iOS with Microsoft Endpoint Manager / Intune

Our client like many others allows its users to use iMac and iPad for daily tasks. All types of application installation or changes must be done manually on each device. This individual management poses a problem in terms of time, tracking and security.

The client's objectives were to be able to access enterprise applications and data, secure access to their devices, distribute different applications and OS versions, and have an inventory of their devices.

We have configured Microsoft Azure, Microsoft Endpoint Manager (Intune), as well as Apple Business Manager.

Apple Business Manager est un service fourni par Apple qui permet de déployer des appareils et des applications Apple dans votre organisation. En tirant parti d’Apple Business Manager (ABM), vous pouvez inscrire automatiquement des appareils dans Microsoft Endpoint Manager (Intune) à l’aide de l’inscription automatisée des appareils (ADE). Autrement dit, cela fournit des fonctionnalités similaires à celles fournies par Windows Autopilot pour l’inscription des appareils Windows.

We have integrated Apple Business Manager (ABM) with Azure Active Directoryin order to authenticate withABM using an account Azure AD. We have also configured account synchronization Azure AD with ABM ; from that point on, these will be managed Apple IDs.

This is the first step toward fully integrating ABM into Microsoft Endpoint Manager/Intune, so that we can automatically register devices at macOS/iOS/iPadOS.

 Here is a Macroscopic view of the integration of the different components for this project

 Preparation

• • D-U-N-S number
  • Checking the contacts
  • Creation of various accounts

Enrollment

Configuration ABM

• • Checking the domain
  • Configure and enable federation between Azure and Apple
  • Authentication test

Configuring synchronization between Azure AD and ABM

• Automated Device Registration (ADR):

Customers can easily enroll a large number of Apple devices (iPhone, iPad, MacBook, etc.) without the IT administrator ever having to touch those devices. When the organization orders Apple devices from a participating reseller (or from Apple itself or a mobile carrier), the reseller can immediately add the devices to ABM . Once a connection is established between Microsoft Intune and ABM, the IT administrator can automatically synchronize these devices and assign an enrollment profile to them. This allows the organization to order these Apple devices and simply ship them directly to users. When the devices arrive, users can simply turn them on, and the out-of-the-box experience will guide them through the enrollment process.

• Supervision:

The customer now has a global view of all his Apple devices. The management and supervision of devices, users, applications and configuration is now done centrally

• Volume Purchase Program (VPP):

Customers now have the option to purchase multiple licenses for an app that will be used on Apple devices (iPhone, iPad, MacBook, etc.). Information about app purchases can be synced with Microsoft Intune, which will help track usage. This helps effectively manage apps within the organization and control app-related expenses.

• Managed Apple ID:

Managed Apple IDs are similar to Apple IDs, except that they are owned and managed by the customer. With ABM, an organization can create and manage these accounts at scale for users who need administrative access to ABM. It eliminates the need for personal accounts for work and creates Apple IDs in bulk.