ABM–Intune sync silently fails until someone signs Apple's new terms

Every major Apple OS release usually ships a fresh set of Apple Business Manager terms and conditions. Until an ABM Administrator accepts them, Intune receives T_C_NOT_Signed from Apple and token sync quietly stalls — sometimes disguised as an "assigned to external MDM" error.

The problem

It is Apple release week. iOS (or iPadOS, or macOS) has just shipped a major version, and suddenly your Intune tenant cannot talk to Apple Business Manager. New devices stop appearing from Automated Device Enrollment, enrolment programme token syncs fail, and Apps and Books (VPP) licensing goes stale. Nothing paged you — the failure is silent until someone tries to enrol a device or notices the token status.

Microsoft's Intune support team describes it plainly in their support tip:

"Managed devices will not be able to sync with Intune until the new Apple T&C is accepted. The Intune service receives the error T_C_NOT_Signed from Apple."

The error you actually see is not always that clear. One admin reported on Microsoft Q&A that after iOS 18 shipped, "10 minutes later the MDM error said the device was assigned to an external MDM" — a thoroughly misleading message for what is really an unsigned-terms lockout.

Who hits it: any organisation managing Apple devices through Intune with an ABM (or Apple School Manager) connection. It clusters around Apple's September release week and major point releases. The worst variant hits organisations where the only person holding the ABM Administrator role has left the company — then nobody can accept the terms, and everything Apple-side stays stalled.

Why it happens

Apple typically publishes updated Apple Business Manager terms and conditions alongside each major OS release. Acceptance is a legal act, so Apple gates it behind role permissions: only a user holding the Administrator role in ABM can accept the new terms at business.apple.com. Device Enrollment Managers and other lesser roles cannot.

Until the terms are accepted, Apple's servers refuse service requests from your MDM. Intune's connections to Apple — the Automated Device Enrollment (ADE) enrolment programme token and the Apps and Books (VPP) token — fail their syncs, and Intune records the Apple-side error T_C_NOT_Signed.

Three properties make this failure mode nasty in practice:

• It is silent. There is no proactive alert. Token sync simply starts failing, and you find out when enrolment breaks or someone checks the token blade.
• The surfaced errors can mislead. As in the report above, the lockout can present as device-assignment errors ("assigned to an external MDM") rather than anything mentioning terms and conditions, sending admins down the wrong diagnostic path.
• The unblock is gated to a person, not a team. If your sole ABM Administrator has left or is unreachable, no amount of Intune-side work fixes it — and recovering Administrator access through Apple is not instant.

The diagnostic tell is timing: sudden Apple-side sync errors in the same week as a major Apple OS release are almost always this, not a genuine enrolment or assignment fault.

The fix

1. Confirm the diagnosis in Intune. In the Intune admin centre, check Devices > iOS/iPadOS > iOS/iPadOS enrollment > Enrollment program tokens and Tenant administration > Connectors and tokens. Look at the last-sync status on your ADE token(s) and Apps and Books token(s). A terms-related failure (or T_C_NOT_Signed) in Apple release week confirms it.
2. Accept the terms in ABM. Sign in to business.apple.com as a user with the Administrator role. The new terms are presented at sign-in; read and accept them. This is the whole fix on the Apple side — about two minutes, for the right person.
3. Re-sync the tokens in Intune. Back in the Intune admin centre, trigger a sync on each ADE token and on the Apps and Books token. Give it a few minutes and confirm the status returns to healthy. Enrolments that were queuing behind the lockout should start flowing again.
4. If sync still fails after acceptance, check that the Apple ID that owns each token is still an active ABM account, and renew the token if it has expired in the meantime — an expired token is the other classic release-week casualty.
5. If nobody in the business can accept — the Administrator left — contact Apple Business Support to recover Administrator access. Recovery is not instant, so start it the moment you discover the gap rather than after the next release.

Prevent the repeat

• Keep at least two people in the ABM Administrator role, and make ABM access part of your leaver process for IT staff.
• Put Apple release week on the maintenance calendar as a standing event: sign in to ABM, accept any new terms, then verify ADE and VPP token sync in Intune. Ten minutes of routine beats a mystery outage.
• Teach the tell to the helpdesk: "Apple-side sync errors in Apple release week — check the terms first," before anyone starts re-enrolling devices or rebuilding tokens.

How Decolla handles it

Straight answer: Decolla does not solve this one. Decolla provisions Windows devices over your own Intune and Autopilot tenant — it never touches Apple Business Manager, and no product can accept Apple's terms on your behalf. Accepting new ABM terms is a two-minute human job reserved for an ABM Administrator, which is exactly why the prevention steps above matter more than tooling here: treat Apple release week as a known maintenance event on your own calendar — check the T&C, then verify token sync — and keep two people in the Administrator role.

What Decolla does share is the design stance this article argues for: nothing should fail silently, and nothing should hinge on undocumented state in one person's head. On the Windows side of your estate, Decolla writes out an itemised plan — delivery method and reversibility class per item — for approval before anything runs, deploys unattended in your own tenant, and offers per-item rollback of the changes Decolla itself made. Its Library of pre-built, industry-tested policies, scripts and fixes exists precisely to turn recurring, rediscovered-every-time problems into documented routine — the same treatment your Apple release-week checklist deserves.

Decolla is pre-launch and waitlist-only; this knowledge base is part of how we work in the open.

Sources

• Microsoft Intune Customer Success — Support tip: Accept Apple's new T&C to ensure Intune can communicate with Apple
• Microsoft Q&A — Issues with Intune and Apple Business Manager