Forum Discussion
IOS Enrollment Policys - User affinity with modern auth, does not work with Company Portal VPP
IOS Enrollment Policys - User affinity with modern auth, does not work with Company Portal VPP
I am trying to test the newer iOS Enrollment Policies using User Affinity with Modern Authentication instead of the older Enrollment Profiles.
One thing I've noticed is that the "Install Company Portal with VPP" setting exists in Enrollment Profiles, but I don't see an equivalent setting in the new Enrollment Policies.
My test Policy configuration is using:
- User Affinity with Modern Authentication
- Company Portal deployed as a VPP app
I tested deploying Company Portal as a required VPP app, and it installs successfully. However, when I launch Company Portal and sign in with my Entra ID credentials, it immediately prompts me to set up company access and download a management profile.
This doesn't seem correct because the device was already enrolled through ADE. If I select Postpone, Company Portal reports that I can't access company resources, and when I check further, it states that the device must be managed before apps can be installed.
this has to be a bug or something right? the microsoft docs on this are very confusing or missing details.
I also noticed that the device initially appears in Intune/entra as "iPad". After some time, the name eventually updates in entra and intune, However, within the Company Portal app, I end up seeing two devices:
- "iPad" (This is the Ipad that you're currently using)
- "ipad123-testing" ( this is the proper name and matches intune / entra)
Under Settings > General > VPN & Device Management, I can see the correct Intune management profile installed. Sync and restart actions from Company Portal also work successfully.
It appears that Company Portal is not associating itself with the existing ADE enrollment record. Instead, it seems to be attempting a user-driven enrollment workflow on a device that is already enrolled and managed through ADE.
Has anyone else seen this behavior when using the new iOS Enrollment Policies with User Affinity and Modern Authentication? its unusable in this state.
i saw a random blog about using an app config to set xml for the company portal app but that cant be right for such a vanilla use case? didnt need to do that with the old profiles.I am trying to test the newer iOS Enrollment Policies using User Affinity with Modern Authentication instead of the older Enrollment Profiles.
One thing I've noticed is that the "Install Company Portal with VPP" setting exists in Enrollment Profiles, but I don't see an equivalent setting in the new Enrollment Policies.
My test Policy configuration is using:
- User Affinity with Modern Authentication
- Company Portal deployed as a VPP app
I tested deploying Company Portal as a required VPP app, and it installs successfully. However, when I launch Company Portal and sign in with my Entra ID credentials, it immediately prompts me to set up company access and download a management profile.
This doesn't seem correct because the device was already enrolled through ADE. If I select Postpone, Company Portal reports that I can't access company resources, and when I check further, it states that the device must be managed before apps can be installed.
this has to be a bug or something right? the microsoft docs on this are very confusing or missing details.
I also noticed that the device initially appears in Intune/entra as "iPad". After some time, the name eventually updates in entra and intune, However, within the Company Portal app, I end up seeing two devices:
- "iPad" (This is the Ipad that you're currently using)
- "ipad123-testing" ( this is the proper name and matches intune / entra)
Under Settings > General > VPN & Device Management, I can see the correct Intune management profile installed. Sync and restart actions from Company Portal also work successfully.
It appears that Company Portal is not associating itself with the existing ADE enrollment record. Instead, it seems to be attempting a user-driven enrollment workflow on a device that is already enrolled and managed through ADE.
Has anyone else seen this behavior when using the new iOS Enrollment Policies with User Affinity and Modern Authentication? its unusable in this state.
i saw a random blog about using an app config to set xml for the company portal app but that cant be right for such a vanilla use case? didnt need to do that with the old profiles.
6 Replies
We'd been chasing this exact symptom for a few weeks, and I'm posting mainly so anyone searching for the "Invalid JWT token" error ends up here.
In the Entra ID audit logs (Register device / Add registered owner to device / Add registered users to device), every enrollment showed a Register device failure with ResultReason: Invalid JWT token. It was followed 11-35 seconds later by a successful retry under the same CorrelationId. Before the fix, that successful retry was what created the second, orphaned Entra device object instead of attaching to the Intune/ADE record. Company Portal then showed the device as not managed.
Deploying the app config XML that GT3 posted above fixed the duplicate
The Invalid JWT token failure still shows up on every enrollment, but the retry now attaches to the correct device record and Company Portal shows the device as managed. So if you're seeing Invalid JWT token failures followed by duplicate device objects on ADE devices using Enrollment Policies with user affinity + modern auth, this is likely your issue.
Hi GT3,
Yes, i observed same behavior and MS documentation is incorrect for new Enrollment polices,
the doc says during the enrollment it should automatically push app config for company portal which is clearly not the case.
could you help me what app config you applied for company portal?Company Portal is installed, but it starts a second enrollment because the VPP assignment lacks ADE configuration. Microsoft documents that Setup Assistant with modern authentication should install Company Portal through the enrollment policy’s Install Company Portal with VPP option; Intune then sends the app and configuration automatically. Edit the policy assigned to the ADE token, keep User affinity and Setup Assistant with modern authentication, select the Company Portal VPP token, and sync the token. Remove the separate assignment and custom Company Portal configuration for this test. Wipe the iPad and enroll it again, because ADE settings apply during activation. After Setup Assistant, sign in to Company Portal once to complete Entra registration and compliance. Do not add separate XML for this documented flow. If the VPP selector is absent from the new policy interface, capture the policy ID and open an Intune support case; that differs from Microsoft’s configuration guidance.
Was able to get a hold of Intune MVP contact and get it working.
Your post is incorrect based on testing and functioning setup now.
The XML is needed for policies to work.
The Microsoft documentation states "profiles" not polices.
its capsensitive which caused an issue on 1 letter.<dict>
<key>IntuneCompanyPortalEnrollmentAfterUDA</key>
<dict>
<key>IntuneDeviceId</key>
<string>{{deviceid}}</string>
<key>UserId</key>
<string>{{userid}}</string>
</dict>
</dict>
documentation reads Terrrible, its probably AI.https://learn.microsoft.com/en-us/intune/app-management/configuration/configure-managed-ios
Thank you! I have been banging my head against a wall for a solid day with this exact problem, and this is the fix I needed.
