Onboarding Checklist for BYOD Android Devices (M365 Business Premium)

bp1

This checklist provides a comprehensive guide to onboard Bring Your Own Device (BYOD) Android phones into a Microsoft 365 Business Premium environment. It ensures that personal Android devices are set up with strong security policies so company information remains protected and secure. The process is broken into phases for clarity: Preparation (Admin setup), User Enrollment Steps, Post-Enrolment Configuration, and Ongoing Management. Key security policies for BYOD Android are highlighted throughout.

1. Preparation (IT Admin Configuration)

1.1 Verify Licensing & Prerequisites

  • M365 Business Premium License: Ensure each BYOD user has an M365 Business Premium licence assigned. This suite includes Intune (for MDM/MAM), Azure AD Premium P1 (for Conditional Access), and information protection features[1] needed for secure BYOD management.

  • Multi-Factor Authentication (MFA): Require all users to have MFA enabled on their Microsoft 365 accounts. This provides an extra layer of identity security before devices can access company data (e.g. using Microsoft Authenticator app).

  • Intune (Endpoint Manager) Setup: Confirm that Microsoft Intune is configured as the Mobile Device Management (MDM) authority for your tenant (in modern tenants it’s enabled by default). Verify you have admin access to the Microsoft 365 admin center and Endpoint Manager admin center.

1.2 Intune Enrollment Configuration

  • Enable Android BYOD Enrollment: In Intune, enable Android Enterprise “personally-owned work profile” enrollment (the setting might be called Android Enterprise work profile). This allows personal Android devices to register with a Work Profile – a separate, encrypted container on the phone for work apps and data[2]. Work profiles isolate corporate information from personal apps, respecting user privacy while securing business data.

  • Managed Google Play Integration: Connect Intune with Managed Google Play. In Endpoint Manager portal, navigate to Devices > Android > Android Enrollment and link to a Managed Google Play account (using a corporate Google account). This integration is required to deploy the Intune Company Portal app and any managed apps to Android devices[3].

  • Define Enrollment Restrictions: (Optional) Review Intune Enrollment Restrictions to ensure personal Android devices are allowed. You may limit enrollment to certain Android OS versions (e.g. block very old, insecure Android versions) or disallow jailbroken/rooted devices.

  • Communicate BYOD Policy: Prepare and distribute a BYOD usage policy document to users. Include what IT will control on the device (work profile only), what security measures will be enforced, and assure users that personal data (photos, personal apps, etc.) remains untouched. Users should consent to remote wipe of company data if the device is lost or upon separation.

1.3 Configure Security Policies in Intune
Set up the following Intune policies before users enroll their devices, so that they apply automatically during enrollment:

  • Compliance Policy for Android (Work Profile): Create a compliance policy targeting Android Enterprise work profile devices with at least:

    • Device must not be rooted – Mark rooted (jailbroken) devices as non-compliant[1].

    • OS version patch level – (Optional) Require a minimum Android version or security patch level. This ensures older, vulnerable OS versions are not allowed.

    • Device Password/PIN – Require a device lock PIN or password of sufficient complexity on the device. For example, a minimum 6-digit PIN or password, with a limit on simple sequences. Set an inactivity auto-lock (e.g. 5 minutes). Intune can enforce these on the whole device or at least on the work profile.

    • Encryption – Require device encryption. Most modern Androids are encrypted by default, but ensure the policy demands encryption is enabled for compliance[4]. This protects data at rest on lost/stolen devices.

    • Threat Protection – If leveraging Microsoft Defender for Endpoint (Mobile), set “Require device at or under Medium threat level” (or Low for stricter security)[1][1]. This uses mobile threat defense to evaluate device risk (e.g. malware detected). Devices with high risk are marked non-compliant automatically. (This requires deploying Defender – see step 3.2).

    • Safety Net/Play Protect – Enable Google Play Protect and SafetyNet device attestation if available[1], to ensure the Android device hasn’t been compromised.

  • App Protection Policy (MAM): Configure an Intune App Protection Policy targeting the user accounts on unmanaged devices (i.e. applying to apps even if the device isn’t fully enrolled, though in work profile scenarios it complements MDM):

    • Approved Apps Only – Specify that corporate data can only be accessed via approved apps (e.g. Outlook, Teams, OneDrive, Office mobile apps, etc.).

    • Prevent Data Leakage – Block backups of work data to personal cloud services (e.g. Google Drive). Prevent “Save As” of corporate files to unmanaged locations; allow saving only to OneDrive for Business or SharePoint[1][5].

    • Restrict Copy/Paste – Do not allow copying text or data from a managed corporate app to personal apps. Conversely, you may allow or restrict personal-to-work copy as appropriate[1].

    • Require App PIN/Biometric – Even if the device is unlocked, require a PIN or fingerprint to open company apps (adds a second layer if device falls into wrong hands)[1].

    • Disable Screenshots – For work profile apps on Android, consider blocking screenshots or screen captures of sensitive app content[1].

    • Selective Wipe – Enable the ability to wipe corporate app data if the device is unenrolled or non-compliant (Intune default for app protection).

  • Configuration Profile (Device Settings): Optionally, deploy a configuration profile to the work profile for additional settings: e.g. enforce device encryption (if not covered by compliance), configure email profile (to push Outlook settings), Wi-Fi profiles for office, etc. These profiles apply to the managed work container on the device.

  • Conditional Access Policies: In Azure AD (Entra ID) > Security > Conditional Access, create policies to protect cloud resources:

    • Require Compliant or Protected Device – e.g. for all Exchange Online, SharePoint, Teams access by mobile apps, require device to be marked compliant or require use of an Intune-approved client app with app protection. This ensures only devices under Intune policies (MDM or MAM) can access company email and files[3][6]. Unmanaged or non-compliant devices will be blocked.

    • Block Unapproved Apps – Require approved client apps for email (forces use of Outlook rather than native mail apps).

    • Require MFA on New/Untrusted Devices – Although MFA is enabled tenant-wide, a CA policy can enforce MFA specifically on risky sign-in or outside trusted locations.

    • Exclude Emergency Accounts – Be sure to exclude break-glass admin accounts from CA rules to avoid lockout.

By completing the above preparation, you have established the policies and infrastructure so that when a user enrolls their BYOD Android, it will automatically receive the necessary protections.

2. User Enrollment Steps (On the Android Device)

Once the admin setup is done, instruct users to follow these steps to onboard their personal Android phones:

2.1 Install Company Portal & Setup Work Profile

  1. Download Microsoft Intune Company Portal app from Google Play Store.

  2. Sign in to Company Portal with the work (Office 365) credentials. The app will begin the device registration process into Intune.

  3. Enroll and Create Work Profile: Follow the on-screen prompts to enroll the device. The user will be asked to set up a Work Profile on their phone (this is an Android OS feature for BYOD). They must accept the creation of a managed work profile and Company Portal will configure it.[2]
    • Note: The user will see their phone “copying” certain system apps into a work profile. A separate Work folder/icon will appear, containing work versions of apps (marked with a briefcase icon).
  4. Accept Management & Policies: The user must agree to allow the organisation to manage the work profile. Assure them that only the work container is managed – personal apps and data remain unaffected. Intune will not collect personal information like photos or texts; it only monitors compliance info on the device.

  5. Set a Work Profile PIN: As part of enrollment or first app launch, the user will be prompted to set a PIN or biometric specifically for the work profile (if required by app protection policy)[2]. For example, they may need to configure a 6-digit PIN that will be used whenever they open a company app like Outlook.

2.2 Install Required Work Apps

  1. Company Portal Checks: Once enrollment is complete, open Company Portal and check device status. It should show as Enrolled/Compliant if all requirements are met (or show actions needed if not).

  2. Automatic App Installation: Intune can automatically deploy essential apps to the work profile. Common apps include: ** Outlook**, *Teams*, *OneDrive*, *Office (Word/Excel)*, *Microsoft Defender*, etc. These will appear in the work profile section of the phone (with briefcase icons).
    • If apps are not pushed automatically, the user can open the Managed Google Play Store (accessible via the Company Portal or Work Profile) which lists approved apps. They should download the required corporate apps from there.
  3. Sign Into Work Apps: User should sign in to the Outlook app and other apps with their work credentials. The Conditional Access policies will enforce that sign-ins only succeed within these approved apps. For example, if they try to add their work email to the phone’s native mail app, it should be blocked by policy, guiding them back to using Outlook.

2.3 Comply with Security Prompts
During or after enrollment, Intune will enforce the compliance settings:

  • If the user had no lock screen, they will be prompted to set a device PIN/password before enrollment completes (the compliance policy requires it). This is mandatory to protect the device.

  • If the OS is out-of-date beyond allowed threshold, it will mark as non-compliant – the user should update their Android to the latest security patch to regain compliance.

  • The user might see a prompt to enable device encryption (if not already enabled). They should follow the instructions to encrypt the device (in most cases, modern Androids are encrypted by default, so this step may be transparent).

2.4 Confirm Setup Completion

  • The device should now show in Company Portal as Compliant. The work profile is active and corporate apps are installed. At this point, the user’s work email, files, and Teams chats are accessible only inside the protected apps.

  • The user should verify they can send and receive work emails in Outlook, access OneDrive files, etc. All company data is now inside the secure work profile environment.

  • Verify that personal apps (e.g. Gmail, personal Facebook, etc.) still function normally – there should be no interference, as policies apply only to the work side.

3. Post-Enrolment Configuration & Security Policies Enforcement

After a successful enrollment, the following protections and policies will be in effect to secure the corporate data on the BYOD device:

3.1 Work Profile Isolation
The Android device now has a dedicated Work Profile. This means:

  • Work apps cannot share data with personal apps. For example, files downloaded in the work profile are stored in a separate encrypted space and can’t be opened by personal apps.

  • The user’s personal notifications and data stay private. Work apps might have their own notifications labelled as work. The admin cannot see personal contacts, photos, or SMS, etc., only an inventory of the work profile apps and device compliance status.

3.2 Policy Enforcement on Device

  • Device Compliance: Intune continuously evaluates the device against the compliance policy. If the user disables their device PIN, or if the device is later rooted or falls out of date, it will flip to non-compliant status. Intune can optionally notify the user and even auto-remediate some issues (like require them to set a PIN again).

  • App Protection: All managed apps apply the App Protection Policy settings: e.g. if the user tries to copy text from a Teams chat (work) to a personal texting app, it will be blocked. Screenshots in a work app will show as blank if disallowed. If they try to save an attachment from Outlook, they’ll only be allowed to save to OneDrive for Business, not to device Downloads folder[5]. These controls ensure company info stays within approved apps and cannot leak to personal space[5].

  • Microsoft Defender for Endpoint (Optional): If deployed, the Defender app runs in the background of the work profile, providing antivirus and anti-phishing protection. It can detect malicious apps or files in the work profile. If malware is detected or the device faces a threat, Defender can raise the device’s risk level. Intune’s compliance policy can then mark the device non-compliant (if risk is above the allowed threshold)[1], and Conditional Access will block the device from accessing company resources until the threat is resolved.

  • Email and Data Access: Thanks to conditional access, if the user attempts any other method to access corporate email or data outside the approved apps, it will be denied. For instance, downloading mail in a personal email app or moving a file to a personal Google Drive won’t be possible. Only Outlook can access Exchange, only OneDrive app can access OneDrive/SharePoint, etc., under the managed context.

  • Conditional Access in Action: When the user launches a protected app (like Outlook), Azure AD checks compliance. If the device ever becomes non-compliant (say the user removes the PIN or the device is detected with an issue), their access token is revoked – Outlook/Teams will inform the user that the device does not meet security requirements and deny access until compliance is restored. This mechanism ensures only secure, policy-abiding devices can use company services[3].

3.3 Security Policy Summary (BYOD Android)
The following is a summary of key security policies now active on the BYOD Android device:

  • Device Protection: Device encryption is enabled and a strong lock PIN/password is enforced. The device is not allowed to be rooted or running outdated software.

  • Separate Work Container: Corporate apps and data reside in an encrypted work profile isolated from personal apps.

  • Data Loss Prevention: No copying of corporate data to personal apps, no backing up work data to unapproved cloud services. Only approved apps can open or edit work files[5].

  • Access Control: Corporate apps require re-authentication or app PIN periodically. If the device fails compliance, corporate app access is blocked.

  • Threat Response: Integrated threat defense (Defender) monitors the device for malware; high risk devices are quarantined from company resources[1][1].

  • User Privacy: Only work profile information is managed. Personal apps, data, and usage remain private and unaffected (aside from the requirement of a device PIN which benefits the user’s own security as well).

These policies together align with common compliance standards by enforcing encryption, access control, and data protection on BYOD devices. For example, requiring encryption and strong authentication helps meet GDPR and other data protection regulations for safeguarding personal data on portable devices, and the strict separation addresses privacy requirements.

4. Ongoing Management and User Responsibilities

Security is not a one-time setup – it requires continuous management and user cooperation. Both IT administrators and the device user have ongoing responsibilities:

4.1 IT Admin Monitoring & Maintenance

  • Compliance Monitoring: Intune provides reports of device compliance. Regularly review the compliance dashboard to spot any non-compliant BYOD devices. If a device is non-compliant for an extended period, follow up with the user. Common issues might include an expired OS version, or a user who hasn’t signed in for a long time (which could indicate a lost device).

  • Update Policies: Keep the compliance and configuration policies up to date. For instance, if a new Android OS version comes out with important security features, you might raise the minimum OS level after a grace period. Similarly, periodically review app protection settings to incorporate new policy options or new corporate apps that need protection.

  • Defender Alerts: If using Defender for Endpoint, monitor its alerts. A malware alert from a BYOD device should be addressed immediately – ensure the threat is remediated and device is clean before marking it compliant again.

  • Conditional Access Reviews: Audit sign-in logs to ensure Conditional Access rules are working as intended (e.g., no unexpected app access). Adjust rules if users encounter false positives (e.g., a new approved app might need to be added to the allowed list).

