Microsoft Intune MDM Training | iOS User Enrollment

[@silerauk366]

Hello Nick, First of all would like to really appreciated for the effort and time taken for adding such informative videos. Kudos !!!!!!

[@t-minus365]

Appreciate it!

[@Walry95]

Great video! And thank you for the complete demo at the end!

[@t-minus365]

Glad you liked it!

[@koustavchakraborty8280]

In Enrollment type you selected User Enrollment at 10:17 but when you present your mobile for enrolling the device you are getting two option which is "Determined Based on User choice" so my question is like if the both enrollment type option is same like "User Enrollment" & "Determined based on user choice" ! please clarify that point.

[@nithyanadhamsingaravadivel8547]

Hi Nick, First of all, many thanks for the detailed video on the company portal - User enrollment for the IOS personal devices. I have few questions, Please clarify and your answers would be really helpful for me. In this video @13:22 is the stage where the managed apple id is created automatically for the user in Apple Business Manager after the user has signed with his Azure AD credentials during the enrollment process ? Also in this type of enrollment, i cannot use the store apps to add the applications to Microsoft Intune portal for app deployment ? is this true ? In this method of enrollment, Is apple volume purchase program is the only option for app deployment from Microsoft Intune to IOS devices ? If we can also use the VPP for this method of enrollment, Any video created from your end for using the Apple volume purchase program configuration in ABM and Microsoft Intune ? Say for example, if the user does have the few apps already installed in his mobile but those apps are supposed to pushed and managed from Microsoft Intune , At this stage, Do we need to ask the user to remove the apps from his mobile device before they enroll the devices to Microsoft Intune ?

[@Schnitzer325ci]

Excellent upload as always. Thanks

[@t-minus365]

Appreciate the support!

[@bosjunnesson4188]

Hi! thanks for the video! How would you setup the device so that it can be shared on a daily basis by frontline workers. Example: In the morning someone arrives at their job, takes the company owned iOS device and has to login with their corporate account so that the device is theirs for that period of time. Later that day when that persons shift is over, they logout, stored data is removed and when the next worker shows up, he can fill in his/her credentials and the device is theirs for the next period. Hope you can answer it!

[@ydsvaradero]

Does the device show in ABM when you do user or device enrollment? I would say it will not. Interesting: 3:59

[@lombahdo21e]

Thanks for his video it was very helpful... One issue I am having is, after I created the enrollment profile, is that when I try to enroll the IOS device I never get to the Access Wizard to show up.. It just brings me the Company Portal and shows me my enrolled devices (my ios device never shows as enrolled if I look using my laptop). Any tips? We have an E5 license

[@roycastillo1602]

Great video. Is it necessary for me to turn on Federated authentication? I asked because I probably have a ton of users that created their personal Apple ID using their corporate email which will create conflict when I enable Federated auth in ABM. That will also affect my Apple MDM push certificate since the Apple ID used is not a managed apple ID. Any thoughts on how do I go about this scenario? Also, how do you handle corporate iOS devices that is already out in the wild for a while and we need to manage it with MS Intune? Can I still use company portal and use device enrollment? Thank you so much for your help.

[@t-minus365]

Hey Roy, Federation is not a hard requirement. You could still manage the environment without managed apple IDs, it just makes things easier from a compliance and BYOD standpoint to separate corporate vs personal data. The push cert can still be associated to you intune environment for them even without federation. Existing corporate devices can still download and enroll using company portal yes! That would probably be a good first step in this project.

[@dusza574]

Hi T-Minus! Great videos. Can you give me some advice on how to lock down company iOS devices so that user will be forced to use Exchange Contacts exclusively? Or maybe even forced to use iOS contacts via a managed Apple ID?

[@t-minus365]

You would want to set up some device restriction profiles docs.microsoft.com/en-us/mem/intune/configuration/device-restrictions-ios

[@dizzanv]

Solid video man!!

[@t-minus365]

Thanks!

[@unknown-lh9qg]

Explained very well☺️.I have a question here , you mentioned we can create a conditional access Policy to redirect users to install company portal.Can you pls guide on this .. !!

[@t-minus365]

Hey Minu, you would want to create a conditional access policy for approved apps docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-conditional-access

[@riseabovethought]

@@t-minus365 Wouldn't that rather be a conditional access policy that requires a compliant device? That way it sees the device is trying to access corporate data but needs to be enrolled and would present you with the enroll screen. That link should be used as well though to force use of approved apps.

