About this article

• Intended audience: IT and endpoint management admins who want to manage corporate-owned iPhones / iPads with Intune
• What you'll learn
  • The concrete steps for the prerequisites (MDM authority and the APNs certificate) you need before you can start with ADE
  • How to issue the enrollment program token that connects ABM and Intune
  • How to create an enrollment profile for Automated Device Enrollment (ADE)
  • What actually happens from the moment you power on an iPhone until it becomes managed
• Test environment: Microsoft Intune admin center / Apple Business Manager (as of September 2026)
• Assumptions: The devices are new, purchased through ABM, or have been wiped

With Automated Device Enrollment (ADE), a device enrolls in Intune automatically during the initial setup the first time it's powered on. No manual staging is required, and because the device becomes Supervised, you can apply stronger controls such as restricting app installation, automatically configuring Wi-Fi, and disabling features you don't need.

Why use ADE

When you hand out corporate-owned iPhone, you could set each one up by hand and have users enroll them from the Company Portal. But that approach has problems.

• Staging effort grows linearly with the number of devices
• Users can remove the management profile on their own
• The devices don't become supervised, so the range of what you can control is limited

ADE solves all of these at once. Once devices are linked to ABM, you can get to a state where you take them out of the box and hand them straight to the user.

Overall workflow

Getting the order wrong means rework, so let's take in the big picture first.

[Step 1] Prerequisites

If this is your first time building this out, this is where you can get stuck. Let's walk through it one operation at a time.

1-1. Set up the ABM account and register purchase information

If you don't have an ABM account at all, sign up at business.apple.com. You need a D-U-N-S Number (a company identifier), and because Apple reviews the request it can take anywhere from a few days to a few weeks. If you're planning for ADE, start here first.

Once you have the account, you need to link your devices to ABM. There are two main ways to do that.

If you go through a reseller, you need to register the reseller's customer number (purchase information) in ABM under Settings → Enrollment Information → Device Management Settings. If that isn't registered, the devices you purchase never flow into ABM.

If you add devices you already purchased to ABM later using Apple Configurator, the user gets a 30-day provisional period, and during that window they can release the device from management themselves. Devices procured through a reseller don't have this provisional period. If you want to manage corporate-owned devices properly, the rule of thumb is to assume ABM integration from the procurement stage.

1-2. Set the MDM authority to Intune

The MDM authority is the setting that declares which service manages the devices in this tenant. Until an IT admin sets the MDM authority, users can't enroll any devices at all.

First, check the current setting

1. Sign in to the Microsoft Intune admin center
2. Tenant administration → Tenant status
3. Open the Tenant details tab
4. Check the MDM authority entry

If it shows Microsoft Intune, you're already set. Move on to 1-3 below.

In relatively recently created tenants, the MDM authority is almost always already set to Intune.

Note that you also need an Intune license assigned in order to set the MDM authority.

1-3. Get the Apple MDM push certificate (APNs certificate)

The APNs certificate is a hard requirement for managing iOS/iPadOS/macOS with Intune. It's what Intune uses to deliver instructions to devices through Apple's push notification service. Without it you can't do ADE — you can't even do regular enrollment.

You'll be going back and forth between the Intune side and the Apple side, so let's follow it step by step.

① Open the settings page in Intune and give consent

1. Sign in to the Microsoft Intune admin center
2. Go to Devices
3. Select Device onboarding → Enrollment
4. Select the Apple tab
5. Select Apple MDM Push Certificate
6. Select I agree to give Microsoft permission to send data to Apple

② Download the CSR (certificate signing request)

Select Download your CSR and save the request file locally. You upload this file on the Apple side to have the certificate issued.

③ Create the certificate in the Apple Push Certificates Portal

1. Select Create your MDM push Certificate to go to the Apple Push Certificates Portal
2. Sign in with your organization's Apple ID
3. Select Create a Certificate
4. Read and accept the terms and conditions
5. Select Choose File and choose the CSR file you downloaded in ②
6. Select Upload
7. On the confirmation page, select Download and save the certificate file (.pem)

Do not get the choice of Apple ID here wrong.

The certificate is associated with the Apple ID used to create it. You need the same Apple ID to renew it, so if you create it with an individual admin's personal Apple ID, you lose the ability to renew the moment that person changes roles or leaves.

Microsoft's own guidance recommends using a company email address and making sure the mailbox is monitored by more than one person, such as through a distribution list. Avoid using a personal Apple ID.

④ Enter the Apple ID in Intune

Return to the Intune admin center and enter the Apple ID you used to create the certificate. This is needed so you get reminded when the certificate needs to be renewed.

⑤ Upload the certificate

1. Select the Folder icon
2. Select the .pem file you downloaded in ③
3. Select Upload

You're done once the status shows as active.

[Important] The APNs certificate must be renewed every year

The Apple MDM push certificate is valid for 365 days. You must renew it annually to keep managing iOS/iPadOS/macOS.

• If it expires, you can still renew it within the 30-day grace period
• You must renew it with the same Apple account you used to create it
• The renewal steps are nearly identical to creating it (download the CSR → select Renew on the relevant certificate in the Apple portal → upload the new CSR → upload the downloaded certificate to Intune)
• When you renew in the Apple portal, entering a unique note about the certificate makes it easier to identify if you have more than one

💡 How to figure out which certificate is which

Each certificate has a unique UID. In the certificate details, look for the subject ID, which shows the GUID portion of the UID.

