Apple Business Manager Intune Setup: Skip the Retail Mistake

Apple Business Manager (ABM) is Apple's portal for linking device purchases directly to your organization. When a reseller or carrier reports your purchase to Apple with your organization ID attached, the device shows up in ABM already tied to your company — before it ever ships. From there, ABM hands off to Intune through Automated Device Enrollment (ADE), formerly known as DEP. Intune then controls what Setup Assistant looks like, forces supervision, and makes sure the device is compliant before an employee ever taps "Get Started."

Without that link, you're stuck managing iPhones reactively — asking users to install a profile, trusting them to not skip it, and hoping nobody factory-resets the phone later. For companies handling regulated data, that gap matters for more than convenience; it touches the same device hygiene expectations baked into frameworks like HIPAA and the FTC Safeguards Rule.

Sign up at business.apple.com with your company's D-U-N-S number. Once approved, go into the Settings panel and add your authorized reseller or carrier's ID under "Device Enrollment Program" so future purchases report into your ABM instance automatically. If you've already got a Microsoft 365 tenant, this is also where you'd federate Managed Apple IDs with Entra ID — worth doing in the same sitting if you're using Entra ID management for your directory.

Buy through that linked reseller going forward, not through a retail storefront, and every device will land in ABM without anyone touching it.

Inside ABM, generate an MDM server token (a .p7m file) and download it. In the Intune admin center, go to Devices > Enrollment > Apple > Automatic Enrollment and upload an Apple MDM push certificate (created via Apple's push certificates portal using your Apple ID) alongside that ADE token. This pairing is what lets Intune actually talk to Apple's push notification service and claim devices as they check in.

Here's where people get tripped up. Intune still shows a legacy "Enrollment Program Tokens > Profiles" experience for some tenants, but Microsoft has been migrating everyone to Enrollment Program Tokens > Enrollment Policies, and that's the one you want to configure. The old Profiles UI is being retired, and policies you build there won't carry the newer options.

Supervised, Locked Enrollment

Turn on supervised mode and lock enrollment so the device can't be removed from management by a factory reset without wiping and re-enrolling through ABM. This is the setting that actually protects you if a phone walks out the door.

Setup Assistant With Modern Authentication

Enable modern authentication so the user signs in with their Entra ID credentials — ideally with MFA enforced — right during Setup Assistant, instead of landing on a blank home screen with no identity tied to the device at all.

Hiding Setup Assistant Screens

Hide the screens nobody needs: Apple ID, Terms and Conditions duplication, Siri, Appearance, Diagnostics, Restore. Fewer taps means less room for a warehouse employee to accidentally configure something you didn't intend.

Await Final Configuration

Turn this on so the device won't finish Setup Assistant until all required apps and configuration profiles have actually installed. Skip this and users end up with a phone that looks done but is still silently downloading Company Portal and your compliance profile in the background — and they start using it anyway.

This is the step that causes the most support tickets. Intune's own documentation is blunt about it: a device synced from ABM with no enrollment policy assigned to it will fail enrollment the moment someone powers it on. Set your new policy as the default for the token before you hand out a single phone, not after. If you've already got devices sitting unassigned, assign the policy manually to that batch before shrink-wrap comes off.

Pull Company Portal into Intune through Apple's Volume Purchase Program (VPP) rather than pointing users at the public App Store listing. VPP-deployed apps install silently as part of the Setup Assistant flow — no Apple ID prompt, no manual search, no chance someone installs a stale or wrong version. Pair this with the devices still sealed in shrink-wrap, and the first thing a user sees after sign-in is a fully configured phone with your mobile threat defense and endpoint security policies already in place.

If phones were bought at a carrier or retail store, they simply aren't in Apple Business Manager, no matter how Intune is configured on your end. The only path to compliance after the fact is Apple Configurator on a Mac, connecting each device over USB and assigning it to your organization manually — one at a time, which is painful at any volume past a handful of units.

Worse, Apple's own documentation notes that users on devices added through Apple Configurator can remove management themselves within the first 30 days. That's not a theoretical gap — it means a disgruntled or careless employee has a full month where they could de-register a company phone before the lock takes effect. It's a workaround, not a fix, and it's exactly why purchasing discipline matters as much as the Intune configuration itself.

Getting enrollment right is one piece of a bigger device management picture that usually also includes Intune device management policies for Android and Windows, and often ties into Microsoft 365 managed services for identity and data loss prevention. Companies rolling out custom line-of-business apps alongside Company Portal should also loop in whoever handles mobile app development early, since VPP licensing and in-house app distribution need to be planned together, not bolted on after the fact.

Texas businesses in particular are under more pressure to show this kind of device hygiene documented somewhere. SB 2610 shields companies with 20-99 employees from exemplary damages in a breach suit if they've implemented CIS Controls IG1, and locked-down, supervised mobile enrollment is a straightforward item to check off that list (Texas SB 2610, as of 2026-08-20).

Do I need Apple Business Manager if I'm only deploying a handful of iPhones?

Yes. Volume doesn't change the enrollment mechanics — even five devices benefit from supervised, zero-touch setup, and it avoids the Apple Configurator workaround entirely.

What happens if I skip setting a default enrollment policy?

According to Microsoft's own Intune documentation, a synced device with no assigned enrollment policy fails enrollment outright when it's powered on. Always confirm your policy is set as default before devices ship to users.

Can I still use the old Profiles experience in Intune?

It's being phased out. Build new configurations under Enrollment Program Tokens > Enrollment Policies so you're not stuck migrating later under time pressure.

Is Apple Configurator a permanent fix for retail-purchased phones?

It gets the device into management, but Apple's guidance notes users can remove management themselves within the first 30 days on Configurator-added devices. Treat it as a stopgap, not a long-term answer.

If your last iPhone rollout involved someone's personal Apple ID and a prayer, it's worth having a second set of eyes look at your Apple Business Manager Intune configuration before the next batch of devices arrives. Request a free IT assessment or contact LayerLogix and we'll walk through your enrollment policy, VPP licensing, and device compliance setup together.