1.5MD-102Advanced
Est: ~15 mins•Verified: 2026-08

Mobile Enrollment: Apple ADE & Android Enterprise

Enterprise mobile device onboarding guide covering Apple Automated Device Enrollment (ADE) via Apple Business Manager and Android Enterprise Work Profile & Dedicated modes.

Tags:#iOS#Android#Apple Business Manager#ADE#Android Enterprise#MD-102
01

Overview

Enterprise mobile device management in Microsoft Intune requires establishing platform-specific trusts with Apple Inc. and Google LLC:

  1. Apple Automated Device Enrollment (ADE): Formerly DEP (Device Enrollment Program). iOS/iPadOS and macOS devices purchased through authorized Apple channels are linked to Apple Business Manager (ABM). During device activation, the device contacts Apple, pulls Intune MDM profiles, locks MDM supervision, and enforces Setup Assistant configurations.
  2. Android Enterprise: Modern management framework replacing legacy Android Device Administrator. Supports:
  • Personally-Owned with Work Profile (BYOD): Strict OS-level containerization isolating corporate data from personal apps.
  • Corporate-Owned Dedicated (Kiosk/COSU): Token-based zero-touch enrollment for shared frontline devices without user affinity.
  • Corporate-Owned Fully Managed (COBO): Complete device control for company-owned phones.

---

02

When to Use

Platform & OwnershipManagement ModePrimary Use Case
Corporate iPhone / iPadApple ADE (Supervised)Company-owned devices requiring mandatory enrollment, web filtering, and kiosk mode.
Personal iPhone / iPad (BYOD)User Enrollment / MAMEmployees using personal iPhones; enforces containerization without full device wipe ability.
Personal Android (BYOD)Personally-Owned Work ProfileIsolates corporate apps (badged briefcase icon); personal data is private from IT.
Corporate Android (Single-purpose)Android Enterprise DedicatedWarehouse barcode scanners, delivery tablets, public kiosks (enrolled via QR code/NFC).

---

03

Prerequisites

Apple Platform Requirements:

  • Apple MDM Push Certificate (APNs): Mandatory annual certificate linking Intune to Apple Push Notification service.
  • Apple Business Manager (ABM) account with an active Administrator role.
  • Enrollment Program Token (.p7m): Uploaded to Intune and renewed annually.

Android Platform Requirements:

  • Managed Google Play Account: Enterprise binding linking Intune tenant to a corporate Google account.
  • Android 10.0+ for corporate modes (Android 8.0+ for Work Profile).
  • Google Mobile Services (GMS) certified devices.

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    ├── iOS/iPadOS
    │   └── iOS/iPadOS enrollment
    │       ├── Apple MDM Push certificate
    │       └── Enrollment program tokens (Apple Business Manager)
    └── Android
        └── Android enrollment
            ├── Managed Google Play (Prerequisites)
            ├── Personally-owned devices with work profiles
            └── Corporate-owned dedicated devices

---

05

Step-by-Step Implementation

Step 1: Configure Apple Push Notification (APNs) Certificate

  1. In Intune, go to Devices > iOS/iPadOS > iOS/iPadOS enrollment > Apple MDM Push Certificate.
  2. Grant Microsoft permission to send user and device information to Apple.
  3. Click Download your CSR (IntuneCSR.csr).
  4. Sign in to the Apple Push Certificates Portal (identity.apple.com) with your corporate Apple ID.
  5. Create certificate, upload the CSR, and download the resulting .pem file.
  6. Return to Intune, enter your Apple ID, upload the .pem file, and click Upload.

Step 2: Connect Apple Business Manager (ABM) Token

  1. In Enrollment program tokens, click Add > Download Intune public key.
  2. Sign in to Apple Business Manager (business.apple.com) > Preferences > MDM Servers > Add MDM Server.
  3. Upload Intune public key > Download the Apple server token (.p7m).
  4. In Intune, upload the .p7m token and save.
  5. Create an Enrollment Profile:
  • User Affinity: Enroll with User Affinity (Company Portal authentication)
  • Supervised: Yes
  • Locked Enrollment: Yes (prevents users from removing MDM in iOS Settings)

Step 3: Link Managed Google Play & Create Android Enrollment Profile

  1. Go to Devices > Android > Android enrollment > Managed Google Play.
  2. Click I agree > Launch Google to connect now > Sign in with corporate Google workspace account > Click Complete Registration.
  3. Under Corporate-owned dedicated devices, click Create profile:
  • Token type: Corporate-owned dedicated device
  • Token expiration: Set date (up to 90 days)
  1. Intune generates a scannable QR Code and string token.

