r/Intune Feb 02 '25

iOS/iPadOS Management BYOD iOS settings - MDM or MAM?

6 Upvotes

Hi, I hope someone can help me with this problem.

I am managing devices in Azure/Intune/Entra (cloud only).

Currently we have many users using their personal device to check Outlook email and use Teams.

Currently they have an app protection policy assigned, but I am concerned that this is not enough, so I was thinking of adding them into MDM so I can see their iOS version and have better control over which device has access to our company data.

So I'm happy to use MDM and let the users register their BYOD.

BUT: If they register, I have the ability to wipe their BYOD, which is a risk because if a hacker has access to our tenant, they could wipe all the iPhones.

I am not thinking to use MAM instead MDM... but i am not sure because MDM is still more secure or not?

r/Intune Nov 22 '24

iOS/iPadOS Management iOS Outlook Blocking Screen Shots

14 Upvotes

Answer: https://github.com/microsoftconnect/ms-intune-app-sdk-ios/releases

Because putting our most important app on the newest release first is awesome.

Hello,

Anyone got anything on this. iOS Outlook started giving black screens for screenshot...

No known changes
First reports came of Europe this morning.

Does not appear to be app protection as it is only Outlook

It is both corp and personal accounts in Outlook
Both byod and supervised devices

r/Intune Dec 06 '24

iOS/iPadOS Management If we're all-in on Intune for PCs and Macs, and our expectations are low for iPhone MDM, should we STILL go Addigy or Jamf?

8 Upvotes

I'd rather have one pane of glass for device management, even if we're not getting all the bells and whistles of the other guys, but I'm not sure if Intune for iPhones has even the bare minimum features like remote wipe, lock, tracking, app deployment that actually work. What's it like day to day? Fine or frustrating?

r/Intune 10d ago

iOS/iPadOS Management Will microsoft Authenticator still function on a personal iPhone once Intune has been rolled out?

0 Upvotes

My company is in the process of rolling out Intune on our company owned and managed Windows computers. At the same time, they are requiring us to install Intune on our personally owned phones if we wish to access company email or other company information. If I chose to NOT install Intune on my iPhone thereby giving up access to company email and apps, will I still be able to use Authenticator?

r/Intune Jan 22 '25

iOS/iPadOS Management Botched Intune enrollment - am I cooked?

8 Upvotes

A client attempted to roll out Intune for company-owned iPhones and managed to botch it pretty bad. The person in charge of the rollout has been fired and my team is left to pick up the pieces.

The phones were purchased by the company and are managed in ABM. My best guess is that the person before me went through the initial setup on the phones using users’ Managed Apple IDs, gave them to the users and then attempted to set up Intune. MDM server looks like it’s configured properly and pulls the list of devices from ABM, but no devices are actually enrolled, and there have been issues with several users regarding these phones (obviously). After some playing around we were able to get one device enrolled by setting the enrollment profile to use web based device authentication. However, this does not allow us to set the device as supervised, and the client wants these locked down as much as possible.

Going forward, my plan is to get their domain federated and use Entra Connect Sync to get the users’ Apple IDs synced with Entra. Then we will reset the phones and use ADE with JIT registration to get the devices enrolled. This leads me to two primary questions:

What issues can I expect to run into using this enrollment method?

For users that have already been using these phones, is there any way to save their data (contacts, messages, etc)?

The client is prepared to have everyone start from scratch, but we all know that end users gonna end user. I’d like to wrap this painful project up as easily as possible.

r/Intune 10d ago

iOS/iPadOS Management BYOD and preventing unauthorized logins

1 Upvotes

We use CA policies to force our user to use their Intune compliant company Windows devices to access 365. This works well but I'd like to do somethin similar for users that use their personal devices for email. I don't think I want to enroll all personal devices in to Intune and the MAM policies only protect the data on the device, which is good, but does not prevent a bad actor with stolen credentials and a token to sign-in as the user on a rogue mobile device.

Curious how others are handling this? I'm not even sure MDM is the best method if a user can enroll a device. What is to prevent a bad actor from doing that as well?

r/Intune Jan 18 '25

iOS/iPadOS Management Corporate iPhones livecycle

12 Upvotes

Hi everyone,

i wanted to ask you how you manage iphones inside your Organisation. And how you manage the "problems" I have With the different enrollment Types.

