How to use Intune Web-based Enrollment for iOS devices

Intune constantly evolves month to month with new ways to manage devices. One of the fairly recent additions is the ability to do Web-based device enrollment for iOS devices. This is for Bring Your Own Device (BYOD) scenario. User enrollment and device enrollment have been around for a long time, with a known process that essentially consists of the user installing the Company portal, sign-in and following on-screen instructions to achieve enrollment.

The Web-based device enrollment eases the process for the end-user to simply access a dedicated web-page, and sign-in. Everything else, including the Company Portal, will be pushed later from Intune after the enrollment is completed. This enrollment method will set the device in the same state as a Device enrollment, which means the device is fully managed, compared to User enrollment which splits the device into personal/corporate sections.

In this post, we’ll detail how to configure Intune to support web-based device enrollment and demonstrate the enrollment behaviour with an iPad.

Intune Web-based Enrollment Prerequisites

• Intune is the MDM Authority
• Apple MDM certificate is configured
  • See our post on How to use Microsoft Endpoint Manager to enroll iOS devices (systemcenterdudes.com)
• Intune license for the end-user
• iOS Enrollment profile
• Just-in-Time(JIT) device configuration profile

Create Web-based device enrollment profile for iOS in Intune

• In the Intune admin center, browse to Devices/Enrollment/Apple and select Enrollment types

• Select Create Profile/iOS/iPadOS

• Provide a name of the enrollment profile

• Select Web-based device enrollment

• Like other enrollment profiles, select a target group of users allowed to use it.

• Use the left section to change the priority order of the various profiles in case the user is targeted by multiple enrollment profiles.

Create a Just-in-time registration device configuration profile

Why JIT configuration?

Just-in-time registration is required to use the Apple Single sign-on(SSO) extension to complete the Microsoft Entra registration of the device. Just in time will limit the number of authentication prompts by establishing the SSO across the whole device for Microsoft products.

• In theIntune admin center, browse to Devices/Configuration and create a new policy

• Select iOS, Templates and Device Features. Click Create.

• Provide the name

• Under Single sign-on app extension, select Microsoft EntraID

• Additional configurations are needed.
  • App Bundle ID isn’t required for our current need.
  • 2 keys are needed
    • Key: device_registration
    • Type: String
    • Value: {{DEVICEREGISTRATION}}
    • Key: browser_sso_interaction_enabled
    • Type: Integer
    • Value: 1

Avoid additional space before/after those values, otherwise Just-in-Time won’t work!!

• Assign the device configuration to the same group as the Enrollment profile for convenience.

For more details about the Just-in-time registration, see Microsoft Docs.

Enroll iOS using Web-based device enrollment

• Open Safari, and open one of those links:
  • https://portal.manage.microsoft.com/conditionalaccess/enrollment
  • https://portal.manage.microsoft.com/enrollment/webenrollment/ios
• Select which type of device you are using.

This enrollment method is only supported from Safari browser!

• Sign-in with Microsoft Entra ID credentials.

• Click on Get Started

• Allow this website to download a configuration profile.

• Go to Settings / General / VPN & device management

• A prompt will ask to install the Microsoft Intune root certification authority, click on Install and Trust

• Once the profile is installed, the enrollment is completed and the device will begin to process policies and applications!

A few additional notes

• The Company portal isn’t required to be installed at all.
  • Microsoft recommends at least providing a web app pointing to https://portal.manage.microsoft.com/
• Microsoft Authenticator is required for work/school access. It is recommended to share instructions accordingly.

For more details about Web-based device enrollment, see Microsoft docs.