[@kennethli8]

Great Video!

[@t-minus365]

Thanks!

[@richie9868]

Great video. Can you please explain or record how you would deploy or create a profile for devices that are ADE for Kiosk use? Thank you

[@t-minus365]

Thanks Richie! I can look into that!

[@thaidoy6240]

Hi teacher. Could you make videos about how enrollment app on andriod device? How to set enrollment APK file to automatically install on the andriod device by sign Company portal app?

[@emsteam5710]

Hi Nick, This video is old but still gold !! I tried this - Everything works except one small issue. I could still see the factory reset option not greyed out in company portal app. In Intune portal, the device was seen as intune managed , personal device - their as well, the wipe option was preset and on choosing it the full device got wiped. Any pointers to disable full wipe or factory reset ?

[@sohandy79]

Trying to connect a using a gmail account as apple id. When i go to install the cert its showing my company email account and doesnt allow me to modify it to change it to the ABM account i created. It doesnt allow me to use my actual company email address keep getting an error. Ive tried using the AMB account on a spare phone as appeid but doesnt allow that as it says its an ABM account. What am i missing?

[@pofrani]

Hi - thanks for this... but do you have a video on how to enroll ios fully managed corporate device? I'm trying to federate my business manager account with Azure but I keep getting a 403 error on apple's website :(

[@cobuildvault]

Great video and I have a question. After user enrollment, I was wondering whether iOS have one another exclusive workspace which stores all the corporate in-house apps such as Android Enterprise's work profile?

[@t-minus365]

The enrollment to the company portal app would include all of the workplace applications that you can manage. These can either be available to download or you can make them required and force the download to the device automatically without user intervention

[@mikecleverlab7776]

Hi T-Minus, great content you upload. I have a couple questions regarding the user enrollment. Currently i'm about to deploy intune in a large ios byod devices and I would want to know what will be the best approach for this kind of situations. As fas as I know, I need to set up an ABM environement to federate the O365 accounts and in order to create a professional apple ID for each of the users isn't it? and how do I do a user enrollment with iPhones? Do I need to mandatory download the company portal or just by adding the professional Apple Id the apps that i current have in the phone became corpoate and personal at the same time? Thank you very much!

[@t-minus365]

Hey Mike, i cover most of your questions in the video here but federation is not a hard requirement. It does allow you to perform the user enrollment method where company data is separate from personal on BYOD devices. If you turn on federation, it is not going to auto enroll the users into MDM management. They would still need to either download and sign into the company portal app to enroll or you could turn on app protection policies which then requires the users to go download the company portal app to access corporate data on the device. When they do this the company portal redirects them to add a new managed apple ID as shown in this video. Let me know if this helps.

[@mikecleverlab7776]

@@t-minus365 Thank you very much. I appreciate your answer and your well made videos. I think that we'll approach to the user enrollment for the byod. I thought at the beginning that we must wipe the terminal in order to do the user enrollment but that didn't has any sense.

[@decemiesabaiton2374]

Hi Nick, we have this one user unable to see emails on his IOS mail app. He already installed and login intune company portal. Our iOS Enrollment type profiles have been always blank/empty (never been configured). The rest of the users are working fine.

[@garycelia9135]

Hi, is it possible to use personal apple id's with device that is supervised y ABM please?

[@chitextra271]

Hello, it doesn't look like federation is activated at 11:03. I am in the same situation and have some managed apple id created (including mine). However, when trying to enroll my iphone, I don't have the choice between corporate device or I own this device. Is this federation only meant for BYOD or even for corporate devices in DEP? Thanks

[@t-minus365]

Hey so this choice comes up depending on what you set as the enrollment type when you create the enrollment profile in Intune. @9:54 Managed Apple IDs can be for both BYOD and DEP

[@chitextra271]

@@t-minus365 I've just discovered that federation is not active for our custom domain, just for *.appleid.com domain (that we don't use). But for DEP I already had created an enrollment profile in the Enrollement program tokens. What should I do with that? Remove and just use the Enrollment types method? Please note that the devices are corporate-owned, so should I set a Device enrollment profile? Or is it better to go for the choice? Thanks!

