Enrolling Windows & iOS Devices in Microsoft Intune: Best Practices for Beginners

In our previous guide on Microsoft Entra ID Conditional Access, we covered how to enforce security boundaries using user identity and signals. However, securing the identity is only half the battle—you also need full control over the endpoints accessing your corporate data.

Microsoft Intune is a cloud-based Endpoint Management (Unified Endpoint Management / UEM) solution that lets you manage devices, enforce compliance policies, and deploy software across Windows, iOS, Android, and macOS platforms.

In this guide, we will walk through the core enrollment methods and best practices for setting up Windows and iOS devices in Microsoft Intune.

Pre-Requisites for Intune Enrollment

Before onboarding devices, ensure the following foundational settings are configured in your tenant:

Intune Licenses: Assign Microsoft 365 E3/E5, Business Premium, or Intune Plan 1 licenses to target users.
Set MDM Authority: Ensure Microsoft Intune is set as the Mobile Device Management (MDM) authority in your tenant.
Configure Automatic Enrollment:
- Go to Microsoft Intune Admin Center (intune.microsoft.com).
- Navigate to Devices > Windows > Windows enrollment > Automatic Enrollment.
- Set MDM User Scope to All (or a specific test group).

Strategy 1: Enrolling Windows 11 / 10 Devices

Windows endpoints offer multiple onboarding routes depending on whether the hardware is corporate-owned or personal (BYOD).

Method A: Out-of-Box Experience (OOBE) / Windows Autopilot (Corporate Devices)

Windows Autopilot delivers a seamless zero-touch provisioning experience for brand-new or reset devices.

Hardware Hash: Export and upload the hardware hash CSV to Intune under Devices > Enrollment > Windows Autopilot deployment program.
Assign Profile: Create an Autopilot Deployment Profile (User-Driven or Self-Deploying) and assign it to a device group.
User Setup: When the user powers on the device, connects to Wi-Fi, and enters their corporate credentials, Intune automatically configures corporate settings, applications, and security baselines.

Method B: Access Work or School (BYOD / Personal Devices)

For user-owned devices accessing corporate resources:

Open Settings > Accounts > Access work or school on the Windows machine.
Click Connect.
Enter corporate email and password.
The device registers with Entra ID and enrolls into Intune MDM simultaneously.

Strategy 2: Enrolling iOS / iPadOS Devices

Managing Apple devices requires establishing a trust relationship between Microsoft Intune and Apple Servers.

Step 1: Push Notification Certificate (APNs)

Before any iOS device can enroll, you must configure an Apple MDM Push certificate:

In the Intune portal, go to Devices > iOS/iPadOS > iOS/iPadOS enrollment > Apple MDM Push Certificate.
Download the Intune Certificate Signing Request (CSR).
Log into the Apple Push Certificates Portal with a corporate Apple ID.
Upload the CSR, download the resulting .pem certificate, and upload it back to Intune.

⚠️ Important: Apple MDM Push certificates expire annually. Set a calendar reminder to renew it using the exact same Apple ID to avoid losing management connectivity over all enrolled iOS devices.

Step 2: Choose Enrollment Method

User Enrollment / Company Portal (BYOD): Users download the Company Portal app from the App Store, sign in, and follow prompts to install the MDM management profile. This separates personal data from encrypted work data.
Apple Business Manager (ABM / Corporate): Link Intune to ABM via an Enrollment Program Token for zero-touch ADE (Automated Device Enrollment).

Best Practices Post-Enrollment

Once enrollment workflows are functional, implement these immediate security baselines:

Compliance Policies: Require BitLocker encryption on Windows and mandatory passcodes/biometrics on iOS.
Conditional Access Integration: Configure Entra ID Conditional Access to “Require device to be marked as compliant” before granting access to M365 apps.
App Protection Policies (MAM): Prevent data leaks by restricting copy/paste between corporate and personal apps.

Summary

Combining Intune enrollment with Entra ID Conditional Access ensures that only secure, compliant users and endpoints can connect to your enterprise resources.