Forum Discussion
Intune for iOS DEP devices with MFA
Hi Aaron
We have the exact same problem at the moment. I have spoken with engineers at Microsoft who have said they are fully aware of the issues with DEP and MFA and are working on resolving this.
Apple can't/won't support MFA during the DEP portion of Setup Assistant on the device, so Microsoft are having to get inventive to essentially work around this limitation while still keeping the ease and flexibility of a DEP setup and not compromise security.
Stay posted to the What's New. I've heard from others that something may be coming within the next month or so to finally resolve this.
Thanks
D
Hello Daniel,
I am also having a problem registrering DEP devices in intune icm MFA.
After reading your comment I have directly browsed to my conditional access policy which is responsible for activating the MFA option.
In the application selection fild/Exclusions i can Exclude Intune Enrolment (screenshot attached).
Somehow I am can not get that not working at this moment.
The workaround in my case at this moment is disabling MFA, registrering and the enabling MFA.
keep posting if you got news from MS.
Regards,
Wahé
Hi Wahe
Within the DEP profile, you need to select Enrol with User Affinity, but then enable the option to Authenticate with Company Portal Instead.
This will stop Apple from asking for the user's details during Setup Assistant. When the user then signs into Company Portal, it will then assign the device to the user.
See step 5 here: https://docs.microsoft.com/en-us/intune/device-enrollment-program-enroll-ios#create-an-apple-enrollment-profile
You can then automatically install the Intune Company Portal on the device for the user using a VPP token, and even force the app to run in kiosk mode until registered. This is shown in steps 6 and 7.
Daniel Hudson but can they then use the device before logging in? meaning can they text and make phone calls? or will the phone brick if they don't log into the company portal?
