Module 2: Device Enrolment — Windows, iOS & Android

← Module 1: Overview

Module 2 of 7

Module 3: Compliance →

🎯 Intune Course · Module 2 of 7

Device Enrolment — Windows, iOS & Android

📂 Course: Intune & Endpoint Management
📦 Module: 2 of 7
🎯 Exam: MD-102
⏱ Read time: ~26 min
MD-102
MD-102 Exam Alignment
MD-102
  • Know that Windows Auto-enrollment via Entra ID join automatically enrolls Windows 10/11 devices in Intune — no user action required after the initial device setup if auto-enrollment is configured
  • Know that iOS/iPadOS corporate devices use Automated Device Enrolment (ADE) via Apple Business Manager — this is the only method that allows supervised mode and zero-touch provisioning
  • Know the difference between Android Enterprise Work Profile (BYOD — personal device with a separate work container) and Android Enterprise Fully Managed (corporate-owned, entire device managed)
  • Know that Enrolment Restrictions (Devices → Enrolment restrictions) can block personal devices, limit device types by platform, or set a maximum device count per user
Exam Tip: ADE (formerly DEP) is the key iOS enrolment method for MD-102. Remember: ADE requires Apple Business Manager (ABM) OR Apple School Manager (ASM). The device must be purchased through Apple or an authorised reseller and linked to ABM before it can be ADE-enrolled. BYOD iPhones cannot use ADE — they must use the Company Portal app instead.
Device enrolment is the process of registering a device with Intune so it can receive policies, apps, and compliance checks. Intune supports multiple enrolment methods for each platform, each suited to different ownership models (corporate vs BYOD) and deployment scenarios. Choosing the right enrolment method determines what level of control IT has over the device and what the user experience looks like during setup.

📋 Enrolment Methods — Overview

Platform Method Ownership Key Characteristic
Windows Entra ID Join + Auto-enrollment Corporate Device joins Entra ID during OOBE; MDM auto-enrollment triggers automatically via MDM scope policy
Windows BYOD via Company Portal Personal User downloads Company Portal app and manually enrolls their personal Windows device
Windows Windows Autopilot Corporate Zero-touch provisioning — device auto-configures from the cloud using pre-registered hardware hash
Windows Hybrid Entra ID Join (GPO) Corporate Domain-joined device enrolled via Group Policy; requires SCCM or Intune connector; co-management scenario
iOS/iPadOS Automated Device Enrolment (ADE) Corporate Via Apple Business Manager; supervised mode; zero-touch; cannot be removed by user
iOS/iPadOS BYOD via Company Portal Personal User downloads Company Portal and enrolls; user-initiated; device remains unsupervised; user can remove enrolment
Android Android Enterprise Work Profile BYOD/Personal Creates a separate work container on the personal device; personal data fully isolated from corporate data
Android Android Enterprise Fully Managed Corporate IT controls the entire device; device is dedicated to work use; set up via QR code, NFC, or zero-touch
Android Android Enterprise Dedicated Device Corporate Single-purpose kiosk device (e.g., self-checkout terminal); runs in kiosk mode with specific apps only

🪟 Windows Enrolment

Method 1: Entra ID Join + Automatic MDM Enrolment

The most common corporate Windows enrolment path. When a Windows 10/11 device is joined to Entra ID during OOBE, Intune auto-enrollment triggers if the MDM scope is configured.

📋 Pre-requisite: Configure MDM Auto-enrollment

  • In Entra ID portal: Mobility (MDM and MAM) → Microsoft Intune → MDM user scope → set to All (or a group)
  • Once set, any device joined to Entra ID by a user in scope automatically enrolls in Intune
  • No additional user action required after Entra join — Intune receives the device within minutes

Method 2: Windows Autopilot (Zero-Touch)

Covered in detail in Module 6. Devices are pre-registered in Intune using hardware hash, and the OOBE runs fully customised — user just signs in with their work credentials.

Method 3: BYOD via Company Portal

User downloads the Intune Company Portal app from the Microsoft Store, signs in with their work account, and manually enrolls their personal Windows device. IT can then push Available (user-installable) apps and enforces compliance, but the device is marked as Personal in Intune inventory.