You can also check from an enrolled iOS/iPadOS device.
Go to Settings → General → Device Management → Management Profile → More Details → Management Profile, and match the GUID contained in the Topic value against the certificate in the Apple Push Certificates Portal.

1-4. Check licenses

• If you enroll with user affinity, each user must have an Intune license assigned
• If you enroll without user affinity (shared devices and so on), management is per device

That completes the prerequisites. Now we can finally move on to connecting with ABM.

[Step 2] Create the enrollment program token

There's a round trip here: issue the public key in Intune → upload it to ABM → issue the token in ABM → come back to Intune and upload it.

Don't close the Microsoft Intune admin center browser tab while you're doing this.
After you finish the work in ABM, you need to come back to the same tab to upload the token. If you close it, you have to start over.

2-1. Download the public key in Intune

1. Intune admin center → Devices
2. Expand Device onboarding → Enrollment
3. Apple → Enrollment program tokens → Create
4. Select I agree to grant permission to Microsoft to send user and device information to Apple
5. Select Download your public key (a .pem file is saved)

2-2. Upload the public key to ABM and get the token

Leave the Intune tab open and open ABM in a separate tab.

1. In ABM, go to the device management services page ( https://business.apple.com/main/devices/managementservices )
2. Select Add
3. Select "Connect external device management" → "Continue"
4. Enter any service name, upload the public key (.pem) you downloaded in 2-1, and select "Next"
5. Select "Download Service Token" (a .p7m file is saved)

2-3. Upload the token to Intune

Go back to the Intune tab you left open.

1. For Apple ID, enter the Apple ID you used to create the token
2. For Apple token, specify the .p7m file you downloaded in 2-2
3. Select Next
4. Apply scope tags if needed (when you want to limit other admins from making changes)
5. Review + create → Create

That completes the connection between Intune and ABM.

[Step 3] Assign devices to the MDM server in ABM

On the ABM side, assign the devices you want to manage to the MDM server you created. Devices that aren't assigned never sync to Intune.
For how to assign them, see the following Apple documentation.
https://support.apple.com/en-us/guide/business/axmf500c0851/1/web/1

After assigning, run a sync on the Intune side and the device count is reflected under Devices on the enrollment program token.

[Step 4] Create the enrollment profile (enrollment policy)

This defines the settings applied to the device during initial setup.

1. Select the token you created in [Step 2] → Profiles
2. Create profile → iOS/iPadOS
3. Enter a name and description (users don't see these details) → Next

4-1. User affinity and authentication method

First, decide whether to tie the device to a user. The configuration branches from here.

Pattern A: Without user affinity (best when you just want to verify it works)

This is the configuration for use cases that aren't tied to a specific user, such as shared devices or in-store devices. Since it needs neither the Company Portal nor an Intune user license, it's also well suited to isolating and verifying just "is the ADE wiring correct?"

Pattern B: With user affinity (production configuration)

How to choose the authentication method

4-2. Management options

4-3. Device name template (optional)

By default, Apple names devices after the device type (iPad and so on). If you want a consistent naming convention, configure a template.

contoso-{{DEVICETYPE}}-{{SERIAL}}

What the device name looks like after enrollment: contoso-iPhone-XXXXXXXXXX

The device name template applies only to supervised devices.

4-4. Setup Assistant

• Department: shown when users tap "About Configuration" while the device is activating
• Department Phone: the contact shown when users tap the "Need Help" button
• Showing / hiding the various setup screens: if you want enrollment to be as smooth as possible, setting them all to "Hide" is a good move

Review the settings and select "Create" to save.

[Step 5] Assign the profile to devices

Creating the profile isn't enough for it to apply. Assigning it to devices is required.

1. Go back to Enrollment program tokens and select the token from the list
2. Select Devices and check the devices you want to assign
3. Select Assign profile
4. Choose the enrollment profile you created → Assign

[Step 6] Create a dynamic group (an operational tip)

Since you'll want to target apps and policies only at devices enrolled through ADE, creating a dedicated dynamic device group makes ongoing operations much easier.

1. Groups → New group
2. Enter a group name and select Dynamic Device for the membership type
3. Set the following rule as the dynamic query

(device.enrollmentProfileName -eq "the name of the enrollment profile you created")

With this, devices enrolled with that profile automatically land in the group. From here on, you can target this group for app deployment and configuration profiles.

[Step 7] Set up an iPhone and verify the behavior

Once the Intune side is ready, verify it on a real device. Have a new or wiped iPhone on hand.

How to tell it succeeded

• During initial setup, a screen showing "Enroll This iPhone" plus your company name is displayed
• The lock screen shows "This iPhone is remotely managed"
• The device appears under iOS/iPadOS devices in Intune

Once you've confirmed all of this, the ADE rollout is complete.

References

• Tutorial - Use Apple Business to enroll iOS/iPadOS devices in Intune - Microsoft Learn
• Get an Apple MDM Push certificate for Intune - Microsoft Learn
• Set the mobile device management authority - Microsoft Learn
• How to manage iOS devices by integrating Microsoft Intune with Apple Business Manager (ABM) - yjk365 (Japanese)