Setup guide · from scratch
Create the Apple ADE (Automated Device Enrolment) program token
ADE builds the trust between Intune and Apple Business Manager so corporate iPhones/iPads enrol themselves out of the box. You swap a public key and a server token between the two. KEEP THE INTUNE TAB OPEN the whole time.
≈ 20 min
Apple — iPhone, iPad & Mac · step 3 of 12 · ≈ 20 min‹ PreviousNext ›
Do these first — this guide assumes you already have:
The Decolla way — the one bit no tool can click for you.
Apple Business Manager + Intune (Devices > Enrollment > Apple mobile) needs a human to sign in, so this stays manual on purpose. Decolla makes it painless: the wizard shows these exact screens at the moment you need them and flags precisely what to bring back — a token, a file, an ID — so the automated steps either side of it run without a hitch.
⏱ A genuine human step — Decolla cuts the coordination around it, not the sign-in itself.
Before you start
- Intune sign-in with a role that can add enrolment program tokens (Intune Administrator).
- The organisation Apple ID and password that owns Apple Business Manager — never a personal one, as it's needed to renew yearly.
- Administrator rights inside ABM so you can add an MDM server and assign devices.
- Your device serial numbers already present in ABM, ready to assign to the new server.
The steps
- In Intune go to Devices > Enrollment > Apple mobile tab.
- Under 'Bulk Enrollment Methods' click 'Enrollment program tokens', then 'Add'.
- Tick 'I agree', then click 'Download the Intune public key certificate' (.pem). DO…
- Click 'Create a token via Apple Business' to open ABM in a NEW tab.
- In ABM sign in with the ORGANISATION Apple ID (never personal — it is needed yearly…
- In ABM go to Preferences > MDM server assignments (newer: Settings > MDM servers)…
- Name the server (e.g. 'Example Company Intune'), upload the .pem public key, and…
- On the saved server click 'Download Token' to get the server token .p7m file.
- In ABM go to Devices, tick the serial numbers, click 'Edit device management' and…
- Return to the still-open Intune tab and type the ABM Apple ID into the Apple ID…
- Browse to the .p7m file in the Apple token field, then click Create.
- Confirm the new token appears in the list with an expiry date.
0 of 12 done
Step 1. In Intune go to Devices > Enrollment > Apple mobile tab.
Screenshot: Apple mobile enrollment tab (captured during a live customer build — coming to this page)
Why: Devices > Enrollment > Apple mobile is the single hub for every Apple enrolment method — you'll return here to build the policy and check sync status, so learn the path now.
Step 2. Under 'Bulk Enrollment Methods' click 'Enrollment program tokens', then 'Add'.
Screenshot: Enrollment program tokens > Add pane (captured during a live customer build — coming to this page)
Why: The token you're about to create is what lets Apple hand corporate devices to Intune automatically at first boot, instead of a person enrolling each one by hand.
Don’t: Do NOT confuse 'Enrollment program tokens' with the older 'Profiles' area — the token is the trust record, the profile is what devices see later.
If this step errors: Apple tokens in Intune: APNs, ADE and VPP renewal explained
Step 3. Tick 'I agree', then click 'Download the Intune public key certificate' (.pem). DO NOT close this browser tab — closing it invalidates the file and greys out Create.
Screenshot: Public-key download link with the tab kept open (captured during a live customer build — coming to this page)
Why: The .pem is half of the trust handshake — Apple uses it to encrypt the server token so that only this exact Intune tenant can ever read it.
Watch for: Create stays greyed out on purpose until you return with the matching .p7m — that's expected, not a fault.
Don’t: Do NOT close or refresh this tab — the instruction is explicit: it invalidates the downloaded .pem and permanently greys out Create, forcing a fresh start.
Step 4. Click 'Create a token via Apple Business' to open ABM in a NEW tab.
Screenshot: The link that launches Apple Business Manager (captured during a live customer build — coming to this page)
Why: Opening ABM in a NEW tab is deliberate — the original Intune tab must stay alive to accept the server token at the end.
Don’t: Do NOT let ABM load over the top of the Intune tab — use the new tab so the original stays open.
Step 5. In ABM sign in with the ORGANISATION Apple ID (never personal — it is needed yearly to renew).
Screenshot: ABM sign-in (redact the ID) (captured during a live customer build — coming to this page)
Why: This organisation (Managed) Apple ID becomes the permanent owner of the token; whoever holds it is the only account that can renew it each year.
Watch for: If sign-in bounces to your company's identity provider or throws an Apple ID conflict, this address has probably been used as a personal Apple ID — untangle that first.
Don’t: Do NOT sign in with a personal or an individual employee's Apple ID — when they leave you lose the ability to renew and every ADE device stops enrolling.
On a schedule: The token this account owns expires 12 months from creation — set the renewal reminder against this shared organisation account, never a personal calendar.
If this step errors: ABM federation Apple ID conflicts: the 60-day rename
Step 6. In ABM go to Preferences > MDM server assignments (newer: Settings > MDM servers) and add an MDM server.