🍎 iOS/iPadOS Enrolment

Corporate Devices: Automated Device Enrolment (ADE)

ADE Step Detail
1. Prerequisite Device must be purchased through Apple, an Apple Authorised Reseller, or a carrier — then linked to Apple Business Manager (ABM)
2. ABM token Admin downloads a server token (.p7m) from ABM and uploads it to Intune: Tenant administration → Connectors and tokens → Apple enrollment tokens
3. Sync devices Devices assigned to the MDM server in ABM appear in Intune under Devices → iOS/iPadOS → Enrolment program tokens → Devices
4. Enrolment profile Create an ADE profile in Intune specifying: supervised mode ON/OFF, Setup Assistant steps to show/skip, department/support phone, user affinity (with or without)
5. Device setup When the device is turned on (or restored), it contacts Apple, receives the ADE profile, runs the customised Setup Assistant, and automatically enrolls in Intune — no IT hands-on required

⚠️ Supervised Mode — Key ADE Benefit

ADE-enrolled devices can be placed in Supervised mode — this enables a higher level of management not available on unsupervised devices: disable Activation Lock, restrict specific app access, hide certain settings, block iCloud backup, and prevent users from removing Intune management. BYOD devices enrolled via Company Portal are always unsupervised.

BYOD: Company Portal App

User downloads the Intune Company Portal from the App Store, signs in with their work account, and follows the enrolment steps. The device is unsupervised. The user can remove the management profile at any time from iOS Settings. IT can perform a Selective wipe to remove corporate data but cannot do a factory wipe of the personal device.

🤖 Android Enterprise Enrolment

Work Profile (BYOD — Most Common)

Creates a dedicated work container on the employee’s personal Android device. All corporate apps and data live in the work profile. Personal apps and data are completely isolated. IT can manage and wipe only the work profile — cannot see or touch personal data.

Scenario Work Profile Fully Managed
Device ownership Personal (BYOD) Corporate-owned
IT control scope Work profile only (apps, data, VPN within work container) Entire device (all apps, settings, factory reset)
Personal app access User retains full access to personal apps outside work profile IT controls which apps can be installed; personal use restricted
Setup method User downloads Company Portal, creates work profile Zero-touch, QR code, NFC, or DPC identifier during factory setup
Wipe capability Selective wipe (work profile only) Full factory wipe

🚫 Enrolment Restrictions

Found at Devices → Enrolment → Enrolment restrictions. Allow admins to restrict:

  • Device platform restrictions — Block enrolment by platform, OS version range (min/max), and personally-owned vs corporate-owned
  • Device limit restrictions — Maximum number of devices a user can enrol (default: 15). Prevents a single user from registering unlimited devices
  • Priority — Multiple restrictions can exist; the one with the highest priority (lowest number) that applies to a user takes effect
PowerShell — Intune Enrolment (Microsoft Graph)

Connect-MgGraph -Scopes 'DeviceManagementServiceConfig.ReadWrite.All'

# Get all enrolled devices with compliance state
Get-MgDeviceManagementManagedDevice | Select-Object DeviceName,OperatingSystem,ComplianceState,EnrolledDateTime | Sort-Object EnrolledDateTime -Descending

# Filter by platform
Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'" | Select-Object DeviceName,OsVersion,ComplianceState

# Find non-compliant devices
Get-MgDeviceManagementManagedDevice -Filter "complianceState eq 'noncompliant'" | Select-Object DeviceName,UserPrincipalName,OperatingSystem

💡 Best Practices

  • For corporate iOS devices, always use ADE via Apple Business Manager — only ADE enables supervised mode, prevents enrolment removal, and supports zero-touch provisioning at scale
  • For Android BYOD, use Work Profile enrolment — it provides IT the controls needed while respecting employee privacy and is more widely accepted by employees than full device management
  • Configure Enrolment Restrictions before users begin enrolling — use platform restrictions to ensure only supported platforms and OS versions enrol

🎓 Interview Q&A

Q: An employee’s Android phone is enrolled with Android Enterprise Work Profile. The employee resigns. What happens when IT performs a Selective Wipe from Intune?
Selective Wipe removes the work profile only — all corporate apps, data, email, and certificates within the work container are deleted. The employee’s personal apps, photos, messages, and personal data outside the work profile are completely untouched. This is a key benefit of Work Profile over Fully Managed from a GDPR/privacy perspective: IT can definitively remove all corporate data without any access to or impact on personal data. After the wipe, the device functions normally as a personal phone.
🎯 MD-102 Mock Test
Module 2 — Device Enrolment
5 questions · Pass mark: 70%

Q1 OF 5

A company purchases 200 iPhones through an Apple Authorised Reseller for corporate use. They want zero-touch enrolment where devices auto-configure when powered on and employees cannot remove the Intune management profile. Which enrolment method achieves this?