  • Support & Troubleshooting: Be prepared to assist users with issues. For example, if the Company Portal shows the device as non-compliant due to a setting, guide the user on how to resolve it (update OS or set a PIN, etc.). Ensure helpdesk can answer questions about what IT can and cannot see on BYOD (to alleviate privacy concerns).

4.2 User Best Practices & Responsibilities

  • Keep Device Updated: Users should install Android system updates and security patches promptly. Even with compliance policies, user diligence ensures their device stays secure and compliant.

  • Maintain Screen Lock: Users should never remove or weaken their device PIN/password. If they do, company data access will stop. Encourage them to use biometric unlock for convenience, but the PIN is still required in background.

  • Only Use Work Apps for Work Data: Remind users to only use the apps provided in the work profile for any company information. They should avoid downloading company attachments or data into personal apps. The system largely enforces this, but user understanding helps prevent attempts to circumvent.

  • Report Lost or Stolen Device: It is the user’s duty to immediately inform IT if their phone is lost or stolen. This allows IT to take swift action (see 4.3).

  • No Tampering: Users should not attempt to root their phone or install untrusted firmware. These actions will break compliance and pose security risks. Instruct that doing so will result in loss of access to work resources (until they reset the device to a secure state).

  • Personal Data Backups: Users should continue their normal personal data backups (this is outside of work profile). For work data, they don’t need to worry – it’s in cloud (OneDrive, Exchange) or protected within apps, but not bad practice to remind them corporate data is backed up by the company’s cloud, not by their personal Google account.

4.3 Device Retirement and Incident Response

  • Offboarding Users: When an employee leaves the company or no longer needs corporate access on their phone, perform a Selective Wipe (Retire) via Intune. This action removes all company data and apps from the work profile without affecting personal data. The work profile and its contents will be erased[6]. Always do this for departing staff BYOD devices to prevent any residual access.

  • Lost/Stolen Device: If a device is reported lost or is suspected stolen, Intune can issue a Remote Wipe. For BYOD, you’d typically do a selective wipe (work profile only) to remove business info. In higher-risk scenarios (or if the user requests it), a full device wipe can be initiated, but note this erases personal data too – typically only done if absolutely needed and with user consent. Either way, because data is encrypted and protected by PIN, the risk of data exposure before wipe is low, but timely action adds assurance.

  • Non-Compliant & Inactive Devices: Intune can be set to retire devices that haven’t checked in for a long period (e.g. 90 days of inactivity), which could indicate the device is no longer in use. This auto-cleans stale records and ensures access isn’t lingering on an unused phone.

  • Periodic Policy Acknowledgement: It’s wise to have users periodically re-accept the BYOD policy (e.g. annually). This can be done via a simple internal process or a compliance requirement in Intune that asks users to open Company Portal and acknowledge a Terms of Use. This keeps users aware of their role in protecting company data.

4.4 Continuous User Education
Security is an ongoing effort. Provide regular training or tips to users about mobile security:

  • Educate on phishing threats via SMS or email on their mobile and how to avoid them (the Defender app can help alert if a malicious link is clicked in the work profile).

  • Remind about not installing untrusted apps on the device – even though work data is compartmentalised, a compromised device at the OS level could still be dangerous.

  • Share any updates in policy or new security features (for example, “Now we enforce a 8-digit PIN due to updated policy – please update your PIN proactively.”).

Conclusion

By following this onboarding checklist, organisations can successfully enable employees to use their personal Android devices for work while maintaining a robust security posture. Microsoft 365 Business Premium provides the necessary tools – Intune for device/app management, Conditional Access, Defender for Endpoint, and information protection – to implement a zero-trust approach for BYOD: never trust a device until it meets all security requirements, and continually verify compliance. The result is a balance of productivity and security: users gain the convenience of a single device for work and personal needs, and the company ensures its sensitive emails, files, and applications are safe from unauthorised access or leakage on those devices.

All stakeholders should regularly revisit this checklist and update it as technology and threats evolve. A well-maintained BYOD program with clearly defined security policies will significantly reduce the risk of data breaches and ensure that even outside the office, corporate information remains secure and under IT’s control[3].

References

[1] Android Enterprise compliance settings in Microsoft Intune

[2] Microsoft 365 Business Premium Setup Checklist A Comprehensive Guide for IT Professionals

[3] Comprehensive Android Device Onboarding Checklist for M365 Business Premium

[4] Protect unmanaged devices with Microsoft 365 Business Premium

[5] BYOD iPhone Onboarding Checklist – Microsoft 365 Business Premium

[6] Onboarding a Windows Device into M365 Business Premium Step-by-Step Checklist

BYOD iPhone Onboarding Checklist – Microsoft 365 Business Premium

bp1

Introduction
Bring Your Own Device (BYOD) policies allow employees to use personal devices (like iPhones) for work, offering flexibility and productivity benefits. However, every personal device connecting to company data is a potential attack avenue if not properly secured[1]. It’s crucial to onboard iPhones with robust security measures so that company information remains protected. Microsoft 365 Business Premium provides advanced tools (Microsoft Intune for device/app management, Azure AD for identity and Conditional Access, information protection and more) to secure BYOD devices[2][3]. This checklist outlines detailed steps for initial setup of a BYOD iPhone and ongoing management practices to maintain security over time.

Key Terms and Concepts

Term Definition
BYOD (Bring Your Own Device) When employees use their personal devices (phones, tablets, laptops) for work purposes. The device is not company-owned, but is granted access to company resources.
Microsoft 365 Business Premium A subscription service that includes Office 365 apps, cloud services (email, OneDrive, Teams, etc.), and advanced security features (like Intune MDM/MAM, Azure AD Premium P1 for Conditional Access, Defender for Business, information protection with DLP and encryption). Tailored for small-to-midsize organisations, it helps protect user accounts, data, and devices.
Initial Setup The one-time configuration process during onboarding of a device. For BYOD iPhones, this includes registering the device, applying security settings, and installing required apps so it meets company security requirements from the start.
Ongoing Management Continuous practices after initial setup to ensure the device remains secure and compliant. This includes regular updates, policy enforcement, monitoring, user training, and incident response over the device’s lifetime in the organisation.

Why Secure BYOD iPhones?
Using personal iPhones for work introduces certain security risks that must be mitigated:

  • Data Leakage – Personal and business data coexist on BYOD devices, which can lead to accidental sharing or unauthorized access to sensitive company information[4]. For example, a user might inadvertently back up work files to a personal cloud or send corporate data via a personal app.
  • Lost or Stolen Device – If a BYOD iPhone is lost or stolen, company data on it could be exposed. Without proper controls (like remote wipe), confidential data might fall into the wrong hands[4].
  • Malware/Phishing Threats – Personal devices may lack the stringent safeguards of managed corporate devices, making them more susceptible to malware or phishing attacks that can compromise corporate data[4]. Users could unknowingly download malicious apps or click phishing links, endangering both personal and work data.
  • Compliance and Privacy – Regulated industries face challenges ensuring BYOD devices meet data protection standards. Blurred personal/work use can complicate compliance (e.g. with GDPR, HIPAA) and raise privacy concerns if devices are not handled correctly[4].
  • Human Error – Without adequate training, employees might use their personal iPhones in insecure ways (weak passcodes, connecting to unsafe Wi-Fi, etc.), inadvertently exposing company data[4]. A strong BYOD policy and user awareness are needed to minimize mistakes.

Given these risks, a zero-trust approach should be applied: assume no personal device is secure by default and layer multiple protections (strong authentication, device compliance enforcement, data protection policies, and user education)[1][2]. Microsoft 365 Business Premium equips organisations with the needed capabilities to implement this, such as enforcing multi-factor authentication, using Intune to manage or contain corporate data on the device, and applying data loss prevention. The following checklist is divided into two parts – initial setup and ongoing management – to ensure a BYOD iPhone is onboarded and maintained securely.

Initial Setup Checklist (BYOD iPhone Onboarding)

Preparation – IT Administration (before user enrolls device):

  1. Enable Multi-Factor Authentication (MFA) for User Accounts: Ensure the user’s Office 365/Azure AD account is protected with MFA. Enforce company-wide MFA as a policy so that even if an iPhone is compromised, an attacker cannot access the account without a second factor[1]. Have users install the Microsoft Authenticator app and register it for MFA on their account[5]. This significantly reduces the risk of account compromise.
  2. Configure Mobile Device Management (MDM) and App Management: Set up Microsoft Intune (part of Business Premium) to handle BYOD iPhone enrollments. This involves adding an Apple MDM push certificate to Intune (a prerequisite for managing iOS devices) and defining an enrollment policy for BYOD scenarios. Intune supports Apple User Enrollment (a privacy-friendly mode for BYOD) which creates a managed work partition on the device, or standard device enrollment for full MDM control[6]. Choose the approach that fits your organisation’s BYOD policy (User Enrollment or full MDM). If full device enrollment is not desired, plan to rely on App Protection Policies (MAM) without device enrollment[2].
  3. Set Compliance Policies in Intune: Define compliance requirements that the iPhone must meet to be considered secure. For example, require the device to have a passcode, block jailbroken devices, and enforce a minimum iOS version[7][7]. In Intune’s compliance settings for iOS, you can mark a device as non-compliant if it’s jailbroken[7], require encryption (which is automatic when a passcode is set on iOS)[7], and require the latest iOS updates (you can set a minimum allowed OS or build version)[7]. These policies ensure that only healthy, secure devices can access corporate data.
  4. Configure App Protection Policies (MAM): In Intune, create App Protection Policies for iOS targeting company apps (especially if you allow access without full device enrollment). These policies protect corporate data at the app level even on unmanaged devices[2]. Key settings include preventing backup of work data to iCloud, restricting copy-paste of data from work apps to personal apps, requiring app data to be encrypted, and requiring a PIN or biometric to open company apps[2][2]. For example, you might block saving corporate files to personal storage and only allow saving to OneDrive for Business or SharePoint[2]. Such controls ensure that even on a personal iPhone, company information stays within approved apps and cannot be easily leaked.
  5. Set up Conditional Access Policies: Use Azure AD Conditional Access to tie everything together. Create policies that apply to all BYOD mobile access – for instance, require that users accessing Exchange Online, SharePoint, Teams, etc., from an iOS device must use approved apps with app protection in place[2]. In Conditional Access rules, you can grant access only if the device/app meets conditions: e.g. Require app protection policy and Require approved client app (so that users must use Outlook mobile rather than any mail app)[2]. You can also require device compliance for certain sensitive apps if you choose to mandate full enrollment for those. These controls ensure that even if a user tries to use a personal app or an unsecured device, they will be blocked from company data – only the secured route is allowed.
  6. Communicate BYOD Policies to the User: Before onboarding, inform the employee of the BYOD usage policy. This should include what data the company can manage on their device, their responsibilities (e.g. maintaining a passcode, not disabling security), and privacy assurances. Make sure they consent to any management profiles to be installed and understand the consequences (for example, IT’s right to wipe corporate data if the device is lost or on separation). Clear communication and user buy-in will make the onboarding smoother[4][4].

Onboarding – End User Device Steps (actual device setup process for the user):

  1. Update iPhone to Latest iOS: Before connecting to corporate services, the user should update their iPhone to the latest iOS version. Current iOS updates include important security patches that help protect the device. (Intune’s compliance policy will require a minimum OS or show the device as non-compliant if it’s outdated[7].) Encourage enabling automatic iOS updates to keep the device up to date going forward. Also verify the device is not jailbroken or tampered (jailbroken devices will be blocked as non-compliant by policy[7]).
  2. Set a Strong Device Passcode (and Enable Touch ID/Face ID): The user must secure their iPhone with a strong passcode if not already done. A passcode (or biometric lock) is the first line of defense if the phone is lost. Not only does a passcode prevent unauthorized access, it also encrypts the device storage on modern iPhones – iOS automatically enables full-device encryption when a passcode is set[7]. Company policy may enforce complexity (e.g. no simple “1234”, minimum length, etc.)[7]. Advise the user to set a 6-digit or alphanumeric passcode and configure auto-lock (e.g. 1-5 minutes of inactivity) to reduce exposure.[7].
  3. Install Microsoft 365 Apps: Next, the employee should install the necessary work applications from the Apple App Store. At a minimum, this usually includes Microsoft Outlook (for corporate email/calendar), Teams, OneDrive/SharePoint, Office (Word/Excel/PowerPoint), and possibly Microsoft Edge for a secure browsing experience. Microsoft 365 Business Premium allows the user to sign into these Office mobile apps with their work account. Installing the official Microsoft apps is important – Conditional Access will likely require “approved client apps” for accessing company data[2]. (The organisation may also use Apple’s managed app deployment, but for BYOD it’s common to let users grab apps themselves from the App Store.)[1] Ensure the user has the latest versions of these apps.
  4. Enroll in Intune via Company Portal: The user must register the device with the company’s Intune MDM if required by policy. Have them download the Microsoft Intune Company Portal app from the App Store and sign in with their work Office 365 credentials[6]. The Company Portal will guide them through the enrollment process. This typically involves: granting the app the necessary permissions, downloading an MDM profile from Intune, and going to iOS Settings to install that profile (the user will see a prompt to install a management profile). Once done, the device is marked as enrolled and will show up in the company’s Intune console. At this point, any compliance policies (from step 3 of Preparation) are enforced on the device via Intune. For example, if the policy requires a passcode or certain OS level, the user might be prompted to set those to comply. Note: In some BYOD setups, full device enrollment might be optional – if the organisation is doing app-level management only (MAM), the user may skip full device enrollment. In such cases, simply logging into Outlook or another managed app will trigger application protection policies without installing a device profile. (For instance, upon first run of Outlook, the user might be asked to set a PIN for the app or enable Authenticator as a broker app for policy enforcement.) Ensure the user follows whichever flow your IT has defined.
  5. Sign In and Configure Work Apps: After enrollment, the user should sign into the Microsoft 365 apps using their work account (if they haven’t already during the Company Portal step). Upon login, the device will be evaluated by Conditional Access. If everything is in order (MFA done, device compliant or app protected), the sign-in will succeed and data will start syncing (emails, files, etc.). The user might see a few additional prompts as final configuration: for example, Outlook for iOS might prompt “Your organisation is now protecting its data in this app” and enforce a policy like requiring a separate app PIN or enabling encryption — these stem from the App Protection Policy applied[2]. The user should accept all prompts for permissions and policy enforcement (these are there to protect company info). At this stage, verify that email is working in Outlook (or the native Mail app if your policy allowed a managed email profile). If native Mail is allowed, Intune would have installed a managed email profile during enrollment; otherwise, the user will use Outlook.
  6. Verify Device Compliance and Security Settings: Once setup is complete, both the user and IT admin should double-check that the device is properly secured. On the iPhone, the user can open Company Portal app to see device status – it will show if the device is compliant or if any action is needed. The user should see that all requirements (like having a passcode, encryption, etc.) are met. The IT admin, on the Intune/Endpoint Manager portal, should also see the device listed under the user with a compliant status. This ensures that the iPhone is successfully onboarded under management. Additionally, test that security controls are in effect: e.g., try copy-pasting from a corporate app to a personal app – it should be blocked if App Protection is correctly applied, per policy[2]. Or confirm that if the user tries to use an unapproved email app, access to email is denied[2]. These validations confirm that company data on the BYOD iPhone is fenced off and protected as intended.
  7. Educate the User on Secure Usage: Finally, spend a moment to highlight to the employee how to use their newly set up device securely. Remind them of key points: Only use the approved apps (e.g. Outlook, Teams) for work data[2]; do not save work files to personal apps or personal cloud storage; be cautious of phishing messages or suspicious apps; and never remove the management profile or jailbreak the device. Also let them know what to do if something goes wrong – for instance, if they forget their app PIN or if the device falls out of compliance (Company Portal can show remediation steps – e.g., “update your OS to regain access”). User awareness at onboarding will reduce risky behavior later[4].