[@t-minus365]

@@chitextra271 so i made a video for setting up federation with managed apple IDs. kzbin.info/www/bejne/aXnHfXmge8idp68 for DEP enrollment profiles, those can be used for new devices or devices you are wiping and reusing. These devices are always considered to be corporate. When the user boots the new device, they will be prompted to set up a new managed apple ID if the federation is set up. User Enrollment profles are meant more for byod devices or corporate devices that will also be used for personal use as well.

[@chitextra271]

@@t-minus365 Hi, thank you, will watch the video. That's my situation indeed: I have like 50 corporate devices on DEP (and some other in Apple Configurator) that by policy can be used as personal devices as well, but I'm a bit lost on the configuration profiles interaction: so far, when those devices are reset they contact Intune and, just after setting up Wifi, a remote management profile is installed and it comes from DEP enrollment type: the profile installs and just after Company Portal app is pushed via VPP token. What would happen at this point if I'd be to setup another user or "on user choice" profile in Enrollment types and I logon to the Company Portal app? Will it work? Or should I unassign the profile in DEP enrollment first? And, if so, what would happen to the devices that are already enrolled and in production? Thanks for all clarifications!!

[@t-minus365]

@@chitextra271 great questions. So ive never fully tested that out so i cannot say for certainty but my guess is that you would not have to unassign the DEP profile. You would just be able to set up the user enrollment profile and it would ask you if the device is corporate or personal. In either case, it would create the managed appleID still as long as the federation is in place. For existing, enrolled devices, the only option i know of to create the managed appleID is to unenroll and reenroll the device. Either that or wait till its wiped again .

[@TheRevRobWilson]

Hi Nick, I know this is an old video, but I have a question. Our company has intune and they have locked the policies down so much that it has been asked to to start from scratch to build a better and more user friendly solution. Let me know if you have some time to chat offline....

[@lucderheld2606]

How about having an managed intune app multiple times. Like Whatsapp with company account and whatsapp with private account? I think Android Enterprise does this with Company Profiles. Is this possible in iOS too?

[@t-minus365]

Yes this is possible. With the user enrollment method you get the separation of data at the app level like i show in this video

[@mikebowman6899]

Hi Nick, I've watched a couple of your videos where you reference a video you made about "enrollment methods for iOS devices between BYOD and corporate owned". Could you provide me with a link to that video? Thanks!! I do find your videos very helpful & concise.

[@t-minus365]

thanks! Here you go! kzbin.info/www/bejne/faDKn2uBoNp1nqM

[@RizDez]

Hey Nick, Is there a way to set up a device to have separated apps so users can distinguish from personal apps to work apps? Android has a solution by creating a work profile with a separated home screen but I see no options with iOS.

[@Knivez_]

Heya, how do I get the company portal installed. Once I sign in with a federated account, I cannot install any apps from the app store. Thanks

[@Knivez_]

I'm really having trouble getting Company portal installed with a federated account. Hope you can help. Thanks

[@utilisateurpublicgoogle7953]

Thank you very much for this great video !!! I applied it in my company. I have a question about administrator's accounts defined in ABM prior to the federation with Intune. What will be the impact if an account is set up in ABM with administrator's role but without an account created within Intune after we activate the Federation ?

[@utilisateurpublicgoogle7953]

In fact the question is where will the administrator or account having a role authenticate ?

[@t-minus365]

If they do not have a user in Azure AD then they will still authenticate with their Apple credentials. It will not proxy the session through Azure AD

[@utilisateurpublicgoogle7953]

@@t-minus365 Many thanks for your reply. I am very grateful for your feedback and thank you very much to publish such a content of quality. I am very respectful for this, and wish you the best.

[@KyleMcNally]

I've got my users enrollment set up, I did not set up federation as I haven't created a ABM account yet. I see the device in the Endpoint manager. My problem is that the Apps that I add, are not being pushed down to the iOS devices, whether they are required or not. Any ideas?

[@t-minus365]

Hey Kyle, what are you seeing when looking at the user or device state for the app? is it showing a failed or pending message?

[@KyleMcNally]

@@t-minus365 just shows pending, I've started the process of getting into apple business manager so I can hook up federation. Other sources have said that could be the problem. Thanks for the reply!

[@t-minus365]

@@KyleMcNally What is the app? Is a apple store application or custom?

