You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Intune lets you manage your workforce's devices and apps and how they access your company data. To use this mobile device management (MDM), the devices must first be enrolled in the Intune service. When a device is enrolled, it's issued an MDM certificate. This certificate is used to communicate with the Intune service.
38
+
To use Microsoft Intune as your mobile device management (MDM) provider, you must enroll devices in Intune using a supported enrollment method. Enrollment sets up and secures the device so that it aligns with your organization's policies and is suitable for use at work or school. Intune deploys and enforces policies through a management profile, which is installed on the device during enrollment. Enrollment is enabled for all platforms by default.
39
+
40
+
Microsoft Intune supports Android, macOS, iOS, and Windows devices. Some enrollment methods require you, as the IT administrator, to initiate enrollment while other methods require your employees or students to initiate it. This article provides an overview of the types of devices and enrollment methods that Intune supports.
41
+
42
+
## Supported device types
43
+
Microsoft Intune enables mobile device management for:
44
+
* Personal devices, which includes personally-owned phones, tablets, and PCs.
45
+
* Corporate-owned devices, which includes phones, tablets, and PCs owned by your organization and distributed to employees and students for use at work or school.
39
46
40
-
As you can see in the following tables, there are several methods to enroll your workforce's devices. Each method depends on the device's ownership (personal or corporate), device type (iOS, Windows, Android), and management requirements (resets, affinity, locking).
47
+
### Personal devices
48
+
Intune supports *Bring-your-own-device*, or *BYOD*, enrollment, which allows employees and students to use their personal devices for work or school. As the admin, you're required to add device users to Microsoft Intune, configure their enrollment experience, and set up device policies. Enrollment is done by the device user. To enroll, they simply need to install and run the Company Portal app on their device.
41
49
42
-
By default, devices for all platforms are allowed to enroll in Intune. However, you can [restrict devices by platform](enrollment-restrictions-set.md#create-a-device-platform-restriction) in Intune.
50
+
> [!NOTE]
51
+
> Intune marks devices that are Azure AD-registered as personally-owned devices.
|Method used to enroll devices. |If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. |More information about method. |
49
-
|**[BYOD](#bring-your-own-device)**| No| Yes | No |[More information](apple-mdm-push-certificate-get.md)|
50
-
|**[DEM](#device-enrollment-manager)**| No |No |No |[More information](device-enrollment-manager-enroll.md)|
|Method used to enroll devices. |If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. |More information about method. |
60
-
|**[BYOD](#bring-your-own-device)**| No| Yes | No |[More information](macos-enroll.md)|
61
-
|**[DEM](#device-enrollment-manager)**| No |No |No |[More information](device-enrollment-manager-enroll.md)|
|Method used to enroll devices. | If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. | More information about method. |
69
-
|**[BYOD](#bring-your-own-device)**| No | Yes | No |[More information](windows-enroll.md)|
70
-
|**[DEM](#device-enrollment-manager)**| No |No |No |[More information](device-enrollment-manager-enroll.md)|
71
-
|**Auto-enroll**| No |Yes |No |[More information](windows-enroll.md#enable-windows-automatic-enrollment)|
|Name of enrollment type. |Method used to enroll devices.| If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. |More information about method. |
84
-
|**Android Device Admin**|**User initiated via Company Portal**| No | Yes | No |[More information](../user-help/enroll-device-android-company-portal.md)|
85
-
|**Android Enterprise personally-owned with Work Profile**|**User initiated via Company Portal**| No | Yes | No |[More information](android-work-profile-enroll.md)|
65
+
For information about corporate identifiers and changing ownership status, see [Identify devices as corporate-owned](corporate-identifiers-add.md).
|Name of enrollment type. |Method used to enroll devices.| If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. |More information about method. |
92
-
|**Android (AOSP) user-associated**|**QR code**|Yes|Yes|Configurable via policy|[More information](../enrollment/android-aosp-corporate-owned-user-associated-enroll.md)
93
-
|**Android (AOSP) userless**|**QR code**|Yes|No|Configurable via policy|[More information](../enrollment/android-aosp-corporate-owned-userless-enroll.md)
94
-
|**Android Device Admin**|**[DEM](#device-enrollment-manager) initiated via Company Portal**| No | No | No |[More information](device-enrollment-manager-enroll.md)|
95
-
|**Android Device Admin**|**(Pre-declared IMEI or SN) User initiated via Company Portal**| No | Yes | No |[More information](corporate-identifiers-add.md)|
96
-
|**Android Device Admin with Zebra Mobility Extensions**|**User or [DEM](#device-enrollment-manager) initiated via Company Portal**| No | Yes if user initiated, No if [DEM](#device-enrollment-manager) initiated | No |[More information](../configuration/android-zebra-mx-overview.md)|
97
-
|**Android Enterprise Dedicated**|**NFC, Token, QR code, Zero Touch**| Yes | No | Configurable via policy |[More information](android-kiosk-enroll.md)|
98
-
|**Android Enterprise Fully Managed**|**NFC, Token, QR code, Zero Touch**| Yes | Yes | Configurable via policy |[More information](android-dedicated-devices-fully-managed-enroll.md)|
99
-
|**Android Enterprise corporate-owned with Work Profile**|**NFC, Token, QR code, Zero Touch**| Yes | Yes | Configurable via policy |[More information](android-corporate-owned-work-profile-enroll.md)|
69
+
Enrollment options vary by operating system (OS). When selecting a method, choose one that works with the devices and features you want to support. The tables in this section compare the methods available for each OS. The columns in each table show:
100
70
101
-
## Bring your own device
71
+
* Method: The enrollment method used to enroll devices in Intune.
