26:37
The Ultimate Guide to Managing Apple Devices in Microsoft Intune
Jonathan Edwards
Overview
This video provides a comprehensive guide on managing Apple devices (iPhones, iPads, and Macs) within the Microsoft 365 ecosystem using Microsoft Intune and Apple Business Manager. It covers the essential setup steps, including creating an Apple Push Certificate and connecting Intune to Apple Business Manager. The guide also details how to deploy applications, add existing devices using Apple Configurator, and configure enrollment profiles for a seamless user experience. Finally, it touches upon enhancing security through configuration profiles and managing software updates for Apple devices, offering a structured approach for businesses to effectively manage their Apple fleet.
How was this?
Save this permanently with flashcards, quizzes, and AI chat
Chapters
- Businesses can effectively manage Apple devices like Macs, iPhones, and iPads using Microsoft Intune and Apple Business Manager.
- This integration is crucial for installing applications, updating devices, and maintaining security.
- Prerequisites include a Microsoft 365 license with Intune capabilities and a verified Apple Business Manager account.
- The methods shown are for corporate-owned devices, not personal devices, which require a different approach.
Understanding the necessity and prerequisites for managing Apple devices ensures a smooth setup and avoids compatibility issues, allowing businesses to leverage their existing Apple hardware within the Microsoft ecosystem.
A business that equips all employees with iPhones for work and needs to install Microsoft 365 apps and enforce security policies on these devices.
- An Apple MDM push certificate is required to enable Intune to communicate with Apple devices.
- This involves downloading a Certificate Signing Request (CSR) from Intune's Endpoint Manager.
- The CSR is then uploaded to Apple's website using a business Apple ID to create the push certificate.
- The created certificate must be uploaded back into Intune, and it is valid for 12 months, requiring renewal.
The Apple Push Certificate acts as the secure bridge between Intune and Apple's services, enabling Intune to send commands and policies to Apple devices. Without it, device management functionalities will be unavailable.
Generating a certificate in the Microsoft Endpoint Manager admin center, downloading a CSR, uploading it to the Apple Push Certificates portal, and then uploading the resulting .pem file back into Intune.
- Connecting Intune to Apple Business Manager allows for automated device enrollment and management.
- This involves downloading a public key from Intune and uploading it to Apple Business Manager to create an MDM server token.
- The generated token from Apple Business Manager is then uploaded back into Intune.
- A successful connection enables Intune to recognize and manage devices assigned to the Apple Business Manager account.
This integration automates the enrollment of devices into Intune as they are assigned to your Apple Business Manager account, significantly simplifying the onboarding process for new or existing devices.
Creating an enrollment program token in Intune, downloading the public key, uploading it to Apple Business Manager under MDM server preferences, and then downloading the server token from Apple to upload back into Intune.
- To deploy apps, a VPP (Volume Purchase Program) connector token must be created in Intune.
- This token is generated by downloading a content token from Apple Business Manager's Payments and Billing section.
- Apps are then selected and assigned licenses within Apple Business Manager and synced to Intune.
- Once synced, these applications can be assigned to users or devices through Intune policies.
Using the VPP connector allows businesses to silently deploy applications to Apple devices without requiring users to enter their personal Apple IDs, ensuring a consistent and controlled app environment.
Adding Microsoft Office apps like Outlook and Word to Apple Business Manager, assigning licenses, syncing them to Intune, and then assigning them as 'required' apps to all users.
- New devices purchased directly from Apple or authorized resellers can be automatically assigned to your Apple Business Manager account.
- Existing devices that have already been purchased need to be added manually using the Apple Configurator app on an iPhone.
- Adding existing devices requires them to be reset to factory defaults.
- Apple Configurator links the device to your Apple Business Manager account and configures Wi-Fi and MDM server settings during the process.
Properly adding devices to Apple Business Manager is the first step in enabling automated enrollment and management through Intune, ensuring that all corporate-owned Apple devices are recognized and controllable.
Using the Apple Configurator app on an iPhone to scan a factory-reset iPhone, which then automatically enrolls it into the business's Apple Business Manager account and assigns it to the configured MDM server.
- Enrollment profiles in Intune define how a device is registered and the user's setup experience.
- Profiles with 'user affinity' link the device to a specific user's Microsoft 365 account for authentication.
- The Company Portal app is installed silently via VPP, and the profile can lock management settings to prevent removal.
- Users can be guided through a simplified setup, choosing which system settings (like Passcode, Face ID) they can configure.
Enrollment profiles streamline the device setup process for end-users, ensuring devices are correctly configured, associated with the right user, and managed by Intune from the first boot.
Creating an iOS enrollment profile that requires user authentication via Company Portal, installs the Company Portal app automatically, locks the management profile, and allows the user to set up their Face ID but not disable other management features.
- Configuration profiles allow administrators to enforce specific device settings and restrictions.
- These can range from blocking features like the camera to enforcing password policies or disabling AirPlay.
- Update policies can be created to manage the installation of iOS, iPadOS, and macOS updates.
- Updates can be scheduled or set to install automatically upon device check-in, ensuring devices remain secure and up-to-date.
Implementing configuration profiles and update policies is critical for maintaining a secure and compliant device fleet, protecting sensitive data and ensuring devices are running the latest security patches.
Creating a configuration profile to block the camera on all company iPhones and a separate update policy to ensure all iPhones and iPads automatically download and install the latest iOS updates within a defined maintenance window.
Key takeaways
- Microsoft Intune and Apple Business Manager are powerful tools for managing Apple devices in a business environment.
- A properly configured Apple Push Certificate is essential for Intune to communicate with Apple devices.
- Automated device enrollment is achieved by linking Intune with Apple Business Manager.
- Applications can be silently deployed to Apple devices using VPP tokens and Intune assignments.
- Existing Apple devices can be added to Apple Business Manager, but they must be factory reset and managed via Apple Configurator.
- Enrollment profiles dictate the user experience and ensure devices are correctly set up and managed by Intune.
- Configuration profiles and update policies are vital for securing devices and keeping them up-to-date.
Key terms
Microsoft IntuneApple Business ManagerApple Push CertificateCertificate Signing Request (CSR)MDM Server TokenVPP (Volume Purchase Program) ConnectorApple ConfiguratorEnrollment ProfileUser AffinityCompany Portal AppConfiguration ProfileUpdate Policy
Test your understanding
- What is the primary purpose of an Apple Push Certificate in Intune?
- How does connecting Intune to Apple Business Manager facilitate device management?
- What steps are necessary to deploy applications to iPhones using Intune and Apple Business Manager?
- What is the prerequisite for adding existing Apple devices to Apple Business Manager, and what tool is used?
- How do enrollment profiles in Intune influence the end-user experience when setting up a new device?