By Marc Nahum Sr Program Manager | Microsoft Endpoint Manager - Intune
Any enterprise or education institution that owns iOS/iPadOS devices can take advantage of automatic enrollment to Intune, as well as the extra features and controls that Apple’s Automated Device Enrollment (ADE) - previously known as Device Enrollment Program (DEP) – provides.
When ADE was first introduced, only Apple resellers or telecom carriers were able to add devices to Apple Business Manager or Apple School Manager. However, since the release of iOS 11, Apple supports the ability to manually add iOS and iPadOS devices yourself with the Apple Configurator 2.5 (AC2) tool. This means that, regardless of where the device was purchased, you can benefit from using ABM or ASM.
This article will help IT pros and mobile device administrators understand the steps required to manually add iOS and iPadOS devices to Apple Business Manager or Apple School Manager, as well as enrolling them into the Intune service.
Note: Manually adding devices (new or old) is not supported for macOS. For these devices, the reseller must carry this out for you, no matter when they have been purchased.
Warning: The devices will be fully wiped during the process. This happens because Apple treats a device being in ABM as proof of ownership.
Before proceeding, there are some configurations, constraints, and restrictions to understand, after which the process is straightforward.
There are a lot of options in AC2, so we will cover only the steps necessary to import the devices to ABM or ASM and assign them to the Microsoft Endpoint Manager MDM server. You can find full documentation from Apple here.
During the onboarding process, the device will need to connect to the internet. Therefore, it’s mandatory to have a Wi-Fi profile, which will allow it to automatically connect. The profile can be as complex as is required, but must not prompt the user for any action, or require a certificate to authenticate.
Note: This step is not mandatory, but it will create a trusted configuration and avoid any doubts that the URL is the proper one.
Important: The device will be fully wiped during this process.
If this is the first time you are connecting the device to the Mac, a pop up will appear asking for the Mac to be trusted, select Trust. Now the device is ready to be prepared.
Do not select:
Name: “Microsoft Endpoint Management”
URL: The one created in the step “Generate MDM Server URL for MEM
Example URL: https://appleconfigurator2.manage.microsoft.com/MDMServiceConfig?id=<Intune_tenant_ID>&AADTenantId=<AAD_tenant_ID>
If you did not set up the organization name, you will need to do that next. That Organization name will be displayed on the device.
The iOS setup assistant steps selected on the next screen are not important as they will be defined in Intune later.
Next, select the Network Profile previously created and, when prompted, enter your local password to initiate the process.
At this point, the device will be erased. When the device has restarted, steps in AC2 are complete.
You now need to assign it to Intune in the ABM/ASM console. By default, it’s assigned to an MDM server configuration named “Apple Configurator 2”:
|You can reassign 1 device by selecting that device and choosing:
Edit Device Management > Assign to server and select the proper Intune one.
|You can reassign multiple devices by doing the same with filters and choose “Edit Device Management” > “Apple Configurator 2”|
Once the device is assigned it will need to be synchronized. This occurs automatically every 12 hours or you can manually trigger the synchronization in Microsoft Endpoint Manager admin center:
Note: You can manually synchronize the devices from ABM/ASM to Intune at a maximum frequency of every 15 minutes.
At this point you should have successfully added your ADE device to Intune.
Let us know if you have any questions by replying to this post or reaching out to @IntuneSuppTeam on Twitter.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.