Screenshot: ABM 'Add MDM Server' screen (captured during a live customer build — coming to this page)
Why: An 'MDM server' in ABM is Apple's name for your Intune tenant — this record is what devices ultimately get pointed at.
Watch for: The menu name shifts by ABM version — Preferences > MDM server assignments on older tenants, Settings > MDM servers on newer ones — but both add the same thing.
Step 7. Name the server (e.g. 'Example Company Intune'), upload the .pem public key, and Save.
Screenshot: Server name + public-key upload field (captured during a live customer build — coming to this page)
Why: Uploading the .pem here completes Apple's side of the handshake and unlocks the matching server token for download.
Watch for: Give it a name you'll still recognise months later — you may run several MDM servers in one ABM, and device assignment in step 9 picks the target by this exact name.
Don’t: Do NOT upload an old or wrong .pem — the token you download will only decrypt inside the exact Intune tab that generated this key.
Step 8. On the saved server click 'Download Token' to get the server token .p7m file.
Screenshot: 'Download Token' button on the server detail page (captured during a live customer build — coming to this page)
Why: The .p7m is the other half of the trust — Intune reads it to prove it is the MDM server Apple has just registered.
Watch for: Treat the .p7m as a secret; anyone holding it plus the Apple ID could bind your devices to a different MDM.
Step 9. In ABM go to Devices, tick the serial numbers, click 'Edit device management' and assign them to your MDM server.
Screenshot: ABM Devices list with 'Edit device management' (captured during a live customer build — coming to this page)
Why: A token on its own enrols nothing — devices only flow into Intune once their serial numbers are assigned to this MDM server here.
Watch for: Serials only appear if the devices were bought through Apple or an Apple-authorised reseller and linked to your ABM — retail or grey-market units simply won't be in the list.
Don’t: Do NOT assume new devices are auto-assigned — assignment is manual (or via a default), and any unassigned serial never reaches Intune.
If this step errors: Retail-bought devices don't appear in Apple Business Manager
Step 10. Return to the still-open Intune tab and type the ABM Apple ID into the Apple ID field.
Screenshot: Intune token pane Apple ID field (captured during a live customer build — coming to this page)
Why: Intune stores which Apple ID owns the token so it can warn you ahead of the yearly expiry.
Watch for: It must be the exact same organisation Apple ID you signed into ABM with in step 5 — a typo or a different account fails validation.
Don’t: Do NOT open a fresh Intune tab to do this — use the original tab from step 3, or the .pem no longer matches and Create stays greyed out.
Step 11. Browse to the .p7m file in the Apple token field, then click Create.
Screenshot: Token pane pre-Create with .p7m selected (captured during a live customer build — coming to this page)
Why: This uploads the server token and finalises the two-way trust — from here Apple and Intune recognise each other.
Watch for: If Create is still greyed out, the tab was closed or refreshed somewhere along the way — you'll have to redo it from the public-key download in step 3.
Don’t: Do NOT upload the .pem here by mistake — this field wants the .p7m server token you downloaded from ABM.
Step 12. Confirm the new token appears in the list with an expiry date.
Screenshot: Enrollment program tokens list showing expiry (captured during a live customer build — coming to this page)
Why: The expiry date is your proof the token bound correctly — and your countdown to the next renewal.
Watch for: The expiry sits roughly 12 months out; nothing shouts when it lapses, but an expired ADE token silently halts all new device enrolments.
On a schedule: Diarise renewal 4–6 weeks before this expiry date and renew with the same organisation Apple ID from step 5 — let it lapse and out-of-box enrolment stops for every new device.
Put these on a schedule
| Step | Recurring action to diarise |
|---|---|
| Step 5 | The token this account owns expires 12 months from creation — set the renewal reminder against this shared organisation account, never a personal calendar. |
| Step 12 | Diarise renewal 4–6 weeks before this expiry date and renew with the same organisation Apple ID from step 5 — let it lapse and out-of-box enrolment stops for every new device. |
If it goes wrong
The failures people actually hit on this process, each with the diagnosis and fix:
- Apple tokens in Intune: APNs, ADE and VPP renewal explained — The APNs certificate, ADE enrolment token and VPP token all expire yearly and each breaks something different. A one-page matrix and the renewal rules.
- Retail-bought devices don't appear in Apple Business Manager — Retail purchases can't satisfy ABM chain of custody. Register reseller DEP IDs, add devices with Apple Configurator, and mind the 30-day release window.
- ABM federation Apple ID conflicts: the 60-day rename — ABM federation gives personal Apple IDs on your domain 60 days, then a forced rename. The conflict lifecycle, plus a staff comms email template.
‹ Create the Apple MDM Push certificate (required for all Apple management)Create the Apple ADE enrolment policy (out-of-box experience) ›
See it on a real device.
Decolla is in private build — early-access members see a build defined, deployed and rolled back first.
Get early access