72
+
* Enrollment type (Android only): The name of the Android enrollment type.
73
+
* Reset required: Tells you if devices are reset to factory default settings during enrollment. Options:
74
+
***Yes**: Existing data is wiped from devices during enrollment.
75
+
***No**: Existing data is retained on devices during enrollment.
76
+
* User affinity: Tells you whether devices are associated with users during enrollment. Options:
77
+
***Yes**: Each device is associated with an Intune-licensed user.
78
+
***No**: Devices aren't associated with a user during enrollment, which is a typical configuration for kiosk, point of sale (POS), or shared-utility devices.
79
+
***Optional**: Microsoft Intune makes this setting available for you to configure on your own.
80
+
* MDM profile removeable: Tells you if users can remove the MDM profile from an enrolled device. Options:
81
+
***Yes**: Device users cannot unenroll devices. If
82
+
***No**: Device users can unenroll devices.
83
+
***Configurable via policy** (Android Enterprise only): There is a setting in Intune that lets you block factory resets on devices, which prevents users from unenrolling their devices, but it is not configured by default.
102
84
103
-
Bring your own devices (BYOD) include personally-owned phones, tablets, and PCs. Users install and run the Company Portal app to enroll BYODs. This program lets users access company resources like email.
85
+
### iOS/iPadOS enrollment methods
86
+
You can use the following enrollment methods with iOS/iPadOS devices:
104
87
105
-
## Corporate-owned device
88
+
* Bring-your-own-device (BYOD)
89
+
* Device enrollment manager
90
+
* Apple Automated Device Enrollment
91
+
* Setup Assistant enrollment via USB
92
+
* Direct enrollment via USB
106
93
107
-
[Corporate-owned devices (COD)](corporate-identifiers-add.md) include phones, tablets, and PCs owned by the organization and distributed to the workforce. COD enrollment supports scenarios like automatic enrollment, shared devices, or pre-authorized enrollment requirements. A common way to enroll CODs is for an administrator or manager to use the device enrollment manager (DEM). iOS/iPadOS devices can be enrolled directly through the ADE tools that are provided by Apple. Devices with an IMEI number can also be identified and tagged as corporate-owned.
|Setup Assistant enrollment via USB| Yes | Optional | No|
100
+
|Direct enrollment via USB| No | No | No|
108
101
109
-
### Device enrollment manager
102
+
For more information about the iOS/iPadOS enrollment methods supported in Intune, see [Enroll iOS/iPadOS devices](ios-enroll.md).
110
103
111
-
Device enrollment manager (DEM) is a special user account that's used to enroll and manage multiple corporate-owned devices. Managers can install the Company Portal and enroll many user-less devices. These types of devices are good for point-of-sale or utility apps, for example, but not for users who need to access email or company resources. Learn more about [DEM](device-enrollment-manager-enroll.md).
104
+
### macOS enrollment methods
105
+
You can use the following enrollment methods with macOS devices:
112
106
113
-
### Apple Automated Device Enrollment
107
+
* Bring-your-own-device (BYOD)
108
+
* Device enrollment manager
109
+
* Apple Automated Device Enrollment
114
110
115
-
Apple Automated Device Enrollment (ADE) management lets you create and deploy policy "over the air" to iOS/iPadOS and macOS devices that are purchased and managed with ADE. The device is enrolled when users turn on the device for the first time and run Setup Assistant. This method supports iOS/iPadOS supervised mode, which enables a device to be configured with specific functionality.
For more information about the macOS enrollment methods supported in Intune, see [Set up enrollment for macOS devices](macos-enroll.md).