With these steps, the iPhone should now be securely integrated into the company’s ecosystem with appropriate protections. The device has MFA on the account, is registered or monitored by Intune, has all necessary apps under policy, and the user is informed of their role. Company data is now confined to secure applications and can be remotely wiped if needed, and the device’s integrity is continuously checked.

Ongoing Management Checklist (Maintaining Security Over Time)

Once a BYOD iPhone is onboarded, security is not a one-time set-and-forget task. Ongoing vigilance is required from both the user and IT to ensure the device continues to protect company information. The following are best practices and actions for ongoing management:

  • Regular Software Updates: Keep the iPhone OS and apps up to date at all times. New iOS versions often patch security vulnerabilities, so timely updates are critical. Encourage users to enable automatic iOS updates and periodically verify they are on the latest version. The IT team can make OS version part of compliance: Intune can flag devices that fall behind on updates as non-compliant (e.g. if below a minimum iOS or if an important security patch isn’t applied)[7]. Likewise, Microsoft apps (Outlook, Teams, etc.) should be updated via the App Store. Outdated apps or OS could become entry points for attacks. Maintaining up-to-date software ensures the device has the latest defenses.
  • Device Compliance Monitoring: Continuously monitor device compliance and health status. In the Intune/Endpoint Manager admin center, IT administrators should regularly check reports of device compliance, and remediate issues promptly. For example, if a device becomes non-compliant (perhaps the user disabled their passcode or the OS fell out of date), Intune can be set to send the user a notification or email. IT should follow up on these alerts to help the user fix the issue or to block access until it’s resolved. Microsoft 365 Business Premium also includes Microsoft Defender for Business, which can provide mobile threat detection. Admins can view device risk levels in the security portal – if a BYOD iPhone is flagged with a threat (say malware is detected, or it’s jailbroken), take immediate action (like locking the device from company data)[7][5]. Regular compliance audits ensure no device drifts into an insecure state unnoticed.
  • Enforce App Protection and Data Loss Prevention: The organisation should maintain and update its data protection policies over time. App Protection Policies (MAM) and Data Loss Prevention (DLP) rules need to stay aligned with evolving business needs. For instance, if new cloud apps are introduced, ensure your Intune app policies cover them or block them appropriately. Microsoft 365 Business Premium includes DLP capabilities to prevent sharing of sensitive info (like credit card numbers, client data) via email or cloud[3] – make sure these policies are enabled in Microsoft Purview Compliance Center. Over time, tune the policies based on incidents: e.g., if users are frequently tripping a policy erroneously, adjust it; if data leaks are observed in a channel not covered, extend the DLP coverage. Also, periodically review which apps are approved for corporate data. Remove any that are no longer needed and add new trusted apps as required, updating your Conditional Access “approved apps” list accordingly[2]. These ongoing adjustments keep your data protection current and effective.
  • User Training and Awareness: Continue to educate BYOD users about security. Initial training at onboarding isn’t enough; threats evolve and users might forget policies. Conduct periodic security refresher trainings or send out tips for mobile security. Emphasize practices like avoiding public Wi-Fi or using a VPN, not clicking suspicious links on the phone, and maintaining a strong device passcode. Reinforce the importance of not circumventing controls – for example, explain why copying data out of managed apps is restricted, so users don’t try risky workarounds. Keep an open channel for users to ask questions or report concerns about their BYOD device. Cultivating a security-aware culture helps counter the human error factor that is often the weakest link[4].
  • Periodic Access Review: IT should perform periodic reviews of enrolled BYOD devices and their access. Retire any devices that have not checked in for a long time or belong to users who have since left the company. Azure AD and Intune logs can indicate when a device last successfully met policy. If a device is inactive or the user no longer needs corporate access on it, it’s safer to remove organizational data from it. Also, confirm that only approved users/devices are accessing sensitive apps – use Conditional Access reports to see if any unknown or non-compliant devices attempted access. This regular housekeeping ensures only intended, managed devices retain access.
  • Lost or Stolen Device Response: Plan and practice an incident response for lost devices. If an employee’s iPhone is lost or stolen, act immediately: the user (or their manager) should notify IT at once as per policy. Using Intune, the administrator should perform a Selective Wipe on the device to remotely remove all corporate data from it. In a BYOD scenario, a selective wipe will delete company app data (email, files, Teams chats, etc.) but leave personal data intact. This ensures that sensitive information doesn’t remain on a device that could be in someone else’s hands. In some cases, if the risk is very high, a full device wipe might be warranted (with user consent as per policy). Additionally, the admin may choose to block or reset the user’s Office 365 sign-in sessions, and require password change, in case the device access could have been compromised. Users should also use Apple’s “Find My iPhone” to put the device in Lost Mode or erase it if possible. The BYOD policy should clearly state the steps for reporting and what actions will be taken[4]. Time is critical in these situations – having a predefined process helps protect data quickly.
  • Employee Offboarding (Device Separation): When an employee leaves the organisation or no longer needs to use a personal device for work, ensure their device is cleanly offboarded. This means removing corporate access and data: Intune’s Retire or wipe action should be used to remove all company apps, profiles, and data from the BYOD iPhone when the employment or BYOD usage ends. Azure AD device objects for that phone should be disabled/removed as well. The offboarding checklist should be part of HR’s exit process so it isn’t overlooked. Having clear protocols for data retrieval at employee departure is vital to prevent any lingering access to sensitive info[4]. Likewise, if a user replaces their phone or decides to opt out of BYOD, perform the same cleanup. Proper offboarding ensures that company information doesn’t remain on personal hardware indefinitely.
  • Policy Updates and Continuous Improvement: Finally, treat BYOD security as an ongoing program. Regularly revisit your BYOD policy and technical controls. As new iOS features or M365 features become available (for example, improved device compliance checks or new types of data encryption), consider adopting them. Stay informed on updates in Microsoft 365 Business Premium – Microsoft frequently enhances Intune, Conditional Access, and Defender capabilities. Also review any security incidents or near-misses involving BYOD devices to learn lessons: if, say, a user found a loophole to save corporate data to an unmanaged app, address it through tighter policy or user guidance. Aim to refine the onboarding checklist itself over time. Continuous improvement will keep the organisation one step ahead of threats.

By following this comprehensive checklist, an organisation can confidently allow iPhone BYOD usage while minimizing security risks. The initial setup establishes a secure baseline – enforcing strong authentication, isolating corporate data in managed apps, and ensuring the device meets security standards. The ongoing management then sustains that security posture through updates, monitoring, user awareness, and swift incident handling. This two-phase approach – onboarding + maintenance – is essential for a robust BYOD program. Microsoft 365 Business Premium’s toolset (Intune, Azure AD, Defender, and information protection features) plays a central role in implementing these steps, making it possible to protect company information on personal devices without unduly interfering in the users’ personal data and privacy. With the right configurations and practices in place, employees like those at Your Organisation can enjoy the convenience of using their iPhones for work, and the company’s data remains safe and under control. [2][2]

References

[1] Set up unmanaged devices with Microsoft 365 Business Premium …

[2] Enforce device compliance and app protection policies on BYOD with M365 …

[3] Set up information protection capabilities – Microsoft 365 Business …

[4] BYOD security risks: mitigation strategies for organizations

[5] Secure managed and unmanaged devices – Microsoft 365 Business Premium

[6] iOS/iPadOS device enrollment guide for Microsoft Intune

[7] iOS/iPadOS device compliance settings in Microsoft Intune

CIA Brief 20250621

image

Case management now supports multiple tenants in Microsoft Defender experience –

https://techcommunity.microsoft.com/blog/MicrosoftThreatProtectionBlog/case-management-now-supports-multiple-tenants-in-microsoft-defender-experience/4425329

Microsoft 365 Insider Round-Up: June 2025 –

https://www.linkedin.com/pulse/microsoft-365-insider-round-up-june-2025-microsoft-365-insider-7vidc/

Breaking down the infinite workday –

https://www.microsoft.com/en-us/worklab/work-trend-index/breaking-down-infinite-workday

Best Practices for Investigating Phishing Incidents in Microsoft Defender for Office 365 –

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/best-practices-for-investigating-phishing-incidents-in-microsoft-defender-for-of/4425748

Introducing TITAN-Powered Recommendations in Security Copilot Guided Response –

https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-titan-powered-recommendations-in-security-copilot-guided-response/4416350

Microsoft to Block Third-Party App Access to User Sites and Files –

https://office365itpros.com/2025/06/19/app-consent-policy-user-app-consent/

Getting started with the Microsoft Entra Suite –

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/getting-started-with-the-microsoft-entra-suite/4422972

New methods boost reasoning in small and large language models –

https://www.microsoft.com/en-us/research/blog/new-methods-boost-reasoning-in-small-and-large-language-models/

Understanding and Mitigating Golden SAML Attacks –

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/understanding-and-mitigating-golden-saml-attacks/4418864

Scale AI transformation with Azure Essentials: AI Center of Excellence guidance –

https://azure.microsoft.com/en-us/blog/scale-ai-transformation-with-azure-essentials-ai-center-of-excellence-guidance/

Microsoft 365 Copilot Notebooks available in OneNote on Windows –

https://techcommunity.microsoft.com/blog/Microsoft365InsiderBlog/microsoft-365-copilot-notebooks-available-in-onenote-on-windows/4423346

Announcing Microsoft 365 Local –

https://blogs.microsoft.com/blog/2025/06/16/announcing-comprehensive-sovereign-solutions-empowering-european-organizations/

After hours

Engineers vs Almost Impossible Tasks – https://www.youtube.com/watch?v=nBfK04-QPpg

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

Onboarding a Windows Device into M365 Business Premium: Step-by-Step Checklist

bp1

This guide provides a comprehensive checklist to onboard a Windows 10/11 device into Microsoft 365 Business Premium, ensuring it becomes fully managed and protected. Each step includes detailed instructions and best practices for both company-owned and personal (BYOD) devices. Follow the steps in order and refer to the notes for special considerations like security policies, personal device handling, and troubleshooting.

Prerequisites and Preparation

Before you begin, make sure the following prerequisites are in place:

  • Windows Pro Edition: The device must be running Windows 10/11 Pro (version 1703 or later). Windows 10/11 Home edition does not support Azure AD join or Intune management, and will prompt for an upgrade to Pro[1][2]. (Microsoft 365 Business Premium requires Windows Pro; it provides an upgrade benefit for devices running Windows 7/8/8.1 Pro to move up to Windows 10/11 Pro[1]). Upgrade the OS if needed before onboarding.

  • Microsoft 365 Business Premium License: Ensure the user of the device has an active M365 Business Premium license assigned. This license includes Azure AD and Intune (mobile device management) rights needed for device enrollment[3], as well as security features like Defender for Business. If the user account is not already in your Microsoft 365 tenant, create it and assign the license.

  • Internet Connectivity: The device should be online with a reliable internet connection during setup, as it will need to contact Azure Active Directory and Intune cloud services.

  • Administrative Access: Have administrator credentials ready. You will either need the local admin account on the PC (for preparing settings) or be prepared to log in with the user’s new M365 account which will become a local admin by default on an Azure AD joined device.

  • Backup Important Data: If the Windows PC was used prior (for example, a personal device being onboarded or a repurposed PC), backup any important files. The onboarding process might create a new user profile or enforce policies (like drive encryption) that could affect existing data. Plan for data migration if needed.

Step-by-Step Onboarding Process

Following is the step-by-step checklist for enrolling the device and applying protections:

  1. Enable Microsoft 365 Device Management Features: Prepare your M365 tenant for device onboarding.

    • Set Intune as MDM Authority – In most cases, Microsoft Intune is already the mobile device management authority for Business Premium. Verify this in the Microsoft Endpoint Manager admin center (Intune) settings[3].

    • Enable Automatic Enrollment – Configure Azure AD to auto-enroll devices into Intune. In the Azure AD (Entra ID) portal, navigate to Mobility (MDM and MAM) and set MDM user scope to All (or at least to the specific group of users you’re onboarding)[4]. This ensures that when a user registers a device with Azure AD, it automatically gets enrolled in Intune MDM.

    • Set Up Compliance & Configuration Policies – Optionally, prepare any Intune compliance policies (requirements like requiring encryption, password complexity, etc.) and configuration profiles (for setting Wi-Fi, enabling BitLocker, etc.) that should apply upon enrollment. Microsoft 365 Business Premium comes with pre-configured default device protection policies that automatically apply baseline security (Defender AV settings, firewall rules, etc.) as soon as devices are onboarded[5]. Review these defaults in the Microsoft 365 Defender portal or Intune and adjust if necessary, or create custom policies for your organization’s needs.

