Account-driven User Enrollment for iOS/iPadOS BYOD with Intune: setup and user flow

Personal iPhones and iPads need work apps and data protection, but their owners don't want IT to see or wipe the whole device. Account-driven User Enrollment is Apple's answer: the user signs in with a work account in Settings, and work data lives on a separate managed volume. In this post I'll cover what it lets you manage, the service discovery file that trips most people up, and the Intune setup end to end.

How it works#

The user enters their work account, a Managed Apple Account, in Settings › General › VPN & Device Management. The device takes the domain part of that account and requests https://<domain>/.well-known/com.apple.remotemanagement. That JSON file points the device to Intune; the user authenticates with Microsoft Entra ID, approves remote management, and the management profile installs silently.

The trade-off is privacy by design:

When the device unenrolls, managed apps are removed and the volume and keys protecting work data are erased. Profile-based User Enrollment with Company Portal is deprecated for new enrollments, so account-driven enrollment is the method to plan for.

Prerequisites#

• iOS/iPadOS 15 or later.
• Intune as MDM authority and an active Apple MDM push certificate (Devices › Enrollment, Apple tab).
• Managed Apple Accounts (previously Managed Apple IDs) in Apple Business, formerly Apple Business Manager. Federating Apple Business with Microsoft Entra ID is strongly recommended, so users sign in with their normal work credentials instead of a separate Apple password.
• A public web server for each domain users sign in with.
• Personally owned iOS/iPadOS devices allowed in Devices › Enrollment › Device platform restriction.

Step-by-step#

1. Publish the service discovery file#

Create a file named com.apple.remotemanagement, with no file extension, containing this JSON. Replace YourAADTenantID with your Microsoft Entra tenant ID, which (Get-MgOrganization).Id returns:

{"Servers":[{"Version":"mdm-byod","BaseURL":"https://manage.microsoft.com/EnrollmentServer/PostReportDeviceInfoForUEV2?aadTenantId=YourAADTenantID"}]}

Publish it at https://contoso.com/.well-known/com.apple.remotemanagement, where contoso.com is the domain in your users' sign-in names, and serve it as application/json. US Government and 21Vianet tenants use a different host in the BaseURL, listed in Microsoft's setup article. If users sign in with several domains, each one needs the file. Test from outside your network:

curl -I "https://contoso.com/.well-known/com.apple.remotemanagement"
curl -I "https://contoso.com/.well-known/com.apple.remotemanagement?user-identifier=first.last@contoso.com&model-family=iPhone"

Good looks like HTTP 200 and Content-Type: application/json for both. Web servers often won't serve extension-less files with the right content type by default, so you may need a MIME mapping or rewrite rule for this one path.

2. Set up JIT registration and Microsoft Authenticator#

Intune uses just-in-time (JIT) registration and Microsoft Authenticator to reduce sign-in prompts during enrollment and when users open work apps. Follow Microsoft's JIT registration article to create the single sign-on app extension profile, and assign it to the same user groups. Then assign Microsoft Authenticator as a Required app. Because Intune supports user-licensed VPP apps on user-enrolled devices, get Authenticator through Apps and Books in Apple Business and assign it with user licensing. If installs stay pending, see iOS/iPadOS apps not installing: VPP tokens and licences.

3. Create the enrollment profile#

1. In the Microsoft Intune admin center, go to Devices › Enrollment, select the Apple tab, then Enrollment types under Enrollment options.
2. Select Create profile › iOS/iPadOS and name it clearly, for example "iOS BYOD account-driven".
3. For Enrollment type, choose Account driven user enrollment. The alternative, Determine based on user choice, asks users who owns the device and, for personal devices, whether to secure the whole device or only work apps and data. For a clear BYOD promise, don't leave that choice to users.
4. Assign the profile to user groups. Device groups aren't supported, because user enrollment needs a user identity.
5. If users fall into several profiles, drag them into order on the Enrollment types list; the higher-priority profile wins.

4. Walk users through enrollment#

1. Open Settings › General › VPN & Device Management.
2. Sign in with the work account, usually their work email address when federation is on.
3. Continue to the iCloud sign-in. With federation, this hands over to the Microsoft Entra sign-in page.
4. Select Allow Remote Management and wait a few minutes while the management profile installs.
5. Approve the install prompts for Microsoft Authenticator and other work apps.

If a user opens a work app before enrolling, the app explains that enrollment is required and how to start it. Put these steps in your onboarding guide.

Verify#

• On the device, VPN & Device Management lists the work account under MANAGED ACCOUNT, and Authenticator is installed.
• In the Intune admin center, the device appears under Devices › iOS/iPadOS with ownership Personal.
• Outlook or another work app signs in through Authenticator, and app protection policies apply; if not, see App protection policies not applying to Outlook mobile.
• Wi-Fi and per-app VPN profiles report Succeeded for the device.

Tips & gotchas#

• "Sign-in Failed" with "Your Apple ID does not support the expected services on this device" means service discovery failed: wrong domain, missing file, a file extension or the wrong content type. Rerun the curl tests.
• Apple Business fallback. From iOS/iPadOS 18.2, if the well-known file can't be fetched, the device can ask Apple Business for an alternative location, but only if the MDM service has configured one for your verified domain (see Apple's account-driven enrollment methods). Host the file anyway.
• Federation side effects. Existing personal Apple Accounts that use your domain are treated as conflicting, and their owners are asked to change them, so warn users first.
• Company-owned devices belong elsewhere. Use Automated Device Enrollment; see Apple ADE devices missing in Intune.
• Check before you promise. Only a subset of restrictions and remote actions applies to user enrollment, so confirm a setting is supported before agreeing to it with your security team.
• Retire is the exit. It removes managed apps and work data and leaves personal data alone, which is exactly the promise you make to users.

References#

• Set up account driven Apple User Enrollment
• Overview of Apple User Enrollment in Microsoft Intune