Company phones that set themselves up: iPhone and Android with Intune

A new company phone should reach the employee, get switched on and then be ready for work: with email, Teams, Wi-Fi and the company’s security settings. With Microsoft Intune, Apple Business Manager and Android zero-touch enrolment, this works without a stop at the IT desk. Here I describe how I set it up and where personal phones fit in. The experience comes from rollouts in 2024 and 2025.

Where the time goes without automation

Without device management, setting up a company phone usually goes like this: someone unpacks it, signs in with an Apple ID or a Google account, sets up the mailbox, installs Teams and hands the device over. After that, nobody checks whether the phone has a screen lock or whether the operating system stays up to date. When someone leaves, it is often unclear which accounts are still on the device.

Automated enrolment reverses the order. The settings are ready centrally beforehand, and the device collects them itself as soon as it first goes online.

iPhones: Apple Business Manager and Intune

Apple Business Manager (Apple now calls the service “Apple Business”) is the register of devices the company owns. If you buy from Apple or a participating reseller using your organisation ID, the devices appear there automatically. I connect Apple Business Manager to Intune once and define which enrolment profile new devices receive.

The order matters: I have to assign the enrolment profile to the device before anyone switches it on for the first time. Otherwise setup completes without management and I have to erase the device. That is why I set a default profile that every new device receives automatically.

Android: zero-touch enrolment

On Android the counterpart is called zero-touch. The principle is the same: on first boot the device checks whether it has a company configuration, downloads the Intune app and sets itself up as a fully managed company device. The prerequisite is that it comes from a reseller that takes part in zero-touch. This does not work for devices from ordinary consumer shops.

So before anyone orders devices, I ask which reseller they will come from. Otherwise this is one of the points where a rollout stalls, because someone has already unpacked the phones before the configuration is in place.

Personal phones: protecting company data without managing the device

Many employees read their work email on their own phone. Understandably, hardly anyone wants to put their whole phone under device management. That is what app protection policies are for: they apply not to the device, only to the work account in specific apps such as Outlook, Teams, OneDrive or Word.

• What the policies protect: users cannot copy company data into personal apps or save it there, the apps require their own PIN, and I can remove company data selectively if the phone goes missing or the employee leaves.
• Stays private: IT neither sees nor manages photos, personal apps or personal accounts.
• Prerequisite: Conditional Access is what ensures that company data opens only in protected apps. On Android, the phone also needs the Intune Company Portal app.

I use this split whenever clients allow personal phones: full management for company devices, app-level protection for personal ones.

When devices were bought outside Apple Business Manager

This happens often: someone buys a company iPhone in a high-street shop or privately and expenses it to the company. Apple Business Manager doesn’t know it. I add such devices afterwards with Apple Configurator. For this, the iPhone has to be back in Setup Assistant after an erase, so any data on it disappears unless someone backs it up first.

One thing worth knowing: after handover, the user has 30 days to release a device added this way from management. After that it behaves like any other company device. For new devices I therefore recommend organising purchasing through a channel that registers devices in Apple Business Manager automatically.

When is Intune worth it for company phones?

From around ten devices I almost always recommend device management. The threshold is not a technical one, though. If nobody in the company makes sure phones stay up to date and locked, and that someone can wipe them if they go missing, management makes sense from the very first device. With Intune, getting started is manageable today, not least because Microsoft 365 Business Premium already includes it.

I describe how Intune differs from specialist Apple solutions such as Mosyle, Jamf or Iru, and when another system is the better fit, in my comparison of MDM systems.

Frequently asked questions

Does this also work with employees’ personal phones?

Yes, but I don’t put personal phones fully under management. There, app protection policies protect only the work account in apps such as Outlook, Teams, OneDrive or Word. IT neither sees nor manages photos, personal apps or personal accounts.

Does zero-touch work with any Android phone?

No. The device has to come from a reseller that takes part in zero-touch. Devices from ordinary consumer shops cannot enrol this way, so before anyone orders, I ask which reseller the company buys from.

Can I add an iPhone from a high-street shop as a company device later?

Yes, I add it to Apple Business Manager afterwards with Apple Configurator. This requires erasing the iPhone, so any data on it needs backing up first. After handover, the user can still release the device from management for 30 days.

Sources

• Automated enrolment of iPhones and iPads in Intune: Microsoft Learn – Tutorial: Set up Intune enrollment for iOS/iPadOS devices in Apple Business
• Zero-touch enrolment for Android in Intune: Microsoft Learn – Enroll Android Enterprise devices
• Zero-touch from Google’s side, purchase through participating resellers: Android Enterprise Help – Zero-touch enrollment for IT admins
• App protection policies without device management: Microsoft Learn – App Protection Policies Overview
• Adding devices with Apple Configurator, 30-day provisional period: Apple Business – Add devices using Apple Configurator
• Supervised devices: Apple Platform Deployment – About Apple device supervision