---

06

PowerShell Automation

Check Apple Push Certificate (APNs) Expiration Date via Graph:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All"

# Query APNs push certificate expiration status
Get-MgDeviceManagementApplePushNotificationCertificate | 
    Select-Object appleIdentifier, certificateSerialNumber, expirationDateTime, lastModifiedDateTime | 
    Format-List

Inspect Enrollment Program (ABM) Tokens:

PowerShell
# Retrieve all Apple Business Manager tokens linked to tenant
Get-MgDeviceManagementDepOnboardingSetting -All | 
    Select-Object id, tokenExpirationDateTime, lastSuccessfulSyncDateTime, shareTokenWithSchoolDataSync

---

07

Microsoft Graph Automation

Create Android Enterprise Dedicated Device Enrollment Token:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All"

$TokenBody = @{
    displayName = "Warehouse-Scanners-Dedicated-Token"
    description = "QR Code for Zebra scanners running Android 13"
    tokenType = "corporateOwnedDedicatedDevice"
    tokenExpirationDateTime = (Get-Date).AddDays(60).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
}

New-MgDeviceManagementAndroidDeviceOwnerEnrollmentProfile -BodyParameter $TokenBody

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/6 (0%)
Apple MDM Push Certificate status displays Active with valid expiration date.
Apple Business Manager devices sync automatically into Intune device list.
iOS device activation forces remote management screen and cannot be skipped when Supervised/Locked.
Android BYOD displays dual app drawer with badged corporate icons (briefcase badge).
Tapping 6 times on new Android factory setup screen launches the QR code scanner.
Dedicated Android device boots directly into Managed Home Screen or targeted kiosk app.
09

Diagnostic Logs & Channels

Platform / ToolLog LocationPurpose
iOS Console Logs (macOS)Apple Configurator / Console.app (filter mdmd)Analyzes mobile device management protocol handshakes and profile payload errors.
Android Logcatadb logcat -s "DevicePolicyManager" "CloudDpc"Detailed Android Enterprise provisioning, policy enforcement, and token parsing logs.
Intune Company Portal (Android)Company Portal > Settings > Send Logs (Incident ID)Uploads client-side diagnostic report directly to Microsoft engineering servers.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
iOS: "The configuration cannot be downloaded"Network connectivity issue or Apple Push Certificate has expired in Intune.1. Check APNs expiration in Intune.
2. Allow outbound access to albert.apple.com and mdmenrollment.apple.com on port 443.
Android: "Can't set up device. Contact IT"Device is enrolled via personal Google account or token has expired.Factory reset device. At "Hi There" screen, tap 6 times in the same spot to invoke enterprise camera QR scanner.
APNs Renewal Overwritten (Fatal)IT administrator clicked "Renew" using a different Apple ID than original creation.NEVER change the Apple ID during renewal. If Apple ID changes, every enrolled iOS device MUST be re-enrolled.
ABM Sync Status: FailedApple server token (.p7m) has expired (tokens are valid for exactly 365 days).Download fresh server token from Apple Business Manager and upload to Intune enrollment token panel.

---

11

Production Best Practices

Security Caution

APNs Certificate Renewal Disaster Prevention:

Always use a generic company mailbox (e.g., apple-admin@yourcompany.com) rather than an individual employee's email for the Apple Push Certificate portal. If that employee leaves and the certificate expires or is recreated under another account, ALL iOS devices will lose MDM communication and must be wiped.

Production Best Practice

Android Zero-Touch Portal Integration:

For large enterprise Android deployments, link your Samsung Knox Mobile Enrollment (KME) or Google Android Zero-Touch portal directly to Intune DPC extras to provision devices straight from the factory sealed box.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. APNs Validity: The Apple Push Notification certificate must be renewed annually (every 365 days).
  2. Supervised Mode: Supervised mode gives IT deep management capabilities (single app mode, web content filter, remote wipe). Devices can ONLY become Supervised during initial setup via Apple Business Manager or Apple Configurator.
  3. Android Device Administrator: Legacy Android Device Administrator is deprecated and disabled in modern Intune. Android Enterprise is the only supported standard.

---

13

Official Documentation

PREVIOUS TOPIC1.4 Windows Autopilot: Pre-Provisioned DeploymentNEXT TOPIC2.1 Intune Device Compliance Policies: Windows 10 & 11