    • (Optional) Configure Windows Autopilot – If this is a new or reset Windows device, consider using Windows Autopilot for zero-touch provisioning[6]. Autopilot allows you to pre-register the device in Intune and Azure AD, so that when it first boots, it will automatically join your organization, enroll in Intune, and even install apps/policies during the initial setup experience. This can greatly streamline onboarding for company-owned devices. Ensure you have created an Autopilot deployment profile in Intune if you choose this route. (Skip this if you plan to manually join via Windows Settings.)

  2. Prepare the Windows Device: Get the device ready for enrollment.

    • Update Windows OS – Install the latest Windows updates on the PC to ensure it’s up-to-date and secure. This can prevent enrollment issues and ensures the latest Intune management features are available.

    • Verify Windows Edition – Double-check that the device is running Windows 10/11 Pro as noted in prerequisites. If the device shows “Windows Home,” upgrade it to Pro before proceeding (M365 Business Premium does not directly upgrade Home editions; a separate purchase or upgrade license may be required[2]).

    • Reset if Necessary – If this device was previously used by someone else and you want a clean start (for a new employee or repurposed machine), you might factory reset or use Windows Autopilot Reset to wipe personal data and settings. Starting from a fresh state (out-of-box experience) with Windows Autopilot or normal setup will ensure no old configurations interfere with the new management. (If you reset, you can immediately proceed to Step 3 during the out-of-box setup.)

    • Install Company Portal (if BYOD) – For personal devices that will be enrolled but not Azure AD joined, the user should have the Intune Company Portal app available. It can be downloaded from the Microsoft Store. (On company-owned devices using Azure AD join, Company Portal is not strictly required for enrollment, but is useful for device info and installing available apps later.)

  3. Register/Join the Device to Azure AD: Connect the Windows device to your organization’s Azure Active Directory, which also initiates Intune management. There are two main paths, depending on ownership:
    a. Company-Owned Device (Azure AD Join) – For organization-owned devices, perform a full Azure AD Join so the device is fully managed:

    • During OOBE (first boot or after reset): When prompted “Who owns this PC?” or to choose setup, select “Set up for an organization”, then sign in with the user’s work (M365) credentials. This will join the device to your Azure AD tenant and enroll it in Intune automatically.

    • On an existing Windows install: Log in with a local or existing account that has admin rights, then open Settings > Accounts > Access work or school. Click Connect and in the dialog, choose “Join this device to Azure Active Directory.” Sign in with the user’s Microsoft 365 Business account credentials[3] and follow the prompts. Confirm the organization name and click Join to finalize the Azure AD join[3]. After a moment, you should see a message that the device is connected to Azure AD.

    • Switch to the Azure AD User Profile: Once joined, Windows will create a new user profile tied to the Azure AD account. Sign out of the old local account and sign in using the new work account (the email/username just used) at the Windows login screen[3]. This ensures the user is now working in the managed profile. Upon first sign-in, an Enrollment Status screen may appear (if configured) while Intune policies and apps apply. Wait for this to complete.

    • (Note: If migrating from a local account, you may need to migrate user data to the new profile. Ensure any needed files from the old profile are copied to OneDrive or transferred, since the user will primarily use the new Azure AD profile going forward.)

    b. Personal BYOD Device (Azure AD Registration) – For personal devices that the user wants to use for work, a full Azure AD join might not be appropriate. Instead, the user can register the device (sometimes called Azure AD Workplace Join) and enroll in Intune without changing their primary local account:

    • In Settings > Accounts > Access work or school, click Connect. This time, sign in with the work account when prompted, but do not select the “Join this device to Azure AD” option if presented. On Windows 11, the process will default to registering the device. On Windows 10, if given a choice, choose “Connect” or “Register” instead of the full join.

    • This action adds a Work or School account to the device (visible under the Access work or school section). The device becomes Azure AD registered and MDM enrolled in Intune (since we enabled auto-enrollment) but the user continues to log into Windows with their personal account. Intune will still manage the device’s security settings and apps in a limited way.

    • If using the Company Portal app, the user can alternatively open it after signing in with their work account and follow the guided enrollment steps (which achieves the same outcome of device registration and Intune enrollment)[2][7].

    • After registration, the user may be prompted to install a management certificate and complete device setup for work. Once done, the device will appear in Intune with “Personal” ownership, and corporate policies (like app protection or some device configurations) will apply without taking full control of the device.

  4. Verify Enrollment and Initial Policy Application: Confirm that the device is now managed in Intune and receiving security policies.

    • Check Intune Portal – In the Microsoft Endpoint Manager admin center (Intune), navigate to Devices > Windows > Devices and verify the PC appears on the list. It should show the user’s name and an Enrollment Status (and eventually “Compliant” or “Not Compliant” once evaluation happens). This confirms the MDM enrollment succeeded.

    • Apply Baseline Security Policies – Microsoft 365 Business Premium automatically applies certain default security configurations to managed devices. These include Microsoft Defender Antivirus settings (next-generation protection) and Windows Firewall rules to ensure the endpoint is protected from malware and network threats[5]. Additional default policies cover features like web content filtering, controlled folder access (to guard against ransomware by protecting documents), and attack surface reduction (ASR) rules to harden the system[5]. Review these policies in the Intune or Defender for Business portal under device configuration/security policies. They should already be assigned to the device (often via “All Devices” or similar group) so that as soon as the device is onboarded, these protections are in effect[5].

    • Enable Device Encryption (BitLocker) – Ensure that BitLocker drive encryption is enabled on the Windows device to protect data at rest. Intune can enforce this via a device configuration profile or compliance policy (e.g., requiring encryption). On Azure AD joined devices, BitLocker can be enabled and the recovery key will be stored to Azure AD automatically. Microsoft recommends enabling BitLocker to secure data in case the device is lost or stolen[8]. If it’s not already on, configure BitLocker manually or through Intune (Settings > Update & Security > Device Encryption/BitLocker, turn it on, and save the recovery key to Azure AD or a safe location).

    • Check Microsoft Defender Status – Since Defender is built into Windows 10/11, verify that Microsoft Defender Antivirus is active and updated. Intune’s default “next-gen protection” policy for Business Premium may have configured cloud protection, real-time protection, and automatic sample submission settings[5]. In Windows Security app on the device, ensure no alerts are present and that virus definitions are current.

    • Verify Firewall and Other Settings – Confirm the Windows Defender Firewall is enabled on all network profiles (Intune’s firewall policy should enforce this[5]). If a web content filtering policy is provided (via Defender for Business), it will be active at this point to block categorized dangerous sites. Controlled Folder Access and ASR rules (if included or additionally configured by you) should now be turned on to provide ransomware and exploit protection – for example, Offices apps might be prevented from creating executables in certain directories as per ASR rules[5]. You can check these on the device (Windows Security > Virus & threat protection > see Ransomware protection for Controlled Folder Access, and App & browser control for Exploit/ASR settings).

    • Note: Microsoft 365 Business Premium includes Microsoft Defender for Business, an enterprise-grade endpoint protection solution. Because the device is enrolled, it is also onboarded to Defender for Business automatically, meaning any alerts or malware detections on this device will show up in the Microsoft 365 Defender security portal. You may group devices or adjust Defender for Business policies via Intune or the security portal as needed (the default policies cover most scenarios). This integration ensures the device is actively monitored for threats.

  5. Install and Configure Applications: Set up required applications (especially Microsoft 365 Apps) on the device.

    • Microsoft 365 Apps (Office) – Install the Office suite (Word, Excel, PowerPoint, Outlook, Teams, OneDrive, etc.) if not already present. Since the user has a Business Premium license, they can install Office on their PC. You can push this via Intune by assigning an “Office 365 app” installation policy or have the user log into the https://www.office.com/ and download the installer. Getting the latest Office apps deployed is important for productivity[6][9].

    • Microsoft Teams – Teams might be included with the Office install; if not, ensure Teams is installed so the user can collaborate. Intune can also deploy Teams as a separate package if needed.

    • OneDrive Sync – Configure the OneDrive client (built into Windows 10/11) to sign in with the user’s work account. This will enable file backup for Desktop/Documents/Pictures (known-folder move) and ensure cloud copies of important files (adding a layer of protection and easy transfer if the device is replaced).

    • Company Portal & Other Apps – Verify that the Company Portal app is installed (it often is auto-installed during enrollment on corporate devices). Through Company Portal, publish any additional business applications the user might need (for example, specialized software, VPN client, or browser). The user can open the portal to self-service install any available apps.

    • Browser and Productivity Tools – Install or configure required browsers or plugins. For instance, if your organization uses Microsoft Edge, ensure it’s updated and maybe sign the user into Edge with their work account for favorites/password sync. Similarly, install PDF readers or other tools as appropriate.

    • Verify App Policies – If you use Intune App Protection Policies (MAM) for mobile apps, ensure that policies for Office apps on the PC are in place if needed. For example, in BYOD scenarios, app policies might restrict saving attachments to personal locations. With full MDM on Windows, much of this is handled via device policy instead, but it’s good to confirm that after Office/Teams installation, the user can access resources (if conditional access requires apps to be protected or device to be compliant, etc., the fact that we onboarded should satisfy that).

  6. Configure User Accounts & Access Settings: Set up the user’s accounts on the device with appropriate permissions and security.

    • User Account Type – By default, the first Azure AD account on a Windows 10/11 device is added to the local Administrators group. This means the user will have admin rights on their machine (unless you have configured Intune to restrict this). While this can be convenient for the user, from a security standpoint you may want to restrict admin privileges. Consider using Intune Endpoint Security policy to remove local admin rights or using Azure AD roles for least privilege. At minimum, educate the user to use caution with their admin rights (install only trusted applications, etc.).

    • Additional Accounts – If an IT admin or another user needs access to the device, add their account under Settings > Accounts > Other users (for local accounts) or, if they are an Azure AD user, they can sign in directly by selecting “Other user” at the login screen (just ensure the device settings allow other Azure AD users to sign in, which it does by default for Azure AD join). For shared devices, you might create a dedicated local admin account and keep it secured for maintenance tasks.

    • Email and Office Apps Login – Have the user open Outlook and configure their work mailbox (with the account that’s already on the device; it should auto-discover in most cases). Likewise, ensure apps like Teams, OneDrive, and Office are activated using the user’s credentials (the Office apps will prompt the user to sign in on first launch if not already).

    • Multi-Factor Authentication – Verify that MFA is enabled on the user’s account before they start accessing resources. MFA adds a vital layer of security for sign-ins[9]. If not already enforced, configure MFA in Azure AD and have the user complete registration (using the Authenticator app or SMS/phone). This should be done ideally at first login to any Microsoft 365 app.

    • Conditional Access Policies – If your organization uses Azure AD Conditional Access, make sure the appropriate policies are in place for this device/user. For example, you can require that only compliant devices (i.e., Intune-managed and meeting policy) can access certain sensitive apps, or that MFA is required for certain logins[8]. Business Premium includes Azure AD Premium P1, allowing Conditional Access setup. This ensures that the newly onboarded device actually grants the user access to needed services (if the device wasn’t compliant, CA policies might block access, so having our security/compliance policies from step 4 is crucial).

    • OneDrive Backup Policy – Optionally, use Intune or user education to enable Known Folder Move (Documents/Desktop/Pictures backup to OneDrive). This protects user data and makes transitions easier.

    • User Training on Security – Advise the user on good security practices: e.g. not to install unapproved software, not to disable antivirus or tamper with settings (note: Defender Tamper Protection is on by default to prevent changes), and to report any unusual behavior or warnings (like malware detections) to IT.

  7. Verify Compliance and Security Posture: After initial setup, double-check that the device meets all compliance requirements and is fully protected.

    • Intune Compliance Status – In the Endpoint Manager portal, check the device’s Compliance state. If you configured a compliance policy (e.g., requiring BitLocker, a passcode of certain complexity, etc.), ensure the device is marked Compliant. If not, identify what setting is non-compliant and address it (the portal will show which requirement failed). For example, if encryption was required but BitLocker isn’t on, enable BitLocker and then sync the device to re-evaluate compliance.

    • Security Center Review – In the Microsoft 365 Defender security portal (security.microsoft.com), navigate to Devices (or the Defender for Business section) and verify the device appears there as Onboarded/Healthy. This indicates it’s reporting into Defender for endpoint protection. Check that no active security alerts are listed for the device.

    • Test Policy Enforcement – Perform a quick test of whether policies are active: e.g., try to download the EICAR test file (harmless virus test string) to see if Defender catches it, or attempt an action that should be blocked by policy (for instance, access a blocked website category if web filtering is enabled, or try to save a file to a protected folder by an untrusted app to see if Controlled Folder Access intervenes). These tests can confirm that the protections are working as intended.

    • Check Device Configuration – Review the device’s settings to make sure everything configured by policy took effect: encryption is on, antivirus is running, firewall is on, etc. Also check Windows Update settings (under Update & Security) to verify it’s either managed by Intune or set to automatic updates (see next step).

    • User Acceptance – Have the end-user confirm they can do all their work: access email, open files, print, use Wi-Fi, etc. Sometimes settings (like firewall or device name change) can incidentally affect things like network drive access or printers; verifying now ensures a smooth handover.

  8. Provide User Documentation and Support: As part of onboarding, supply the user with resources and information about their new managed device.

    • Onboarding Guide – Give the user a quick orientation on what it means for their device to be managed. For example, explain that certain security software is running (Defender) and that some settings might be enforced by the company (like password requirements or screensaver lock). If you have an internal Acceptable Use Policy or IT handbook, this is the time to share it and highlight key points (e.g., policies about personal use, installing software, etc.).

    • Instruction for Essentials – Provide instructions or documentation for common tasks new to a managed environment: how to log into Office 365, how to access the company SharePoint/Teams, how to use OneDrive for file backup, and how to get support if something goes wrong. If the user is not familiar with MFA, include a brief guide on using the Authenticator app or receiving codes.

