Setup guide · from scratch

Create the Apple ADE enrolment policy (out-of-box experience)

This policy controls what a corporate iPhone/iPad shows during first-boot setup and locks it to management. Set it as the token's Default Policy or synced devices fail with 'Invalid Profile'.

Intune (Devices > Enrollment > Apple mobile > Enrollment program tokens > Enrollment policies)

Step 1. In Intune go to Devices > Enrollment > Apple mobile tab > Enrollment program tokens and pick your token.

Screenshot: Token selected under Enrollment program tokens (captured during a live customer build — coming to this page)

Step 2. Click 'Enrollment policies' (the new experience, not the retiring 'Profiles'), then 'Create policy' > iOS/iPadOS.

Screenshot: Create policy iOS/iPadOS Basics tab (captured during a live customer build — coming to this page)

Step 3. On Basics give it a Name/Description (admin-only), Next.

Screenshot: Basics name/description fields (captured during a live customer build — coming to this page)

Step 4. Optionally pick a STATIC Entra security group for enrolment-time grouping, Next.

Screenshot: Device group step (captured during a live customer build — coming to this page)

Step 5. Choose User Affinity: 'Enroll with User Affinity' (personal-to-user, gets Company Portal) or 'without' (kiosk/shared).

Screenshot: User Affinity selector (captured during a live customer build — coming to this page)

Step 6. If user affinity, set authentication to 'Setup Assistant with modern authentication'.

Screenshot: Authentication method dropdown (captured during a live customer build — coming to this page)

Step 7. Set Supervised = Yes, Locked enrollment = Yes, Await final configuration = Yes.

Screenshot: Supervised / Locked enrollment / Await toggles (captured during a live customer build — coming to this page)

Step 8. Optionally set a device name template such as {{DEVICETYPE}}-{{SERIAL}}.

Screenshot: Device name template field (captured during a live customer build — coming to this page)

Step 9. Under Setup Assistant, set each of the ~40 panes to Show or Hide (hide Passcode/Apple ID panes on iOS 14.5+), then Next > Create.

Screenshot: Setup Assistant Show/Hide pane list (captured during a live customer build — coming to this page)

Step 10. Back on the token click 'Set Default Policy' and choose this policy so every synced device gets it automatically.

Screenshot: Token overview with 'Set Default Policy' (captured during a live customer build — coming to this page)

Step 11. Confirm Enrollment Restrictions > Device Type Restrictions does not block iOS, or ADE shows 'Invalid Profile'.

Screenshot: Device Type Restrictions allowing iOS (captured during a live customer build — coming to this page)

See it on a real device.

Decolla is in private build — early-access members see a build defined, deployed and rolled back first.

Get early access