Setup guide · from scratch

Create the Apple ADE (Automated Device Enrolment) program token

ADE builds the trust between Intune and Apple Business Manager so corporate iPhones/iPads enrol themselves out of the box. You swap a public key and a server token between the two. KEEP THE INTUNE TAB OPEN the whole time.

one-time human step · Apple Business Manager + Intune (Devices > Enrollment > Apple mobile)assisted guide — Decolla walks you through this

This is a one-time human step. It runs through Apple Business Manager + Intune (Devices > Enrollment > Apple mobile), which requires an interactive sign-in no MDM or API can perform for you. Decolla keeps it frictionless: the wizard shows these exact steps at the moment you need them, and flags what to bring back (a token, a file, an ID).

Step 1. In Intune go to Devices > Enrollment > Apple mobile tab.

Screenshot: Apple mobile enrollment tab (captured during a live customer build — coming to this page)

Step 2. Under 'Bulk Enrollment Methods' click 'Enrollment program tokens', then 'Add'.

Screenshot: Enrollment program tokens > Add pane (captured during a live customer build — coming to this page)

Step 3. Tick 'I agree', then click 'Download the Intune public key certificate' (.pem). DO NOT close this browser tab — closing it invalidates the file and greys out Create.

Screenshot: Public-key download link with the tab kept open (captured during a live customer build — coming to this page)

Step 4. Click 'Create a token via Apple Business' to open ABM in a NEW tab.

Screenshot: The link that launches Apple Business Manager (captured during a live customer build — coming to this page)

Step 5. In ABM sign in with the ORGANISATION Apple ID (never personal — it is needed yearly to renew).

Screenshot: ABM sign-in (redact the ID) (captured during a live customer build — coming to this page)

Step 6. In ABM go to Preferences > MDM server assignments (newer: Settings > MDM servers) and add an MDM server.

Screenshot: ABM 'Add MDM Server' screen (captured during a live customer build — coming to this page)

Step 7. Name the server (e.g. 'Example Company Intune'), upload the .pem public key, and Save.

Screenshot: Server name + public-key upload field (captured during a live customer build — coming to this page)

Step 8. On the saved server click 'Download Token' to get the server token .p7m file.

Screenshot: 'Download Token' button on the server detail page (captured during a live customer build — coming to this page)

Step 9. In ABM go to Devices, tick the serial numbers, click 'Edit device management' and assign them to your MDM server.

Screenshot: ABM Devices list with 'Edit device management' (captured during a live customer build — coming to this page)

Step 10. Return to the still-open Intune tab and type the ABM Apple ID into the Apple ID field.

Screenshot: Intune token pane Apple ID field (captured during a live customer build — coming to this page)

Step 11. Browse to the .p7m file in the Apple token field, then click Create.

Screenshot: Token pane pre-Create with .p7m selected (captured during a live customer build — coming to this page)

Step 12. Confirm the new token appears in the list with an expiry date.

Screenshot: Enrollment program tokens list showing expiry (captured during a live customer build — coming to this page)

See it on a real device.

Decolla is in private build — early-access members see a build defined, deployed and rolled back first.

Get early access