    • List of Installed Apps and Services – Let the user know what software has been installed or is available. For instance: “Your device has Office 365 (Word, Excel, Outlook, etc.), Teams for collaboration, OneDrive for file backups, and Company Portal for additional apps. If you need any other application, check Company Portal or contact IT.” This sets expectations and encourages them to use the provided tools.

    • Privacy and Monitoring Transparency – Especially for BYOD users, clarify what the company can and cannot see on their device. For example, Intune does not collect personal files, browsing history, or photos; it mainly reports device compliance info and enforces policies. Company email and data is protected, and if the device is ever lost or the user leaves, the company can remove its data (through a remote wipe of only work data in the case of BYOD). Being transparent builds trust and ensures the user is comfortable with the management.

    • Contact Information – Provide the IT support contact details. Ensure the user knows how to reach the helpdesk or IT admin for any issues (e.g., a phone number or email, and support hours). Encourage them to report incidents like lost device immediately.

  9. Ongoing Management and Monitoring: After onboarding, IT should continuously manage and monitor the device through Microsoft 365 services.

    • Microsoft Endpoint Manager (Intune) – Regularly review the device’s status in Intune. Check that it remains compliant and check-in is happening (devices that haven’t reported in for a long time might be offline or have an issue). Intune provides device reports you can consult, and you can even set an alert if a device becomes non-compliant. Through Intune, you can also push future configuration changes or apps to the device as needed.

    • Microsoft Defender Security Portal – Monitor security alerts or recommendations for the device. Microsoft Defender for Business will log detections of malware, vulnerabilities, or risky behavior on the endpoint[8]. Ensure someone on the IT team is assigned to follow up on any alerts (e.g., malware quarantined, or abnormal activity). The Defender portal’s incident queue should be checked periodically.

    • Conditional Access and Sign-in Logs – Use Azure AD’s sign-in logs and Conditional Access reports to monitor how the device is being used. For example, if there are sign-in attempts from unexpected locations or many failed logins, it could indicate a problem. The device compliance report in Azure AD can show if the device ever falls out of compliance (someone turning off BitLocker, etc.).

    • User Feedback – Keep communication open with the user. Check in after a week or two to ensure they aren’t experiencing any problems under management (sometimes policies might need tweaking if they hinder productivity). Also remind them to report any issues promptly.

    • Device Grouping – In Intune or Defender, group devices (e.g., all “Sales Laptops” or all “BYOD”) for easier management. This is more for IT organization, but Business Premium allows creating device groups and targeting policies to them[5]. This way, as you onboard more devices, you apply consistent policies and can monitor by groups.

    • Logging and Auditing – Ensure that actions like device wipes, policy changes, or user role changes are audited. M365 has audit logs – useful for tracking lifecycle events for the device.

  10. Maintenance: Updates and Patching: Keep the device and its software up to date to maintain security over time.

    • Windows Updates – Microsoft 365 Business Premium supports Windows Update for Business, allowing you to manage Windows Updates through Intune policies. Configure update rings in Intune to automatically deploy Windows quality updates (patches) and feature updates on a defined schedule. This ensures the device always has the latest security patches[8]. The device should be set to install updates automatically (often the default). Regularly verify in Intune or on the device (Settings > Windows Update) that updates are being applied successfully.

    • Microsoft 365 Apps Updates – Office apps update themselves via Click-to-Run. You can set the update channel via policy (e.g., Monthly Enterprise Channel for less frequent changes or Current Channel for latest features). Make sure the Office apps are updating – users should periodically accept updates if prompted, or IT can force updates via Intune scripting if needed.

    • Defender Updates – Defender AV definitions and threat intelligence updates are automatic through Windows Update or cloud delivery. Just ensure the device checks in to Microsoft Update. Intune can report on AV signature status. No heavy action is needed here aside from monitoring.

    • Third-Party Software – Keep any other installed software (browsers, PDF readers, etc.) updated. Intune can deploy some app updates or you may need a third-party patching solution for comprehensive coverage. At minimum, enable auto-update within apps (for example, Google Chrome’s auto-update) when possible.

    • Periodic Review – It’s wise to periodically review the device’s configuration against your baseline. For instance, every quarter verify BitLocker is still enabled and keys are escrowed, check that the device is running a supported Windows version, and confirm compliance with new policies (if you tightened standards, e.g., required a shorter lock screen timer, etc.).

    • User Training Refreshers – As part of maintenance, remind the user about security practices and any new threats (for example, phishing awareness). The human element is critical to maintain protection beyond just technical updates.

  11. Troubleshooting Common Onboarding Issues: Be prepared to troubleshoot if things don’t go as planned during device onboarding.

    • Cannot Join or Enroll Device – If the Azure AD join/registration fails or Intune enrollment doesn’t happen, double-check prerequisites: Is the Windows edition Pro? (If the user sees a message about needing Windows 10 Pro, upgrade the OS first[2].) Is the user’s account definitely licensed for Business Premium/Intune? (Without an Intune license, enrollment will be refused.) Also verify the device’s time and region settings are correct (sign-in can fail if the system clock is far off).

    • Device Not Showing in Intune – If Azure AD join succeeded but the device doesn’t appear in Intune, ensure auto-enrollment was enabled (Step 1). You may manually initiate enrollment via Company Portal as a fallback. Also, in Azure AD portal check the device’s MDM status; it should list “Microsoft Intune”. If it says “none”, the MDM scope might’ve been misconfigured – set the MDM user scope to All and try again (you can disconnect and re-join the device to Azure AD after fixing MDM settings).

    • Policies Not Applying – If the device enrolls but isn’t getting the expected policies or apps, force a sync. On the device, go to Settings > Accounts > Access work or school, click the connected account and choose Info > Sync. Or use Company Portal app’s Sync function. Ensure the device is in the group targeted by the policies. It may take some time (several minutes) after enrollment for everything to come down. In Intune portal, you can view the device’s Device Configuration to see if there are errors applying any profile. Resolve any conflicts or scope issues (e.g., two policies setting contradictory password requirements can cause one to fail).

    • User Login or Profile Issues – After Azure AD join, if the user cannot log in with their work account, double-check that the account credentials are correct. If the device says “no logon servers” or similar, that indicates no internet – ensure the device has connectivity at login (Azure AD login needs internet for the first sign-in). If the user is stuck on a temporary profile or cannot see their old data, recall that their old local account is separate – you may need to migrate files (see note in Step 3).

    • Compliance Errors – If Intune marks the device non-compliant (and perhaps Conditional Access is blocking the user), review the compliance policy. A common issue is missing BitLocker encryption or an outdated OS version. Have the device implement the required setting (enable BitLocker, install updates, etc.), then sync. If compliance policies require a device reboot (e.g., after encryption) make sure to reboot. You can also initiate a Fresh Scan for compliance from the Intune portal for the device.

    • Defender for Business Onboarding – Usually Intune takes care of this. But if in the security portal the device is not listed, you might need to manually onboard it. (This is rare for Business Premium – devices auto-onboard via Intune.) You could download a local onboarding script from the Defender portal and run it on the device as admin[4][4], but ensure this isn’t needed by checking the portal first.

    • Support Resources – Be aware of official Microsoft docs and tools for troubleshooting. Microsoft provides a Troubleshooting Windows device enrollment guide with common errors and resolutions[7]. Also, the Intune Diagnostics app (built into Windows 10/11 – accessed via tracker.ddiagnostics in browser) can collect logs if an issue is persistent. Leverage Microsoft support if a blocking issue arises.

  12. Handling Personal Devices vs. Company-Owned Devices: Adjust the approach based on ownership of the device.

    • Enrollment Method – For company-owned devices, prefer Azure AD Join with full Intune enrollment (as detailed above) for complete management control. For BYOD (Bring Your Own Device) where users may be cautious about IT control, use Azure AD registration + MAM or ask the user to enroll via Company Portal. This will apply security controls to corporate apps/data without fully taking over the device. Microsoft 365 Business Premium supports both scenarios and includes tools for each.

    • Policy Variations – You can have different Intune policies for personal devices vs. corporate. Intune tags Azure AD joined devices as “Corporate” and registered ones as “Personal”. For corporate devices, you might enforce stricter policies (mandatory BitLocker, software installation restrictions, etc.). For personal devices, you might choose lighter-touch policies or just rely on App Protection (e.g., require a PIN for Outlook app, encryption of work files, but not encrypt the whole device). App Protection Policies keep company data within approved apps and can prevent data from being saved to personal locations[10]. Use Conditional Access to ensure that if a device is not fully compliant or not corporate-owned, the user can only access cloud data in protected apps, not download to device.

    • Data Privacy – Assure BYOD users that their personal content remains private. Intune’s MDM on personal Windows 10/11 will primarily enforce security settings and isn’t poking into personal files. If users are uncomfortable with MDM, you could allow them to access M365 resources via web or MAM-only policies (though on Windows, MAM-only is less common than on mobile). It’s a balance of security vs. user privacy that your organization’s policy should define. Clearly document what corporate IT will manage on a BYOD (perhaps requiring a device PIN, the right to wipe corporate data, etc.).

    • Removal and Support – For corporate devices, IT can fully wipe or re-image the machine as needed (e.g., when the employee leaves or the device is repurposed). For personal devices, if the employee leaves or opts out, you should perform a Selective Wipe (Intune Retire action) to remove only company data/profiles, leaving personal stuff intact[10]. Users should know they can unenroll their personal device if they leave the company, restoring it to purely personal use.

    • Summary of Differences:

      Aspect
      Company-Owned Device (Fully Managed)
      Personal/BYOD Device (Lightly Managed)

      Enrollment
      Azure AD Join + Intune MDM (device appears as Corporate)
      Azure AD Registered + Intune MDM (or MAM only), marked as Personal

      Control Level
      Full control: device-wide policies, full wipe if needed
      Limited control: primarily protects corporate apps/data, can retire corporate data

      Policies Applied
      All device policies (AV, firewall, encryption, etc.) enforced
      Basic device compliances (maybe require AV, PIN) or just app protection policies

      Data Separation
      Not applicable (device is dedicated to company use)
      Company data kept in separate apps/containers      [10], personal data not touched by IT

      User Admin Rights
      Typically yes (by default), but IT may restrict if desired
      Yes, it’s the user’s own device – admin rights not removed

      Device Removal
      Full wipe or reassignment via Intune (device can be factory reset remotely)
      Corporate access removed via Retire (apps and accounts removed, no OS reset)      [10]

    Both scenarios benefit from Business Premium’s security features, but the implementation will differ to respect ownership. Always apply minimum necessary management for BYOD to secure corporate data while preserving user privacy, and use stronger management on corporate assets where the company has full responsibility for the device.

  13. Decommissioning a Device: When a device is no longer needed or is being replaced or the user leaves, properly remove it from management.

    • Intune Retire/Wipe – In the Endpoint Manager portal, locate the device and decide whether to Retire or Wipe it. Retire removes Intune management and all company data (managed apps, profiles, etc.) but leaves personal data intact – use this for BYOD or scenarios where the user keeps the device for personal use[10][8]. Wipe triggers a factory reset (all data removed, device returns to out-of-box state) – use for company-owned devices being repurposed or returned, or a lost device that you need to brick for security. There is also a Selective Wipe specifically for just removing work account data (especially on mobile devices), which is essentially what Retire does for Windows.

    • BitLocker Recovery and Key – If the device was encrypted and is being transferred or disposed of, make sure you have the BitLocker recovery key if needed to access the drive. For reuse within company, you might simply re-encrypt after reassigning. For disposal or return to a leasing company, a full wipe (with BitLocker in place) is usually sufficient to ensure data cannot be accessed. You can also choose to securely overwrite the disk if required by policy.

    • Azure AD Device Cleanup – In Azure AD > Devices, find the device entry and disable or delete it after it’s been wiped/retired. This removes the object from Azure AD (tidying up the directory and preventing stale entries). If the device was Autopilot-registered, you might also remove its registration if it’s leaving permanently.

    • License Reclamation – Unassign any dedicated licenses if the user or device was consuming one (in Business Premium, licenses are per user, so if the user leaves, free up that license in the Microsoft 365 admin center for re-use). There’s no license tied specifically to the device aside from Windows (which is OEM or the upgrade rights); the Windows 10/11 Pro remains on the device for the next owner as it was purchased or obtained via subscription.

    • Documentation – Update your asset inventory to mark the device as decommissioned. If it’s being reused for another employee, you’ll be onboarding it again (consider using Autopilot Reset to prepare it). If it’s being disposed or transferred, log that detail. Keep a record of Intune wipe actions and Azure AD deletions (these actions are logged in the audit logs) in case you need proof that data was wiped for compliance.

    • User Offboarding – If the user tied to the device is leaving the organization, ensure their M365 account is disabled or removed according to your user offboarding process, and mail/data retention is handled (this is beyond device scope but important for completeness).

By following this checklist, your Windows device should be successfully onboarded to Microsoft 365 Business Premium with full management and protection. The device will be protected by enterprise-grade security (virus protection, firewall, encryption, threat detection) and controlled via Intune policies, as well as monitored for compliance[8][8]. Both the IT administrator and the end-user have clear steps to ensure the device remains secure and functional throughout its life cycle in the organization. This process not only hardens the device against threats but also integrates it into your company’s cloud environment, enabling secure remote work and easy access to resources. Keep this checklist handy for future onboardings, and update it as Microsoft evolves the Business Premium features or your company’s policies change. Good device management is an ongoing process – with the device now in Intune, you are well-positioned to manage updates, security incidents, and eventual offboarding with confidence. [5][8]

References

[1] Does MICROSOFT 365 E3 (not Office 365 E3) include Windows 10 or not!?

[2] new device to add to 365 business account – Microsoft Community

[3] Step-by-Step Guide For Windows Devices Enrollment In Microsoft Intune …

[4] Onboard devices to Microsoft Defender for Business

[5] View or edit device protection policies – Microsoft 365 Business …

[6] Secure managed devices with Microsoft 365 Business Premium

[7] Enroll Windows 10/11 devices in Intune | Microsoft Learn

[8] Overview of Microsoft 365 Business Premium Security

[9] Set up unmanaged devices with Microsoft 365 Business Premium …

[10] Microsoft 365 Business Premium

Comprehensive Android Device Onboarding Checklist for M365 Business Premium

bp1

Onboarding an Android phone into Microsoft 365 Business Premium (which includes Microsoft Intune for device management) ensures the device is fully managed and protected. This detailed checklist covers every step – from preparation to post-deployment – including security configurations, policies, and ongoing management. Follow the sequence below to set up the Android device securely and keep it compliant with your organisation’s standards.

