Prepare infrastructure for devices · Topic 4 of 7
Apple and Android Enrollment Methods
MD-102 mobile enrollment: personal and corporate enrollment for macOS, iOS and iPadOS, Android Enterprise modes, Apple Business Manager, Knox and zero touch.
- 5 min
- Apple needs an APNs certificate. Corporate Apple enrollment through ADE needs an Apple Business Manager token.
- Android Enterprise needs a managed Google Play connection. DA is deprecated.
- User enrollment is personal with limited control. ADE is corporate and supports supervision.
What it is
Each mobile platform offers several enrollment methods, and the right one depends on who owns the device, how much control you need and whether you want the user to touch the device. Apple devices use user enrollment, device enrollment and automated device enrollment. Android devices use Android Enterprise modes: work profile, fully managed, dedicated and corporate owned work profile. Each platform also has a bulk method for corporate devices.
How it works
Prerequisites
| Platform | Needed before enrolling |
|---|---|
| Apple | An Apple MDM push certificate (APNs) in Intune, renewed every year with the same Apple ID. For corporate devices, an Apple Business Manager (or Apple School Manager) enrollment program token |
| Android Enterprise | A connection between Intune and a managed Google Play account |
Apple enrollment
| Method | Ownership | What it gives |
|---|---|---|
| Apple User Enrollment (iOS, iPadOS) | Personal | Separates managed data and apps on their own volume. Very limited control, no full device wipe |
| Apple Device Enrollment (iOS, iPadOS) | Personal or corporate | More control than user enrollment, started in the Company Portal |
| Automated device enrollment (ADE) through Apple Business Manager | Corporate | New or wiped devices enroll automatically from Setup Assistant, can be supervised, with the most control |
| Apple Configurator | Corporate | Manual enrollment through a Mac with a cable, by Setup Assistant or direct enrollment |
| macOS BYOD | Personal | User signs in to the Company Portal on the Mac |
Supervised mode unlocks controls that unsupervised devices lack, such as app restrictions and silent app install. ADE applies your organization's settings from Apple Business Manager and requires a factory reset first if the device was already set up. With ADE, you can use enrollment time grouping to place devices in a group at enrollment and can lock enrollment so users cannot remove the management profile.
Android Enterprise enrollment
| Mode | Ownership | Use |
|---|---|---|
| Personally owned work profile | Personal | A separate work profile, installed through Company Portal. Only work data is managed |
| Corporate owned work profile (COPE) | Corporate | Corporate device with a work profile that can also be used personally |
| Fully managed | Corporate | Work only device with one user and full control |
| Dedicated | Corporate | Kiosk or single use devices with limited apps and no user |
| AOSP | Corporate | Devices without Google Mobile Services, either userless or user associated |
Android device administrator (DA) is deprecated and no longer available for devices that have Google Mobile Services, so use Android Enterprise.
Corporate Android devices enroll with a QR code, a token typed at setup, NFC, or zero touch. Two bulk programs exist.
- Google zero touch enrollment: devices bought from a participating reseller provision and enroll as fully managed as soon as the user turns them on. Best for bulk and remote workers.
- Samsung Knox Mobile Enrollment (KME): Samsung's equivalent for Samsung devices, using a Knox portal profile.
Corporate devices that were set up already need a factory reset before enrolling in Intune, except the personally owned work profile and device administrator, and Apple user enrollment.
Enrollment profiles and restrictions
Android corporate enrollment uses enrollment profiles (tokens) that you create for each mode, and their tokens expire. Platform restrictions can block personal Android devices, block device administrator, or limit manufacturers and OS versions. For Apple, restrictions can block personal iOS devices.
Troubleshooting enrollment failures
Start with Devices, Monitor, Enrollment failures, which lists the failure reason, OS and method. Common causes:
| Symptom | Likely cause |
|---|---|
| Android Enterprise enrollment is unavailable | The managed Google Play connection is missing |
| Apple enrollment fails or devices do not appear | The APNs certificate is expired, or the Apple token expired |
| Device is blocked | An enrollment restriction applies, or the device limit is reached |
| User cannot sign in or is not licensed | The user has no Intune license, or is not in the MDM user scope |
| Corporate enrollment fails on a device already in use | The device needs a factory reset first |
| Enrollment token rejected | The Android token expired |
A worked scenario
A retailer buys 400 iPads and 300 Android handhelds. The iPads come from Apple Business Manager, so Intune uses automated device enrollment with supervised mode and an enrollment time group. The handhelds come from a reseller registered with Google, so they provision as fully managed through zero touch. Sales staff who want email on their own phones use Apple user enrollment and the Android work profile. When iPads stop appearing, the admin finds that the APNs certificate expired and renews it.
What to remember for the exam
- Apple needs an APNs certificate. Corporate Apple enrollment through ADE needs an Apple Business Manager token.
- Android Enterprise needs a managed Google Play connection. DA is deprecated.
- User enrollment is personal with limited control. ADE is corporate and supports supervision.
- Zero touch and Knox Mobile Enrollment are bulk programs for corporate Android devices.
- Fully managed is for corporate work only devices. Dedicated is for kiosks. Work profile is for BYOD.
Look for ownership first. Personal points to user enrollment or work profile. Corporate points to ADE, fully managed or dedicated.
How the exam asks about this
- "Employees use personal iPhones, and only work data must be managed." Apple User Enrollment.
- "Company buys iPads from Apple and wants no touch setup." Automated device enrollment.
- "Reseller supplies Android phones that must self enroll as fully managed." Zero touch enrollment.
- "Android Enterprise options are missing in Intune." Connect managed Google Play.
Common mistakes
Letting the APNs certificate lapse. All Apple management stops.
Using device administrator. It is deprecated.
Enrolling used corporate devices without a reset.
Choosing fully managed for BYOD. It gives the company control of the whole device.
Check yourself
Which certificate does Intune need before managing Apple devices?
An Apple MDM push certificate (APNs).
Which Android method provisions fully managed devices straight from the reseller?
Google zero touch enrollment.
Which Android mode suits kiosks?
Dedicated.
Topic 4 of 7 in Prepare infrastructure for devices
Test yourself on Prepare infrastructure for devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.