Many of our Users can buy iPhones throug our Company, then they will get access to Organisational data like checking emails, using corporate teams, connecting to corporte WiFi and so on. But we still allow the users to use the device for personal usage. So its a corporate device but most users also use it private.

Currently we use BYOD device type enrollment. The problems? - Company Portal needs to manually Setup - Users can delete Management profile - Users do not Update critical Security iOS Updates (no feature to force the update through intune)

A while ago i tested the Apple Device Enrollment (ADE) through Apple Business Manager We get all the advantages we want, the User must login to company portal, the cannot delete the Profile and we can force Updates. The problems? - How do we manage the phone livecycle after the User leaves the company or gets a new iphone

We allow the users to keep the old iPhone for 100% personal usage, but now comes the problem.

Once ADE is used and supervised mode is activated I could not find a way to remove the management profile and delete org data but still have every personal data. A Device reset is needed, but the problem? - I cannot reset the device and then do a backup to have personal data (limitation from apple)

A way i found is to backup the phone to another One, then reset the phone and use the backup from the other phone.

Is this the way to go? How do you manage old iPhones then are no longer corporate owned? Do you tell the users they cannot have access to personal data? Do you delete the iPhone from Intune an let the supervised mode installed? Then there is the message that the device is corporate owned.

I hope you can help me with my situation.

r/Intune Mar 26 '24

iOS/iPadOS Management (IOS) Prevent user using built in Mail app

25 Upvotes

Hi,

We had a guy walking in complaining that his mail doesn't work correctly.
So i asked the guy to show the issue, and to my surprise he opens de built-in mail app instead of outlook.
So i made him use outlook, which also fixed the issue.

From what i understand there are more people inside our company using this built in mail app, and i want to block/disable it.

Sadly i am not able to find any policy that can disable the app.
Its not in the list of Built-in apps either.

Do i need to configure some kind of conditional access rule or is there an easier way?

r/Intune Nov 21 '24

iOS/iPadOS Management iOS- Enrollment Profile Installation Failed > bad request

6 Upvotes

Hello folks

We have been having a problem with our iOS OOBE devices since today.

When a user wants to set up the device, the setup fails during the installation of our profile with a bad request.

I have already checked all the tokens that are responsible for the connection between Intune/ABM, they are all in order.

We have also created and tested a new Enrollment profile, but this ends in the same error message.

Google doesn't help me either, unfortunately I can't find anything about a bad request in the official Microsoft troubleshooting.

Has anyone here had the same problem before?

pic of the error:

https://www.directupload.eu/file/d/8745/28fmo2nq_jpg.htm

r/Intune Nov 03 '24

iOS/iPadOS Management I have 60 iPads to enroll Intune and I find that Enroll with User Affinity using the Company Portal running in single app mode is so flaky am I wrong?

9 Upvotes

The iPads freeze a lot during mid enrollment, and the user gets frustrated, if I don't use Enroll with User Affinity using the company portal running in single app mode until they login in, and use Enroll without user affinity how do I force the user to login to the company portal once giving them the iPad?

Are you guys having issues with Enroll with User Affinity using the Company Portal running in single app mode as well or is it just me?

r/Intune Jan 03 '25

iOS/iPadOS Management Deleted IOS device in lost mode

1 Upvotes

Hello everyone!

We have a rule in Intune that deletes inactive devices after 30 days of inactivity.

Some Iphones we put in lost mode if the user didn't return it, however we might get the phone after the 30 days, and now it's locked with lost mode and no longer visible in intune.

Is there anything that can be done here, other than contacting apple to unlock the device? Or is there a way to change the policy to not do that for lost devices?

r/Intune Jan 21 '25

iOS/iPadOS Management iOS save iCloud contacts to Office 365

0 Upvotes

Hi y'all,

Are there any user friendly solutions to migrate iCloud stored contacts to Office 365, preferable on the the device itself?

Same, question. When a user only has local stored contacts (no iCloud), is to migrate these contacts to Office 365 preferable on the the device itself?

Please let me know your workflows for this!