Step-by-Step Onboarding Process

  1. Prepare the M365 Environment for Android Management

    • Verify Licensing & Access: Ensure the user is assigned a Microsoft 365 Business Premium license (this license includes Intune for Mobile Device Management). Also, have administrator access to the Microsoft 365 admin center and Endpoint Manager (Intune) portal.

    • Intune Tenant Preparation: Confirm Intune is set as the MDM authority (in modern tenants Intune is already the default). If not done previously, set up Intune by signing in to the Endpoint Manager admin center and reviewing enrollment preparation steps. For example, verify your tenant’s enrollment restrictions and device limit settings to allow Android enrollments.

    • Link Intune to Managed Google Play: Configure Android Enterprise integration by connecting Intune to a Managed Google Play account[1][2]. This is required for managing Android devices. In the Endpoint Manager portal, navigate to Devices > Android > Android Enrollment and connect your Intune account to Managed Google Play. Follow the on-screen steps to sign in with a corporate Google account and grant permissions[1]. Result: Intune is linked with Google Play, and the Company Portal app (and other Android Enterprise system apps) will be made available to devices automatically[2].

    • Choose Android Management Mode: Decide on the management mode. For corporate-owned devices that will be fully controlled by IT, use Android Enterprise Fully Managed (formerly COBO – Corporate Owned, Business Only)[1]. (For BYOD personal devices, you’d use Work Profile mode, but this guide focuses on fully managed corporate devices for maximum control and protection.) Ensure the Android OS version on the phone is supported by Intune and Android Enterprise (generally Android 9.0 or above for fully managed)[3]. If the device was previously enrolled in another MDM or used personally, factory reset it now – fully managed enrollment requires a fresh start[2].

    • Configure Initial Device Settings (Optional): If your organisation uses zero-touch enrollment or Samsung Knox Mobile Enrollment for bulk provisioning, set those up in advance. For Zero-Touch or Knox, you’d upload device IDs to those portals and link to Intune enrollment profiles. Otherwise, plan to enroll via QR code or the Company Portal app. Ensure you have a stable Wi-Fi network available for the device’s enrollment.

  2. Define Security Policies in Intune (Compliance & Configuration)
    Before enrolling the device, set up the security policies that will apply upon enrollment. This ensures that as soon as the phone is onboarded, it will receive the required configurations to be secure.

    • Create Compliance Policy: In Endpoint Manager (Devices > Compliance policies), create a new Android compliance policy to enforce your security requirements. Configure rules such as: require a password/PIN on the device (e.g. minimum 6-digit PIN, alphanumeric or complex as needed)[3][3], require device encryption to be enabled[3], set a minimum OS version (e.g. disallow Android versions lower than a certain release)[3], and block jailbroken/rooted devices by enabling Google Play Integrity or SafetyNet checks[3]. You can also mandate that the device is not on a blocked manufacturer/model list if relevant. Define an action for non-compliance (e.g. send user notification or block access after a grace period) – by default, marking the device non-compliant immediately is recommended[3].

    • Create Configuration Profiles: Next, create an Android device configuration profile (specifically an “Device Restrictions” profile for fully managed Android Enterprise). In Endpoint Manager (Devices > Configuration profiles), set restrictions to harden the device. Recommended settings include: disable USB file transfers and external media access to prevent data leaks[3]; block screen capture and screen recording; disable installation from unknown sources (to stop unapproved apps); enforce Google Play Protect app scanning (Threat Scan on apps: Require to ensure malware scanning is active)[3]; require device encryption if not already enforced via compliance; and enable other desired restrictions (e.g. block Bluetooth file sharing, block factory reset by the end-user[3], and force automatic system updates installation on a schedule). Also consider enabling biometric unlock (fingerprint/face) if available for user convenience on top of PIN – Intune can require biometrics for unlock via policy[1].

    • Email and App Configuration (Policy): If you plan to use the native email app (Gmail) for work email, create an “Email profile” configuration profile (with Exchange Online details) to push to the device. However, the recommended approach is to deploy Outlook (covered in the next step) instead of using native email. You can also prepare App Configuration policies for certain apps if needed (for example, pre-configure Outlook’s settings or require a PIN within Outlook app using an App Protection Policy).

    • Conditional Access (Integration with Azure AD): Set up a conditional access policy in Azure AD (if not already) to require device compliance for accessing corporate resources. For example, enforce that only devices marked Compliant by Intune (meaning they meet the above policy conditions) can access Exchange Online, SharePoint, Teams, etc.[4]. This ties the Intune compliance policy to actual access control, ensuring unmanaged or non-compliant devices are blocked from M365 data. (Note: Conditional Access requires Azure AD Premium, which is included in Business Premium.)
    • Review and Save Policies: Save and deploy these policies to the target user or device groups (e.g. to “All corporate devices” or specific user groups). Result: With compliance and configuration profiles in place, any enrolled device must adhere to these security requirements to be deemed compliant and maintain access[4].

  3. Enroll the Android Device into Intune (M365 Management)
    Now that the backend is prepared, proceed to enroll the phone. There are a few enrollment methods for a fully managed device – here we use the QR code method (suitable for Android Enterprise fully managed) or the Company Portal app method:

    • Generate Enrollment QR Code/Token: In Endpoint Manager, go to Devices > Android > Android Enrollment > Enrollment Profiles. Create a “Corporate-owned, fully managed user device” enrollment profile if you haven’t already[1]. Intune will provide an enrollment token (string code) and an option to get a QR code. This QR code or token will be used on the device during setup. (If using Android’s Zero-Touch enrollment or Samsung Knox, you would assign this profile to the device in those portals instead.) For a streamlined experience, the QR code is very convenient – it embeds the enrollment token and Intune’s info.

    • Factory Reset & Initial Setup: Ensure the Android phone is factory reset. Turn on the device (or if just reset, start the setup wizard). Follow the initial prompts (select language, connect to Wi-Fi, etc.). When prompted to sign in or when you reach a screen for device management, use the enrollment method:
      • QR Code enrollment: Tap multiple times on the welcome screen (or in setup, choose “Perform QR code enrollment” if available). Scan the QR code from Intune using the device’s camera. This will automatically configure the device to enroll in Intune.

      • Token entry enrollment: Alternatively, in the Wi-Fi selection screen, you can enter the code afw#setup in the Wi-Fi SSID field (this triggers Android Enterprise setup) and then you will be prompted to enter the enrollment token manually (or sign in to Google to retrieve it). Enter the enrollment token from Intune to proceed.

      • Company Portal app (for BYOD or if already set up): If the device was not factory reset (for example, if doing a personal device with work profile), the user could simply install the Intune Company Portal app from Google Play, launch it, and sign in with work credentials to enroll. In our fully managed scenario, the QR code method is more automated and ensures full control.
    • Intune Enrollment Process: After scanning the QR code or entering the token, the device will automatically download and install the Intune Company Portal and related management apps. It will prompt for the user’s Azure AD (M365) credentials. Sign in with the company (work) account when prompted (this binds the device to the user in Azure AD). The device will then enroll into Intune – you’ll see screens indicating the device is being managed by your organization.

    • Apply Corporate Profile: The enrollment profile will apply, marking the device as corporate-owned. The device may also set up a work Google account silently to manage Managed Play apps. The phone will likely enforce a PIN code setup at this point if your compliance policy requires one. Follow any on-screen instructions (e.g. “create a work profile” or “set a PIN to secure your device”). For fully managed devices, the entire device is now under management (not just a work profile).

    • Network & Sync: Ensure the phone stays connected to the internet during this process. Intune will start pushing down the configurations and apps assigned to this device/user. This can take a few minutes.

    • Verification: In the Endpoint Manager portal, you can check Devices > All Devices, and you should see the new Android phone appear in the list once enrollment is complete. It will show as “Compliant” or “Not compliant” depending on whether it has finished applying policies. (At first, it might be non-compliant until all policies are applied – this is normal. The device will continuously sync until it meets the compliance criteria.)

  4. Deploy and Configure Microsoft 365 Apps (Email, Teams, etc.)
    To ensure productivity and security, install the required Office/M365 applications on the device through Intune and configure them properly:

    • App Deployment via Managed Play: Using Intune’s integration with Managed Google Play, you should have added key apps in advance. If not done yet, go to Apps > Android Apps in Intune, and Add apps from the Managed Google Play store. Search and add apps like Microsoft Outlook, Microsoft Teams, OneDrive, Office (Mobile), Microsoft Authenticator, and any other required apps (such as Line of Business apps)[1]. Assign these apps to the device or user group (as “Required” for corporate devices so they install automatically)[1]. Intune will then push these apps to the enrolled phone.

    • Email Configuration: Outlook Mobile is the recommended email client. Once Intune pushes Outlook and it installs on the phone, the user should launch Outlook. The app may auto-detect the user’s account (through single sign-on with the managed device) or prompt the user to add their Office 365 email account. The user should sign in with their work credentials. Because the device is marked compliant (and conditional access is in place), the email account will successfully configure and start syncing mail. If you instead use the native email app, ensure an email profile policy was sent or instruct the user to add the account via system settings (and expect a prompt to enforce Device Administrator if Office 365 MDM was not already in effect – but since Intune MDM is handling it, Outlook is simpler).

    • Other App Sign-ins: Have the user open other apps like Teams and OneDrive – these should similarly either SSO sign-in or prompt for login with the work account. Verify that each app works and that policies like App Protection (if configured) are applied (for instance, if you set an App Protection Policy, it might require a PIN when opening Outlook or prevent copying data from Outlook to personal apps).

    • Policy Enforcement on Apps: Thanks to the earlier Managed Google Play setup, all apps deployed are the approved versions. Intune can manage permissions for certain apps if configured (for example, you can pre-grant or deny permissions to apps through the Device Restrictions profile). Ensure that Microsoft Defender (if your organisation uses it for mobile threat defense) is also deployed (see next step for more on Defender).

  5. Verify Device Compliance and Security Settings
    At this stage, the phone is enrolled and apps installed. Now verify that all security configurations are in effect and the device is compliant:

    • Compliance Check: On the device, open the Company Portal app. It should show the device status as compliant (green check) or list any actions needed. If any compliance item is missing, the Company Portal will typically prompt the user (for example, “Set a device PIN of at least 6 digits” if the user hadn’t done so, or “Encrypt your device” if encryption wasn’t automatic). Follow any prompts to resolve outstanding issues. Modern Android devices usually encrypt by default when a PIN/password is set, satisfying the encryption requirement automatically[3].

    • Intune Portal Status: In the Endpoint Manager admin center, check the device’s Compliance status. It should be Compliant if all policies are met. If it shows Not Compliant, review which setting is not met. Common causes: the user hasn’t set a required PIN or the device is still installing a required update or app. You can select the device in Intune and view Device Compliance to see a per-setting report. Resolve any outstanding compliance issues by either adjusting the device settings or updating the policies if necessary.

    • Security Policy Enforcement: Verify specific configurations: try taking a screenshot on the device – if you set “block screen capture,” it should be disabled by policy[1]. Attempt to plug the phone into a PC via USB – with USB data transfer blocked, the phone’s storage should not be accessible[3]. These tests confirm that the device restrictions profile is active. Also check that the required PIN complexity is enforced (e.g., try setting a too-simple PIN to see if it gets rejected as per policy).

    • Defender for Endpoint (Optional): If Microsoft Defender for Endpoint (part of Defender for Business in M365 Business Premium) is being used, ensure the Defender app is installed and onboarded. (Intune can deploy the Defender app just like other apps[1][1]. After installation, the user should open the Defender app and sign in to activate it[1][1]. Once onboarded, the device will show up in the Defender portal with its threat status.) This adds an extra layer of protection by scanning for malicious apps, phishing SMS, unsafe network connections, etc.

    • Encryption Status: Confirm the device storage is encrypted. On the phone, you can usually see this under Settings > Security > Encryption (it might say “Encrypted” if all is well). Intune can also report encryption status as part of compliance. This ensures data on the phone is protected if the device is lost.

    • Corporate Data Separation: Although this is a fully managed device (all data is corporate-managed), if any work/personal profile distinction exists (in COPE scenarios), verify that policies for data separation are applied (e.g. copying data from work apps to personal apps is restricted). In our fully managed case, all apps are corporate, so all data is under management and protected by policies like App Protection or the device encryption.

    • Compliance Reports: Intune provides compliance reports and dashboards. Use Devices > Monitor > Compliance in the portal to see an overview of device compliance across your organisation. Ensure this newly onboarded device appears with green status. Monitoring these reports regularly is important for ongoing compliance[5].

  6. Enable and Test Device Management Features
    With the device now managed, you have various remote management capabilities to secure and support it throughout its lifecycle:

    • Remote Wipe / Reset: In Intune, locate the device and test a Retire or Wipe command (caution: do this only for testing if you have no real data on the device, or just be aware of the capability). A Retire action removes the company’s data and management profiles but leaves personal data intact[6]. A Wipe fully resets the device to factory settings, erasing all data[6]. Use Retire for employee personal devices when they leave the company, and use Wipe if a device is lost/stolen or being reissued to someone else. Verify: If possible, simulate a Retire on a test device – the Company Portal and managed apps should get removed, and the device will lose access to corporate email (this demonstrates your ability to protect data if needed). Cancel or avoid a full wipe unless you are ready to reset the device.

    • Remote Lock and Passcode Reset: Intune supports remote locking of a device and resetting the passcode. These actions can be initiated from the device’s page in Endpoint Manager. This is useful if a device is misplaced or the user forgets their PIN. (Fully managed Android devices may support these commands – verify on a test device.)

