Setup guides

Every manual step, from scratch

Most of an Intune build can be automated — but Apple and Google each keep a few one-time steps human. These guides walk each one at a no-prior-knowledge level, with the exact screens.

The one-time steps outside Intune

Apple and Google each require a one-time human connection before anything can be automated. These guides take you from a blank account to a working connection — no prior knowledge assumed.

Create your organisation's free Apple Business Manager account — the portal that owns every Apple token and app licence. Needs a brand-new work email and D-U-N-S verification (allow several business days), so start this FIRST. · 10 steps · assisted

Create the Apple MDM Push certificate (required for all Apple management)

The MDM Push certificate is the master key that lets Intune manage ANY iPhone, iPad or Mac. Download a request from Intune, sign it at Apple's push portal, upload it back. Renew yearly with the SAME Apple ID or every device re-enrols. · 7 steps · assisted

Create the Apple ADE (Automated Device Enrolment) program token

ADE builds the trust between Intune and Apple Business Manager so corporate iPhones/iPads enrol themselves out of the box. You swap a public key and a server token between the two. KEEP THE INTUNE TAB OPEN the whole time. · 12 steps · assisted

Download the Apple location (VPP content) token from ABM

The .vpptoken lets Intune push App Store apps silently with no personal Apple ID. It lives in ABM under Payments and Billing > Content Tokens. One token per Location, per MDM; valid 12 months — diarise renewal. · 7 steps · assisted

Get / buy app licences in ABM Apps and Books

Before Intune can deploy an Apple app you must 'Get' its licences in ABM against the SAME Location as your uploaded token. Free apps still need a licence quantity; that count becomes your ceiling in Intune. · 7 steps · assisted

Connect Intune to Managed Google Play (Android Enterprise binding)

One-time, effectively permanent binding that unlocks Android Enterprise. Sign in with an organisational Entra account that has a working mailbox (NOT personal Gmail). Path is Devices > Enrollment > Android > Prerequisites, NOT Connectors and tokens. · 12 steps · assisted

Inside Intune

Everything here is on the automation path — Decolla performs these for you on a connected tenant; the guides exist so you always know exactly what it is doing.

Create the Apple ADE enrolment policy (out-of-box experience)

This policy controls what a corporate iPhone/iPad shows during first-boot setup and locks it to management. Set it as the token's Default Policy or synced devices fail with 'Invalid Profile'. · 11 steps

Upload the VPP/location token into Intune

Creates the Apple VPP connector in Intune from the .vpptoken you downloaded in ABM. The Apple Account you enter MUST exactly match the Managed Apple ID that owns the token or it shows invalid. · 9 steps

Sync the token and assign a VPP app with silent device licensing

After upload, sync so ABM apps appear in Intune, then assign them Required with DEVICE licensing to an Entra group for a silent, Apple-ID-less install. Never mix device and user licensing on the same target. · 7 steps

Deploy Company Portal for iOS as a required VPP app

ADE devices need the VPP/device-licensed Company Portal, NOT the App Store version (which is incompatible with ADE and won't auto-update). Assign it Required with device licensing. · 6 steps

Add a free iOS App Store app by URL (no VPP)

For genuinely free apps where an Apple ID on the device is acceptable, add straight from the App Store — no token needed. Not silent and no licence tracking; paid apps must use VPP. · 7 steps

Approve Managed Google Play store apps (in-Intune iframe)

Approve Android apps in the embedded Google Play store inside Intune — one action both approves and syncs. Set 'keep approved' for new permissions, and remember approving is not enough: you must also assign to a group. · 8 steps