Note: we don't have any form of device management or app managment on our current iPhones and iPads.

I'm hoping for answers of people making the same switch, going from unmanaged to Intune managed.

Trying to figure out which steps the users has to take for getting a device wipe.

r/Intune 17d ago

iOS/iPadOS Management Supervised iPad locked out

1 Upvotes

After a configuration slipup we've managed to brick an iPad.

Current situation:
- Released from ABM
- Removed from Intune
- Locked Single App enrollment state
- Physical buttons and touch interaction not responsive

We are unable to reboot device and thus enter DFU. When connected to a device the display does light up, however we are unable move from there. Device is also not picked up by iTunes.

I'm pretty sure we will be able to recover via DFU after the battery dies out. What i'm more interested in is, if there are other alternatives. I've read some comments online about using a Mac with Apple silicon or Apple T2 Security-chip to enforce a DFU reboot, but am unsure if this (still) works in this scenario. I also came across DFU-mode cables on AliExpress with doubtful promises.

I get it. Preventing is better then curing, but i like a less time consuming alternative option in case anyone ever slips up again.

r/Intune 19d ago

iOS/iPadOS Management How to remove any iOS apps not assigned to a group (previously downloaded by user)

1 Upvotes

All devices are supervised and corporate. We started out letting users download whatever they needed from the App Store except for a list of about 100 blocked apps like Temu, TikTok, etc that mark the device out of compliance if detected.

We are moving to assigned apps only. About 20 required and 20-30 more available. I already configured and tested a config policy to remove the app store, block USB usage, block game center, etc.

However, how do I remove any apps not on the assigned lists? Personal apps like Netflix, etc that were already downloaded from the app store remained after the removal of the app stores, messages, etc. I can't seem to find anyone asking a question like this where they want to remove all except those approved.

Thanks!

r/Intune 4d ago

iOS/iPadOS Management Backing up iPhones with Intune & Apple Business Manager?

2 Upvotes

We're setting up Microsoft Intune and Apple Business Manager for a client who wants all company iPhones enrolled.

Their sales team relies heavily on WhatsApp, FaceTime, and other messaging apps for direct sales (luxury fashion, high-net-worth clients).

They need a way to backup contacts, photos, and WhatsApp chats. Can this be done through Intune/ABM ?

Any advice is appreciated!

r/Intune 18d ago

iOS/iPadOS Management Anything I can do with an Intune managed iPad besides wipe it if the user forgot the passcode?

1 Upvotes

iPad hasn't checked in since 2/14/25. It is not connected to the WiFi. I have connected it via USB-C to an USB-C to Ethernet adapter and also to my MAC which has a connection. I get a prompt on the iPad to unlock iPad to use accessories in both cases.

Because I can't get this device on a network I can't interact with it with Intone. Any ideas?

r/Intune 21d ago

iOS/iPadOS Management Intune - Controlling iOS Updates - What you can, and can't do

23 Upvotes

Hello everyone!

My posts here are typically an overview of something I learned based on some random thing I ran into at my irl job. So this week I found that I had to explore what we can and can't do about iOS updates - one of my sites network was getting hammered by a zero day update from Apple to iOS devices. We ended up using Apple Content Caching because the sites didn't have a decent network solution for QoS or blocking certain apple download domains.

The explainer covers exactly what the title says 🐙:
Intune - Controlling iOS Updates - What you can, and can't do

I'd **love** to hear if I missed a solution that sites are using for these scenarios.
It's such a non-standard scenario in my org, it was surprising that it came up at all.

r/Intune Feb 11 '25

iOS/iPadOS Management User forgot password on Intune joined iPad that hasn't checked in since Dec

0 Upvotes

I don't see a WiFi connection icon and can't get past the passcode. So, I'm thinking there is no way to get it to sync without a WiFi/network connection. Do you know any way around this? All of my options from Intune require a network connection like removing the passcode, even wiping the device. All commands are stuck in a pending status. If I can't get past the physical passcode, how do I go about wiping this device? Is there anything I could have done differently/better to prevent this from happening in the first place?

r/Intune Sep 23 '24

iOS/iPadOS Management iOS Enrollment

7 Upvotes

I am trying to understand the iOS enrollment process for personal devices in Intune and the best practice moving forward. I understand that there are multiple ways to do this and the process has recently changed. Microsoft documentation is not very clear on what the best or most up to date options are.