    • Device Encryption Enforcement: We already required encryption via compliance. If the device for some reason wasn’t encrypted, Intune would mark it non-compliant. There isn’t usually a separate action needed, as modern Android will encrypt upon setting a PIN. However, it’s worth noting for older devices: you might instruct the user through Company Portal to enable encryption if it didn’t happen automatically. Ensure no one turns encryption off (some devices might allow decrypting via settings – which should also flip compliance to non-compliant).

    • Policy Updates & Sync: Know that you can push policy updates or new configurations anytime. For example, if you want to enable a new Wi-Fi profile or VPN configuration on the phone, you can create a profile in Intune and assign it; the device will receive it on next check-in (devices check in with Intune periodically, or the user can open Company Portal and tap “Check Device Settings” to force a sync).

    • Defender and Threat Management: If using Defender, you can view device risk in the Defender Security portal. Intune can also take action based on device risk (via compliance policies integrating with Defender threat level). Make sure Defender is actively protecting the device (run a test EICAR virus file if you want to see if Defender catches it, for example).

    • User Support Abilities: In the Company Portal, the user can see company contacts or support info (you can customise the Company Portal branding and contact details in Intune). It’s good practice to configure Help Desk information there so users know how to get assistance. Also, the user can use the Company Portal to see which policies are applied, which apps are available, and initiate a sync or check compliance. Encourage users to familiarize themselves with the Company Portal app.

  7. Manage Operating System and App Updates
    Keeping the device up-to-date is critical for security. Microsoft Intune provides mechanisms to manage Android OS updates for corporate devices:

    • Configure System Update Policy: In your Device Restrictions configuration profile (created earlier), use the System update settings to control how updates are applied[7]. Options include: using the device default (updates auto-install when idle, charging, on Wi-Fi), forcing automatic install ASAP (no user delay)[7], or postponing updates for a defined period (e.g. postpone up to 30 days)[7]. You can also set a maintenance window for updates (so updates install during off-hours)[7]. For example, you might allow automatic nightly updates or weekend updates to minimise disruption.

    • Enforce Updates (Don’t Rely on Users): It’s best practice not to rely on end users to install OS patches[7]. Intune policies ensure updates happen so that users cannot indefinitely defer important patches[7]. For instance, if an update is deferred 30 days, Intune will prompt or force installation after that. Make sure devices are set to a schedule that balances security with usability (and communicate this to users so they know their device may reboot for updates at designated times).

    • App Updates via Managed Play: Apps deployed through Managed Google Play will be updated automatically via the Play Store (according to Play Store policies). Intune itself doesn’t directly schedule app updates, but by using Managed Play, you ensure the user cannot disable auto-updates for those apps. Periodically check in the Managed Play store if critical apps (e.g. Outlook, Teams) have updates that might require admin approval (for apps in Managed Play, you might need to approve new versions depending on your Play enterprise settings – the default is usually automatic approval).

    • Monitor Update Compliance: Use Intune’s Reports (under Devices > Monitor > Software update status for Android) to see the OS update status of devices. Ensure all devices, including this one, are not running significantly outdated patch levels. You can also enforce compliance by setting a Minimum Android security patch level in the compliance policy if desired (for example, require that the device’s security patch date is no older than 2 or 3 months)[3]. This will mark devices non-compliant if they fall behind on security updates, adding pressure to get them updated.

    • Plan for Upgrade Cycles: When Android releases major new versions, test them with your policies. Intune allows setting a minimum or maximum OS version in compliance, so update those rules over time as you

References

[1] Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune

[2] Android device enrollment guide for Microsoft Intune

[3] Android Enterprise security configurations for corporate-owned fully …

[4] How Conditional Access Works in M365 Business Premium

[5] iPhone Onboarding into M365 Business Premium Step-by-Step Guide

[6] Administrative Intune Offboarding

[7] Admin checklist for Android software updates in Microsoft Intune

iPhone Onboarding into M365 Business Premium: Step-by-Step Guide

bp1

Overview:
This guide provides a comprehensive checklist for onboarding an iPhone into Microsoft 365 Business Premium (which includes Microsoft Intune) so that the device is fully managed and protected. It covers initial setup, detailed step-by-step enrollment procedures, specific security configurations, ongoing management tasks, and compliance considerations. By following this checklist, your organisation can ensure iPhones are enrolled in Mobile Device Management (MDM), secured with best-practice policies, and compliant with relevant standards.

Prerequisites and Preparation

Before enrolling an iPhone in M365 Business Premium/Intune, make sure the following prerequisites are in place:

  • Licenses and Accounts:

    • The user must have a valid Microsoft 365 Business Premium license (which includes Intune). Ensure the user’s account has an Intune license assigned[1].

    • You must have appropriate admin roles in Intune (e.g. Intune Administrator or Policy and Profile Manager) to perform the setup.

  • Device Requirements:

    • The iPhone should be running a supported iOS version (iOS 14.0 or later is required for Intune enrollment)[1][2]. Newer iOS versions are recommended.

    • The device should be factory reset or not previously MDM-enrolled. Remove any existing management profiles or accounts from the iPhone. (On the device, check Settings > General > Device Management; if a management profile is listed, remove it before proceeding[2].)

  • Network and Apps:

    • The iPhone has a reliable Wi-Fi or mobile data connection (maintain connectivity throughout the enrollment)[1].

    • The Safari browser (built-in) should be available for profile installation during enrollment[1].

    • Install the Intune Company Portal app from the Apple App Store on the iPhone[1]. This app is used for user-driven enrollment and device compliance checks.

  • MDM Setup in Microsoft 365:

    • Set MDM Authority: Verify that Intune is enabled as the Mobile Device Management authority in your tenant (for new M365 tenants this is usually already the case).

    • Apple MDM Push Certificate (APNs): Set up an Apple Push Notification Service certificate in Intune before any iOS device enrollment[2]. This certificate allows Intune to manage Apple devices.

    • In the Intune admin center, navigate to Devices > Enroll devices > Apple enrollment > Apple MDM Push certificate. Follow the steps to create and download a Certificate Signing Request (CSR), then upload it to Apple’s Push Certificates Portal to obtain the APNs certificate, and finally upload that certificate to Intune[1][1].

    • Note: The APNs certificate must be renewed annually. It’s tied to an Apple ID (use a company Apple ID email account for this). Intune will warn you as the expiration approaches; renew the certificate before it expires to avoid losing the ability to manage iOS devices[2].

  • Apple Business Manager (for Corporate Devices):
    If your organisation uses Apple Business Manager (ABM) or Apple School Manager for corporate-owned iPhones, integrate it with Intune for Automated Device Enrollment (formerly DEP). This allows zero-touch setup of devices that are purchased through Apple and makes them supervised (giving greater management control).

    • Ensure devices are added to your ABM account (either by purchasing through ABM or via Apple Configurator for existing devices).

    • In Intune, go to Devices > iOS/iPadOS > Enrollment Program Tokens and create an ABM token by uploading the key from Intune to Apple and vice versa[3][3].

    • Create an enrollment profile in Intune and assign it to the ABM devices (specify supervision, MDM user affinity, etc.)[3][3].

    • Outcome: When a new or erased iPhone is turned on, it will automatically enroll into Intune during setup with the defined management profile[3]. (If you are not using ABM, or for BYOD scenarios, you will use the Company Portal method described below.)

  • Intune Groups and Policies Preparation:

    • Set up Azure AD groups for device or user targeting (for example, a group for “Managed iPhone Users”). This will help in assigning policies and apps.

    • Draft your Compliance Policy and Configuration Profiles for iOS in Intune ahead of time (detailed in the security configuration section). Having these in place ensures that once the device enrolls, it will automatically receive the required settings and be evaluated for compliance[4].

    • Optionally, prepare Company Portal branding and Terms of Use in Intune to show a corporate welcome or usage policy to users during enrollment (this can include an acceptable use policy for mobile devices).

  • User Communication:

    • Plan a communication to the end user (if user-assisted enrollment) explaining the enrollment steps and why device management is needed. End-user guides or an enrollment workshop can improve success rates. Make sure users are aware of what data IT can and cannot see on managed personal devices (privacy notice).

    • Training: Be ready to provide help or training on using the Company Portal app, accessing work resources, and any changes in device behavior after enrollment (such as needing a stronger passcode) – this helps user adoption.

With these prerequisites complete, you are ready to onboard the iPhone into Intune (M365 Business Premium) with full management and security.

Initial Onboarding Steps

Follow these steps to enroll the iPhone in Microsoft 365 Business Premium’s management (Intune):

1. Configure Intune for iOS Management (Admin Task)

  • Intune Portal Access: Sign in to the https://endpoint.microsoft.com with an administrator account.

  • Verify Prerequisites: Double-check that the Apple MDM Push Certificate is configured in Intune[1] and that the user account is properly licensed for Intune (M365 Business Premium assigned)[1].

  • Device Enrollment Restrictions: Optionally, review enrollment restrictions under Devices > Enroll devices > Enrollment restrictions. You can restrict which platforms can enroll (ensure iOS is allowed) or limit enrollment to certain OS versions, device ownership types, etc[2][2]. For example, you might block very old iOS versions or limit personal device enrollments if desired.

2. Create Compliance and Configuration Policies (Admin Task)
Before or immediately after enrollment, apply security configurations by creating policies in Intune. This ensures the device will be fully protected as soon as it’s managed. Key policies include:

  • Device Compliance Policy for iOS: Define the minimum requirements the iPhone must meet to be considered compliant[2]. For instance: require a device passcode, block jailbroken devices, require encryption (on iOS, setting a passcode automatically enables encryption)[2], enforce a minimum OS version, and set other security rules (detailed in the next section). Once created, assign this policy to the relevant user/device group. This policy will evaluate the iPhone after enrollment and mark it as Compliant or Non-compliant according to your rules.

  • Configuration Profiles: Set up any device configuration profiles needed. Examples:

    • Device Restrictions profile: to enforce specific settings (like disallowing backup to iCloud for corporate data, blocking installation of untrusted apps, or preventing removal of the management profile for supervised corporate devices).

    • Wi-Fi or Email profiles: to automatically configure company Wi-Fi networks or email accounts on the device[5] (note: for email, Intune can deploy a managed email profile; requiring the device to use that ensures email is accessed securely[5]).

    • App Deployment: Prepare required app deployments (e.g., Outlook, Teams, OneDrive) or app protections. In Intune, you can assign Managed Apps to the device or user group so they install during or after enrollment.

  • App Protection Policies (MAM): (Optional, mostly for BYOD scenarios) If some users won’t fully enroll devices, you could use App Protection Policies to protect company data at the application level[6][6]. However, since this scenario is for fully managed devices, we assume full enrollment. Still, Intune MAM policies can add an extra layer of data protection for corporate apps (e.g. requiring a PIN in Outlook, blocking data transfer to personal apps)[6][6].

    By setting these policies now, you ensure that as soon as the device is enrolled, Intune will apply all the security requirements automatically. ✅

3. Initiate iPhone Enrollment
Now it’s time to enroll the device. There are two primary enrollment methods depending on ownership:

  • (A) Corporate-Owned Device – Automated Enrollment via Apple Business Manager:
    If the iPhone is company-owned and has been added to Apple Business Manager (ABM):

    • Turn on or reset the iPhone. During the initial setup wizard, after choosing language/region and network, the device will contact Apple’s deployment service and recognize that it is assigned to your organisation’s MDM (Intune).

    • You will see a screen indicating the device will be automatically configured by your organisation. Continue with the prompts. The device will enroll itself over the air into Intune with the settings from the enrollment profile you assigned (no need to manually download a profile)[3][3].

    • Sign in with the user’s work or school (Microsoft Entra/Azure AD) account when prompted. This will register the device to that user in Intune (user affinity) and complete the enrollment.

    • Once finished, the iPhone will be in supervised mode (granting enhanced control) and the Company Portal app may be pre-installed as part of the process. The user might still need to open Company Portal to finalize compliance checks.

      ABM enrollment streamlines the process – it’s largely automatic after initial setup, and the device is fully managed from the start.

  • (B) BYOD or Non-ABM Device – User-Driven Enrollment via Company Portal:
    For personal or non-ABM devices, use the Intune Company Portal app:

    1. On the iPhone, launch the Company Portal app (which was installed earlier).

    2. Sign in with the user’s work Microsoft 365 credentials (email and password). The app will identify that the device is not managed and will begin the enrollment process.

    3. Follow the on-screen prompts in Company Portal. The user will typically tap Begin or Enroll to start. Privacy information is shown; the user should review what the company can and cannot see.

    4. Download Management Profile: The Company Portal will redirect to the Safari browser to download a management configuration profile. When prompted “This website is trying to download a configuration profile”, the user should tap Allow. A message will confirm the profile is downloaded. [2]

    5. Install Management Profile: After the profile is downloaded, the user must go to the iPhone Settings app to install it (Apple requires manual installation for profiles on user-enrolled devices). In Settings, a new item “Profile Downloaded” will appear near the top – tap this, or navigate to General > VPN & Device Management, then under “Downloaded Profile” select the Intune management profile.

    6. Tap Install. The device may prompt for the phone’s passcode to authorize profile installation. A warning about device management will be shown – the user should confirm by tapping Install again, and then Trust when asked to trust the remote management. Now the Intune MDM profile is installed on the iPhone[2]. Tap Done when finished.

    7. Return to the Company Portal app (or the Safari page) to continue any final steps. The Company Portal will complete the enrollment and register the device with Intune.

      The device is now enrolled in Intune as a managed device (in a state often called “MDM enrolled”). The Company Portal app will show the device status and any compliance requirements.

    (Choose the method above that fits the scenario. Both achieve an enrolled, managed iPhone in Intune, but the user experience differs.) ✅

4. Verify Enrollment and Compliance
After enrollment, verify that the iPhone appears in Intune and meets compliance:

  • In the Intune Admin Center, go to Devices > iOS/iPadOS > All devices (or Devices > All devices) and confirm the iPhone is listed, assigned to the correct user, and shows as “Compliant” or “Not compliant”. Initial status might be not compliant until policies apply.