[@KyleMcNally]

@@t-minus365 just a normal app store app

[@miguelmojica5897]

Is it possible at all to do user enrollment *without* ABM (no AAD federation or manual Management Apple ID from ABM)?

[@t-minus365]

Yes thats not a hard requirement. Users could still be enrolled via the company portal app

[@miguelmojica5897]

@@t-minus365 thank you for the quick reply. I've been testing User Enrollment and can't get it to work. When I try to install the management profile downloaded, it asks me to sign in with my managed apple id when I click Enroll my iPhone. I can do device enrollment without issues if I add the corporate device identifier ahead of time, and I can do MAM as well. However, BYOD MDM doesn't seem to be working.

[@distantyahoo]

managed apple id is required after iOS 13.

[@catsvideos6045]

Can we deploy without federated authentication - what are the practical issues? (Our UPN's aren't the same as our email addresses so this option won't be easy for us)

[@t-minus365]

Yes, federated auth gives your more protection from a DLP standpoint when a user leaves, giving you the ability to separate the data at the app level but its not a hard requirement,

[@caspianjvc]

Yes this requirement really sucks. Don't understand why they are not just using the UPN. We have over 1k users that don't have a UPN and email address that match. Has anyone tried it? What happens?

[@ronald0122]

Great content

[@NGranero]

Hi! Amazing video! What emulator are using for test? Can you recommend an iOS emulator for test Intune in W10?

[@t-minus365]

I am just using a test iphone. I feel its best here to really see end user experience

[@Real4D33L]

Does this mean that you can have two instances of Microsoft apps? One for personal and one for corporate?

[@t-minus365]

Its still one app but the data is siloed between corporate and personal, yes

[@Real4D33L]

@@t-minus365 MAM policies can achieve the same thing without enrollment. I still don't see much benefit to choosing this method for BYOD.

[@abusaleh8713]

Hey Nick, thanks for your videos - its so helpful! I have a question about Federated AppleID. We have around 150/300 users that are currently using AppleID with company email (not federated). If I enable Federation through Apple Business Manager, will it kick out the existing users? The reason I ask is because our executive team are from the list of the users and I do not want to do something that causes them to be kicked out. Thanks in advance!

[@t-minus365]

It will kick them out and give them 60 days to change their Apple ID. Hope Apple will provide a better solution to this soon.

[@abusaleh8713]

@@t-minus365 Thanks Nick!

[@ricklucas6216]

What free tool do you recommend to display iOS output to a computer?

[@t-minus365]

Hey Rick, what do you mean by iOS output?

[@ricklucas6216]

T-Minus 365 I would like to show clients the iOS interface or record the iOS interface like you are doing in this video.

[@davidstanley5161]

Hello Nick, I am not sure if you still monitor this but if you do I'll pay you to help me learn this Intune enrollment information. I have a phone that belongs to the company in LA. I am in Atlanta. I need to remotely wipe the phone, and enroll in in Intune and load the corporate apps, Outlook etc and configure without having to fly there and or have the new user to do anything but enter their email address and password.

[@rayebajo]

it is possible to setup Intune for IOS without APPLE BUSINESS MANAGER?, out setup is User Owned Device with Company profile.

[@t-minus365]

Yes, thats totally possible. BYOD is fully supported

[@webcomment8895]

Why did it still prompt the user asking who owns the device if you already selected user enrollment in the portal?

[@t-minus365]

Hey for this one i apologize i think this was just a mix up of what i populated and then coming back later to record i used a different profile that allow the user to choose. Choosing the user enrollment will enroll as personal

[@riazjon]

If I open VPN Location will change from company portal?

[@Schnitzer325ci]

Not initially if the user is not enrolled, but once authenticated you can run VPN by app if need be.

[@wadep]

How is a user supposed to download the Intune company portal app if they sign in on the device with a Managed Apple ID? Managed Apple IDs do not have the ability to download apps. This is a company-owned device.

[@CarstenNielsen1971]

How do i setup an automatic enrollment, no user interaction?

[@t-minus365]

I would check out a couple of my other videos on this: Enrolling iOS Devices: kzbin.info/www/bejne/faDKn2uBoNp1nqM Automated Device Enrollment: kzbin.info/www/bejne/gJCaoWlnerNna9k

[@williambonomo]

Getting User name not recognized on Comp Portal app, anyone else got this?

[@Schnitzer325ci]

Did you fix?