"

Pattern B: With user affinity (production configuration)

Setting	Value	Notes
User Affinity	Enroll with User Affinity	Use this for corporate-owned devices tied to an individual
Authentication method	Setup Assistant with modern authentication / Company Portal / Setup Assistant (legacy)	See below

How to choose the authentication method

Authentication method	Characteristics
Setup Assistant with modern authentication	Authentication completes inside Setup Assistant. Because it can complete the user association without the Company Portal app, it's the easiest one to try first
Company Portal	Authentication happens in the Company Portal app. The app has to be installed separately (see below)
Setup Assistant (legacy)	The traditional method

4-2. Management options

Setting	Value	Notes
Locked enrollment	Yes	Users can no longer remove the management profile. For corporate-owned devices, "Yes" as a rule
Sync with Computers	Allow all	Restrict according to your requirements

4-3. Device name template (optional)

By default, Apple names devices after the device type (iPad and so on). If you want a consistent naming convention, configure a template.

contoso-{{DEVICETYPE}}-{{SERIAL}}

What the device name looks like after enrollment: contoso-iPhone-XXXXXXXXXX

The device name template applies only to supervised devices.

4-4. Setup Assistant

Department: shown when users tap "About Configuration" while the device is activating
Department Phone: the contact shown when users tap the "Need Help" button
Showing / hiding the various setup screens: if you want enrollment to be as smooth as possible, setting them all to "Hide" is a good move

Review the settings and select "Create" to save.

[Step 5] Assign the profile to devices

Creating the profile isn't enough for it to apply. Assigning it to devices is required.

Go back to Enrollment program tokens and select the token from the list
Select Devices and check the devices you want to assign
Select Assign profile
Choose the enrollment profile you created → Assign

[Step 6] Create a dynamic group (an operational tip)

Since you'll want to target apps and policies only at devices enrolled through ADE, creating a dedicated dynamic device group makes ongoing operations much easier.

Groups → New group
Enter a group name and select Dynamic Device for the membership type
Set the following rule as the dynamic query

(device.enrollmentProfileName -eq "the name of the enrollment profile you created")

Setting	Value
Property	enrollmentProfileName
Operator	Equals
Value	The profile name you created in step 4

With this, devices enrolled with that profile automatically land in the group. From here on, you can target this group for app deployment and configuration profiles.

[Step 7] Set up an iPhone and verify the behavior

Once the Intune side is ready, verify it on a real device. Have a new or wiped iPhone on hand.

How to tell it succeeded

During initial setup, a screen showing "Enroll This iPhone" plus your company name is displayed
The lock screen shows "This iPhone is remotely managed"
The device appears under iOS/iPadOS devices in Intune

Once you've confirmed all of this, the ADE rollout is complete.

DEV Community