Ship Apple Devices Box-to-Production: Zero-Touch Enrollment with Intune and ABM

A remote user opens a box, powers on a brand-new Mac or iPhone, signs in, and the device is in production: policies applied, settings configured, apps installed, no VPN required. That is what Apple automated device enrollment with Microsoft Intune and Apple Business Manager delivers, and it works for both macOS and iOS. For an MSP managing a distributed workforce, it removes the manual imaging step entirely and keeps corporate data separated from personal data on the device, which checks a lot of compliance boxes.

Intune was traditionally behind a dedicated MDM like JAMF, but over the past few years Microsoft has added serious Apple configuration capability. Automated deployment is the strongest of those additions. The full configuration is walked through in the video on the original post.

What you need before enrolling#

Two things are non-negotiable: a Microsoft Intune subscription and an Apple Business Manager account.

Federation between ABM and Azure AD (opens in new tab) creates managed Apple IDs, which let users authenticate with their Azure AD credentials. This works in pure-cloud deployments and in hybrid environments with AD Connect.

You also need an MDM push certificate (opens in new tab) in the customer's account. Microsoft documents the full process here (opens in new tab).

The configuration, in two halves#

The setup splits across the two consoles you will work in.

In Microsoft Intune:

1. Add the MDM server (Intune).
2. Create the enrollment profile.
3. Create compliance policies.
4. Create configuration profiles.
5. Add managed applications.

In Apple Business Manager:

1. Set up Azure AD federation.
2. Add the MDM server.
3. Add reseller IDs.
4. Upload devices.
5. Set up the VPP account.
6. Add the Company Portal app.

Work through both lists and a device assigned to the customer's ABM account will enroll into Intune automatically the moment a user powers it on and signs in.