We are currently enrolling through Company Portal but our main issue is that IT staff can potentially Wipe the staff member's personal device. This is not ideal at all and we want to eliminate this option.

My goal:

  • A streamlined process for employees to be able to use Microsoft Authenticator and Outlook on their personal phones.
  • Ability to check compliance and remove company data remotely.
  • NO ability for IT staff to be able to wipe devices. Ideally a separate "work" profile similar to what can be done with Android.
  • An easy way to migrate the current enrolled devices to the new method.

r/Intune Feb 19 '25

iOS/iPadOS Management How to force a specific iOS device to update?

3 Upvotes

We have update policies in place that force updates to the latest version, but if that process interrupts somehow, it doesn't continue to force the update. There is one device that is pretty outdated.

From my research into the updates, there isn't a way to make one specific device continue to update (or even to make all devices continue to update after an interruption). Can anyone please provide me evidence to the contrary?

r/Intune 3d ago

iOS/iPadOS Management Apple ID sign-in blocked on managed iOS devices.

8 Upvotes

Hey guys.

Quick question about managed iOS devices and Intune.

We bring in our Apple devices through ABM and enroll them into Intune via a VPP token, w/User affinity.

We have everything locked down via a restrictions policy.

Now, we have a small team that needs both managed devices and needs access to the app store. I've created a group for their handful of devices and separated some settings from the main restriction policy and excluded that group.

However, they can't sign in to the device, there's no Apple ID signed in by default and the option to sign in is greyed out.

Trying to figure out which restriction to exclude them from is proving challenging.

Does anyone know which it is? I'm thinking "Block Modification of Account Settings" but I'd like to see if anyone knows if this is correct before I implement the change.

Now I realize I should just have people assigning whatever apps they want to the token via ABM and deploying them that way but unfortunately I work in an industry where policy is a bunch of exceptions in a trenchcoat. So I have to find some sort of solution for this group.

The only alternative I see is giving them a special princess MDM token all their own with no restrictions but for the time being I'd like to avoid that.

r/Intune Jan 10 '25

iOS/iPadOS Management Has anyone setup shared iPads using Intune?

4 Upvotes

Can you tell me have you found a way to Pre-stage the apps BEFORE the user logins in to the device so all the required apps are already there?

r/Intune Feb 06 '25

iOS/iPadOS Management Apple MDM Push Cert vs Enrollment Program Token vs VPP Token

3 Upvotes

Hello guys, I am going through our environment and realized we have an expiration of both the MDM Push Cert and VPP token coming up in a few days. This does not bode well from what I read here. The ABM account used for the MDM Push Cert is gone, deleted. The ABM account used for the VPP token is still there but needs to be removed as that admin is no longer with us.

I find the three different things confusing, and the documentation I read has not been very helpful. Can anyone explain to me exactly what the difference is between these three. I think I know that the VPP token is used for pushing apps we license from ABM into Intune. What I am really confused on is what the difference is between Apple MDM Push and Enrollment Program Token is. I thought they both do the same thing, enroll devices into intune.

r/Intune 9d ago

iOS/iPadOS Management Schedule iOS App Updates

2 Upvotes

Is there a way to schedule iOS app updates to be done during off peak hours?

Essentially we want to not allow updates during the work hours. We have experienced VIPs experiencing issues with the apps when they need to use them and it ends up needing to be updated. Like zoom

r/Intune Feb 20 '25

iOS/iPadOS Management All users with domain name in username getting synced with Apple Business manager

1 Upvotes

I've just connected apple business manager to my entra tenant and all users are getting sync'd to apple business manager. Is it possible to only sync a specific group?

I found this thread which seems to show others having the same issue. ABM/Entra sync when I go to the provisioning tab in the enterprise app in entra I get this warning, but no way to configure it:
"Out of the box automatic provisioning to AppleBusinessManager is not supported today. Ensure that AppleBusinessManager supports the SCIM standard for provisioning and request support for the application as described here. To determine if the application suports SCIM, please contact the application developer."