AAutomated Device Enrolment (ADE) via Apple Business Manager with supervised mode enabled
BBYOD enrolment via the Company Portal app with a lock restriction policy applied
CiOS User Enrolment — designed for corporate devices with supervision
DApple Configurator with a supervision profile applied before distribution

✅ A. ADE via Apple Business Manager is the only method that: (1) enables zero-touch provisioning, (2) enables supervised mode, and (3) prevents users from removing the management profile. Devices must be linked to ABM, which requires purchase through Apple or an authorised reseller. BYOD via Company Portal always allows users to remove management.

Q2 OF 5

An employee brings their personal Android phone and needs to access company email and SharePoint. IT wants to manage corporate apps and data but must NOT be able to access the employee’s personal photos or apps. Which Android enrolment type is appropriate?

AAndroid Enterprise Fully Managed — IT needs to control the corporate apps
BAndroid Enterprise Dedicated Device — appropriate for BYOD with work apps
CAndroid Enterprise Work Profile — creates a separate work container, personal data remains isolated
DAndroid Device Administrator — the legacy enrolment method for BYOD

✅ C. Android Enterprise Work Profile creates a dedicated, encrypted work container on the personal device. Corporate apps and data live inside the work profile; IT can only see and manage what’s in the work profile. Personal photos, apps, and messages remain completely private. IT can do a Selective Wipe to remove only the work profile. Fully Managed (A) is for corporate-owned devices where IT controls the entire device.

Q3 OF 5

A Windows 11 device is Entra ID joined by a user whose account is in scope for MDM auto-enrollment. What additional configuration is required for the device to automatically enrol in Intune during setup?

AThe user must manually install the Intune Company Portal app and sign in
BNo additional configuration — Entra ID join with MDM scope configured triggers automatic Intune enrolment
CAn Intune enrolment profile must be assigned to the user in the admin center
DA Group Policy Object must be applied to trigger MDM enrollment on Windows

✅ B. When MDM auto-enrollment is configured in Entra ID (Mobility → Microsoft Intune → MDM user scope set to All or a specific group), any device that is Entra ID joined by a user in scope automatically enrolls in Intune. No additional user action, app installation, or profile assignment is required beyond the Entra ID join itself.

Q4 OF 5

An organisation wants to prevent employees from enrolling personal Windows devices in Intune, allowing only corporate-owned Windows devices. Where is this configured?

AEndpoint security → Device compliance → Windows restrictions
BTenant administration → Connector and tokens → Windows enrollment
CEntra ID → Devices → Device settings → Restrict device registration
DDevices → Enrollment → Enrollment restrictions → Platform restriction → Block personally-owned Windows devices

✅ D. Enrolment Restrictions are found at Devices → Enrollment → Enrollment restrictions. Create or edit a Platform restriction for Windows, and enable the option to block personally-owned (BYOD) devices. Corporate devices (Entra ID joined, Autopilot-registered) are classified as corporate-owned and allowed; personal Windows devices enrolled via Company Portal are classified as personally-owned and blocked.

Q5 OF 5

What is the primary advantage of iOS Supervised mode enabled through Automated Device Enrolment (ADE) compared to BYOD enrolment via the Company Portal?

AADE is faster to set up because no ABM token is required
BADE allows MAM-WE policies to apply without the Company Portal app
CSupervised mode enables deeper management controls and prevents users from removing the management profile
DADE automatically backs up all device data to company storage

✅ C. Supervised mode (only achievable via ADE) provides significantly deeper management capabilities: the management profile cannot be removed by the user; IT can disable Activation Lock; restrict specific app categories; block iCloud backup; and apply additional restrictions unavailable on unsupervised devices. BYOD Company Portal enrolment results in unsupervised devices where users retain the ability to remove management at any time.



🔒

Module locked — Complete Module 1 first.