118
118
119
-
-[Choose how to enroll iOS/iPadOS devices](ios-enroll.md)
120
-
-[Enroll iOS/iPadOS devices using Device Enrollment Program](device-enrollment-program-enroll-ios.md)
119
+
### Windows enrollment methods
120
+
You can use the following enrollment methods with devices running Windows:
121
121
122
-
### USB-SA
122
+
* Bring-your-own-device (BYOD)
123
+
* Device enrollment manager
124
+
* Automatic enrollment via MDM
125
+
* Automatic enrollment via Group Policy
126
+
* Windows Autopilot
127
+
* Bulk enrollment
128
+
* Co-management with Microsoft Intune and Configuration Manager
123
129
124
-
IT admins use Apple Configurator, through USB, to prepare each corporate-owned device manually for enrollment using Setup Assistant. The IT admin creates an enrollment profile and exports it to Apple Configurator. When users receive their devices, they're then prompted to run Setup Assistant to enroll their device. This method supports **iOS supervised** mode, which in turn enables the following features:
|Automatic enrollment via Group Policy|No |Yes |No |
136
+
|Windows Autopilot |Yes |Yes |No |
137
+
|Bulk enrollment |No |No |No |
138
+
|Co-management |No |Yes |No |
125
139
126
-
- Locked enrollment
127
-
- Kiosk mode and other advanced configurations and restrictions
140
+
For more information about the Windows enrollment methods supported in Intune, see [Enrollment methods for Windows devices ](windows-enrollment-methods.md).
141
+
142
+
### Android enrollment methods
143
+
144
+
To select the appropriate enrollment method for Android devices, consider the enrollment type you'll use and the device's ownership status (personal versus corporate-owned). For more information about the Android enrollment methods supported in Intune, see [Enroll Android devices](android-enroll.md).
145
+
146
+
#### Personal Android devices
147
+
You can set up user-initiated enrollment for people who want to use their personal devices at work or school. Employees and students initiate enrollment by signing into the Company Portal app with their work or school account. Intune supports personal devices within the following enrollment types:
148
+
149
+
* Android Device Administrator (also referred to as *Android Device Admin*)
150
+
* Android Enterprise, personal owned with a work profile
|Android Device Admin|User-initiated via Company Portal | No | Yes | No |
155
+
|Android Enterprise, personal-owned with work profile|User-initiated via Company Portal| No | Yes | No |
128
156
129
-
Learn more about iOS/iPadOS Apple Configurator enrollment with Setup Assistant:
157
+
#### Corporate-owned Android devices
158
+
You can use the following methods in Microsoft Intune to enroll corporate-owned Android devices.
130
159
131
-
-[Decide how to enroll iOS/iPadOS devices](ios-enroll.md)
132
-
-[Enroll iOS/iPadOS devices with Configurator and Setup Assistant](apple-configurator-enroll-ios.md)
160
+
* QR code
161
+
* Device enrollment manager (DEM) with Company Portal
162
+
* User initiated with Company Portal
163
+
* NFC
164
+
* Token
165
+
* Zero Touch
133
166
134
-
### USB-Direct
135
-
For direct enrollment, the admin must enroll each device manually by creating an enrollment policy and exporting it to Apple Configurator. USB-connected, corporate-owned devices are enrolled directly and don't require a wipe. Devices are managed as user-less devices. They're not locked or supervised and can't support Conditional Access, jailbreak detection, or mobile application management.
|Android (AOSP) user-associated|QR code|Yes|Yes|Configurable via policy|
170
+
|Android (AOSP) userless|QR code|Yes|No|Configurable via policy|
171
+
|Android Device Admin|DEM-initiated via Company Portal**| No | No | No |
172
+
|Android Device Admin|User-initiated via Company Portal with pre-declared IMEI or serial number | No | Yes | No |
173
+
|Android Device Admin with Zebra Mobility Extensions|User or DEM-initiated via Company Portal**| No | Yes if user-initiated; no if DEM-initiated | No |
174
+
|Android Enterprise Dedicated|NFC, token, QR code, Zero Touch| Yes | No | Configurable via policy |
175
+
|Android Enterprise Fully Managed|NFC, token, QR code, Zero Touch| Yes | Yes | Configurable via policy |
176
+
|Android Enterprise corporate-owned with work profile| NFC, token, QR code, Zero Touch | Yes | Yes | Configurable via policy |
136
177
137
-
To learn more about iOS/iPadOS enrollment, see:
178
+
## Mobile device cleanup after MDM certificate expiration
138
179
139
-
-[Decide how to enroll iOS/iPadOS devices](ios-enroll.md)
140
-
-[Enroll iOS/iPadOS devices with Configurator and direct enrollment](apple-configurator-enroll-ios.md)
180
+
The MDM certificate renews automatically as long as enrolled devices are communicating with the Microsoft Intune service. The MDM certificate doesn't renew for devices that have been wiped, or that fail to sync with Microsoft Intune for an extended period of time. Microsoft Intune deletes idle devices from record 180 days after the MDM certificate expires.
141
181
142
-
## Mobile device cleanup after MDM certificate expiration
182
+
## Next steps
143
183
144
-
The MDM certificate is renewed automatically when mobile devices are communicating with the Intune service. If mobile devices are wiped, or they fail to communicate with the Intune service for some period of time, the MDM certificate isn't renewed. The device is removed from the Azure portal 180 days after the MDM certificate expires.
184
+
You can adjust the settings in Intune to restrict specific platforms from enrolling. For more information, see [Create a device platform restriction](enrollment-restrictions-set.md#create-a-device-platform-restriction).
0 commit comments