Tenant foundation & connectors

One-time tenant prerequisites — platform connectors, enrolment tokens, certificate infrastructure — that everything else in the build depends on. Decolla sequences them first, plans them in writing, and tracks the renewals.

Why this matters

Everything downstream of device provisioning rests on a small set of one-time tenant prerequisites, and they fail in expensive ways. Let the Apple APNs MDM push certificate lapse and every enrolled iPhone, iPad and Mac stops responding to management; renew it under a different Apple ID and the entire Apple estate needs wiping and re-enrolling. Leave the MDM auto-enrolment user scope unset and Windows devices join Entra but never actually enrol into Intune — a gap that tends to surface only when the first policy fails to arrive. And with no certificate issuing backend in place, certificate-based Wi-Fi and VPN profiles are undeployable no matter how carefully they were authored. None of this is glamorous work. It is, however, exactly where experienced admins look first, because it is where builds that looked finished quietly break months later.

What a good build does

Decolla puts tenant foundation at the front of the journey: it is the prep phase of the catalogue, sequenced before anything that depends on it. The guided wizard works through the platform connectors and tokens across Apple, Google and Samsung, the auto-enrolment scope, and the config-as-code plumbing — each captured in the written, itemised plan you approve before anything runs, with delivery method and reversibility class stated per item and anything irreversible explicitly flagged. The permission scopes Decolla requests are published before you connect your tenant.

The plan is also honest about boundaries. Apple connectors involve Apple Business Manager and your own Apple ID, so those steps are guided rather than silently automated. The certificate backend is licence-aware: Intune Cloud PKI is an Intune Suite add-on, and the plan tags it as such so nobody discovers a licensing dependency mid-deployment. Token expiry dates feed a renewal-reminder engine at T-45/30/14/7/1 days, because an annual certificate is only safe if someone is reminded well before day zero.

Where it bites people

Two failures recur often enough to be predictable.

• The APNs renewal. The certificate expires annually and must be renewed with the same Apple ID that created it. Renew with a different one and Apple issues a new certificate rather than extending the old, severing management for every enrolled Apple device — the recovery is re-enrolment, not a fix. The T-45 reminder exists precisely so the renewal happens calmly, by the right account, with time to spare.
• The certificate backend gap, found late. Teams author Wi-Fi or VPN profiles that require certificates, then discover nothing in the tenant can issue them — and that the tidy option, Cloud PKI, carries an Intune Suite licence they have not got. Decolla surfaces both dependencies in the plan, before deployment, where they are cheap to resolve.

What's in this section (11 items)

Reversibility: auto reverses when unassigned · reverse reversible with a documented step · irreversible flagged before you approve the plan.