  • Intune will automatically deploy the compliance policy and evaluate the device. If any compliance requirement is not met, the Company Portal will notify the user of what needs to be done. For example, if your policy requires a PIN/passcode or a stronger password, the user will be prompted to set a device passcode to meet the policy[2]. The Company Portal app can guide the user through resolving issues (e.g., setting a new PIN, removing a jailbreak, updating iOS to a required version).

  • Once all conditions are satisfied, the device status in Intune will update to Compliant, meaning it adheres to your organisation’s security rules and can access resources. The user now has access to corporate email, Teams, OneDrive, etc. on the device (or will shortly, once those apps are installed and the device syncs policies).

    Tip: In Intune, you can check Device Compliance > Reports for a compliance overview and drill down into the specific device to see any settings that are not met. Ensure that the device has checked in recently (an initial check-in happens during enrollment).

5. Apply Security Configurations and Policies
Many security settings should already be active thanks to the compliance and configuration profiles applied in Step 2. However, ensure the following configurations are in place (some of these are automatically enforced via the compliance policy, but it’s good to review):

  • Passcode Policy: The iPhone must have a lock screen passcode that meets your requirements. Intune compliance can require a password to unlock the device[5]. Typically, enforce a strong passcode (e.g. at least 6 digits or an alphanumeric code, no simple sequences). You can block simple PINs like “1234” or “111111”[5] and require a mix of characters if using alphanumeric.

  • Device Encryption: iOS devices encrypt all data when a passcode is set. By requiring a passcode, you are also ensuring the device storage is encrypted[5]. No additional action is needed for encryption beyond the passcode requirement (there’s no separate encryption setting on iPhone; it’s automatic).

  • Jailbreak Detection: The compliance policy should mark jailbroken (rooted) devices as noncompliant, effectively blocking them[5][6]. This protects against devices that might be compromised. Intune can’t run on a jailbroken device without being detected – if a device is jailbroken, the user should remove the jailbreak or use a different device.

  • OS Version Requirements: Enforce a minimum OS version (and optionally block specific older OS builds). For example, if you require at least iOS 16.0 for security features, set that in the compliance policy; any device below that will be noncompliant until updated[2][5]. You can also specify a maximum OS version if needed (usually leave this unset unless a future iOS update is known incompatible with some app).

  • Threat Level / Defender Integration: If using Microsoft Defender for Endpoint (MDE), integrate it with Intune compliance. In Intune’s compliance policy for iOS, you can require the device to be at or below a certain threat level as reported by a Mobile Threat Defense solution. With Defender for Endpoint on iOS, you could set “Require the device to be at or under the machine risk score” to, say, Low or Medium[5]. Devices with higher risk (malware detected, etc.) would become noncompliant automatically. (This requires Defender for Endpoint to be deployed on the device – see step 6.)

  • App Configuration: Verify that any necessary managed apps (such as Outlook, Teams, OneDrive, or custom apps) have been installed or are available for the user to install via Company Portal. For email, if you deployed a managed email profile, ensure it’s functioning (the user should see the work email account in Mail app or Outlook configured).

  • Device Restrictions: If you created a device restrictions profile (for supervised devices), ensure settings like prohibiting USB data transfers when locked (USB restricted mode), disabling the ability to factory reset or enroll in other MDM, etc., are applied according to your needs. These settings help lock down corporate devices further. BYOD devices typically wouldn’t have heavy restrictions beyond compliance requirements, to respect user privacy.

    The security configurations above collectively harden the iPhone and align it with corporate policy and compliance standards. Intune will continuously enforce these settings; if the user tries to disable them (for example, removing their passcode), Intune will mark the device noncompliant and can take action.

6. Enable Conditional Access (Enforce Compliance)
To protect company data, set up Conditional Access policies in Azure AD (Entra ID) that require device compliance for accessing cloud resources (like Exchange Online email, SharePoint, Teams, etc.)[6][7]. This step ensures that only managed and compliant iPhones can actually use company apps/data:

  • Go to the Azure AD or Microsoft Entra admin center (Azure AD > Security > Conditional Access). Create a policy named, for example, “Require compliant device for mobile access.”

  • Assignments: Target all users or a group of users (e.g., all staff using mobile devices). For cloud apps, select the key services (or “All cloud apps” for a broad policy) that should be protected – typically include Exchange Online, SharePoint Online, Microsoft Teams, etc.[7].

  • Conditions: Scope the policy to apply to mobile platforms (iOS and Android) if you only want to enforce on mobiles[6][6]. You can also include or exclude device states as needed.

  • Controls (Grant): Select “Require device to be marked as compliant” as a requirement for access[6]. You might combine this with “Require multi-factor authentication” or other controls for additional security, but requiring compliance means the device must be Intune-enrolled and meeting all policy rules to get a token to cloud services.

  • Enable the policy. Now, if a user tries to sign into, say, Outlook on an iPhone that is not enrolled or not compliant, they will be blocked and told their device does not meet requirements. This effectively forces users to enroll and adhere to policies to use company data.

  • Note: M365 Business Premium includes Azure AD Premium P1, so Conditional Access is available with this license level. Make sure to exclude any emergency/break-glass admin accounts from CA policies[7] to avoid locking out all admins inadvertently.

    With Conditional Access in place, you have closed the loop: device compliance status (from Intune) is now gating access to company resources. This significantly strengthens security.

7. Deploy Defender for Endpoint on iOS (Optional but Recommended)
Microsoft 365 Business Premium includes Microsoft Defender for Business, which covers Defender for Endpoint (Plan 1) for devices including iOS. Installing Microsoft Defender for Endpoint (MDE) on the iPhone can provide additional threat protection:

  • In Intune (Endpoint Manager), navigate to Apps > iOS/iPadOS and add the Microsoft Defender for Endpoint app (available in the App Store) as a managed app. Assign it to the iPhones/user group for deployment. Alternatively, instruct the user to install Microsoft Defender from the App Store.

  • Once installed, the user should open the Defender app and sign in with their work account to onboard the device. Intune can also deploy a device configuration for Defender if needed (or use an App Configuration policy) to streamline onboarding.

  • Defender for Endpoint on iOS provides anti-phishing, malicious website blocking, and even some MTD capabilities[8]. All threats or alerts from the device will be visible in the Microsoft 365 Defender Security portal alongside other endpoints[8][8].

  • Ensure that in the Defender portal (security.microsoft.com), the device shows up as onboarded. You can also integrate Defender risk signals with Intune compliance (as noted in step 5 for device threat level).

  • This extra layer helps catch things like unsafe network connections or malicious apps/websites on the iPhone, complementing Intune’s device controls[8].

    Caution: Don’t run multiple endpoint protection agents on iOS concurrently (e.g., two MTD apps), as it may cause conflicts[8]. Defender for Endpoint acts as a local VPN on the device to monitor traffic (it’s an on-device VPN, not sending data through an external server)[8]. This is normal and by design for it to function.

8. Finishing Up and User Guidance

  • Make sure the user can access all needed resources and apps on the iPhone now. They should be able to open Outlook for email (or the iOS Mail app if that’s managed), Teams for chat, etc., with no Conditional Access blocks.

  • Educate the user on Company Portal: The Company Portal app will show device compliance status and any pending actions. Encourage users to periodically open it or pay attention to its notifications. For example, if their device falls out of compliance (maybe their OS is outdated), Company Portal will alert them and instruct how to fix it.

  • Advise the user on how to get support if they encounter issues – e.g., whom to contact in IT for device problems or questions.

  • Document that the device has been onboarded (update your asset inventory or MDM device list if you maintain a separate register outside Intune). Especially for corporate-owned devices, record serial numbers and who the device is issued to.

At this stage, the iPhone is successfully onboarded into Microsoft 365 Business Premium’s management. It is receiving policies from Intune, is protected by compliance and conditional access, and (if configured) has additional threat protection. The next section covers ongoing management to keep the device secure and compliant over time.

Security Configurations and Compliance Policies for iPhone

(This section details the key security settings that should be implemented as part of the onboarding, many of which we applied via compliance policy in the steps above. Use it as a reference checklist to ensure nothing is missed.)

Device Compliance Policy – Key Settings: When creating the iOS compliance policy in Intune, consider including these settings to enforce security baselines (in addition to any organisational requirements):

  • Require a Passcode: Ensure “Require a password to unlock mobile devices” is set to Require[5]. This forces the user to have a lock screen passcode. As noted, this also enables device encryption on iPhones. Configure related passcode settings:

    • Block Simple Passwords: Set to Block to disallow easy PINs like 1234[5].

    • Minimum Password Length: Recommend at least 6 digits (or more if using alphanumeric).

    • Password Type: Consider Numeric (which allows numeric or stronger) or Alphanumeric if you want to require letters too[5]. Alphanumeric passwords are more secure but less convenient on phones – many orgs choose Numeric with a length of 6+ as a balance.

    • Password Expiration: You can set passwords to expire after e.g. 90 days to prompt users to change them periodically[5]. (Some organisations skip this on mobile devices, relying on device biometric unlocks and compliance rules.)

    • Auto-Lock: Use “Maximum minutes of inactivity until screen locks” to something like 5 minutes or less[5], so devices auto-lock quickly when not in use. And “Maximum minutes after screen lock before password is required” to Immediately or a few minutes[5]. This ensures the passcode is needed promptly after lock.

  • Device Health:

    • Jailbreak (Rooted) Device Detection: Set “Mark noncompliant if Jailbroken” to Block such devices[5]. This will flag any jailbroken iPhone as noncompliant and Intune/Conditional Access can then prevent it from accessing corporate data[5].

    • Require Device to be Free of Threats: If using a Mobile Threat Defense like Defender, set Maximum Allowed Device Threat Level to Low (or Secured) to only allow devices with no detected threats[5]. This ties into the threat assessment from Defender for Endpoint.

  • Operating System Requirements:

    • Minimum OS Version: Set the least allowed iOS version. For example, if your org supports iOS 16 and above, put 16.0 here[5]. Devices running older iOS will then show as noncompliant until updated. This helps enforce that users apply iOS updates.

    • Maximum OS Version: Generally leave this blank unless you have a specific reason (e.g., a new iOS version is known to break a critical app – then you could temporarily block it by setting max version to one below). If used, be sure to update this when the new OS is vetted, otherwise devices will become noncompliant after upgrading past the max[5].

    • Minimum OS Build: Rarely used, but you could specify a minimum build number if a particular security patch is required.

  • Device Encryption:

    • On iOS, encryption is automatically tied to having a passcode (data at rest is encrypted with hardware AES). Intune doesn’t have a separate “require encryption” toggle for iOS because of this. Just ensure the passcode requirement is in place. (For reference, the compliance policy setting “Encryption of data storage on device” is applicable to Android/Windows; on iOS it’s not separately configurable – it’s fulfilled by having a passcode).

  • System Security and Other Settings:

    • Device Security Compliance: Consider enabling “Microsoft Defender for Endpoint device risk” in compliance if you deploy Defender. For instance, Require the device risk score to be at most Low[5]. This integrates threat evaluation.

    • Block Cloud Backup of Org Data: While not a compliance setting per se, you might enforce via App Protection or device config that certain app data (like Office 365 data) isn’t backed up to iCloud. This can be configured in an App Protection Policy (MAM) by blocking “backup to iCloud”[6] for managed apps. On supervised devices, a Device Restrictions profile can disable iCloud backup entirely, but that may be too restrictive for BYOD.

    • Disable Jailbreak Detection Evasion: (Supervised only) There are settings to prevent the user from turning off features like USB Restricted Mode (which blocks accessory connections if device is locked for an hour) – ensure those are enabled by default on iOS 12+ so that if someone tries to jailbreak via a USB exploit, it’s harder. Intune doesn’t expose every one of these as separate toggles, but keeping device up-to-date and supervised mode helps.

Conditional Access Policy: (As covered in step 6) After configuring compliance, create Conditional Access rules to enforce that devices must be compliant to access corporate cloud apps[6]. This connects the device’s compliance state with real-time access control and is crucial for security. Also consider requiring MFA on new devices or for sensitive apps, even if compliant.

Information Protection Policies: Beyond device config, ensure the rest of M365 security baseline is addressed (though out of scope of device onboarding, it’s worth mentioning): Enable MFA for all users[9], use data loss prevention (DLP) policies for sensitive data in emails/SharePoint, and use sensitivity labels if needed. These complement device security by protecting data at other levels.

Compliance Standards and Regulatory Policies: Intune’s device compliance features help organizations adhere to regulations like HIPAA, GDPR, ISO 27001, etc., by enforcing encryption, access control, and monitoring of devices[10]. For example, HIPAA requires safeguarding of ePHI – by mandating passcodes, encryption, and the ability to wipe a lost device, you are implementing required safeguards. If your organisation has specific regulatory needs, review those and adjust compliance policies accordingly (e.g., shorter device lock times for highly sensitive environments, or specific audit logging requirements). Intune itself is compliant with many standards, and it provides you tools (reports, logs, enforcement) to maintain compliance. Always document your policies and how they map to any regulatory requirement for audit purposes.

Ongoing Management and Maintenance

Onboarding is just the first step. To keep the iPhone managed and protected over time, perform these ongoing tasks and checks:

  • Monitor Device Compliance: Regularly review the device’s compliance status in Intune. Intune provides compliance reports and dashboards – for example, see if any devices are listed as not compliant and why. Common issues might be an expired OS version, or a user who removed their passcode. Use Intune > Devices > Monitor > Compliance status to get an overview. If a device is noncompliant, Intune can be configured with automatic actions (like send the user a notification, or even retire the device after X days of non-compliance). Take appropriate action: contact the user to resolve the issue or remediate from the admin side. Maintaining compliance is an ongoing process, not a one-time set-and-forget[6][6].

  • Update Management: Keep the iPhone’s OS up to date. New iOS releases often contain important security fixes. Intune can manage iOS updates for supervised devices using iOS Update Policies[11]. You can schedule updates to install during off-hours or at next check-in, and even defer or push specific versions[11][11]. For unsupervised BYOD devices, Intune can’t force-install OS updates, but you should encourage users to update promptly. Consider setting “mark device noncompliant if OS is older than X” to prompt them. In Company Portal, users can see if their OS is out of compliance and update. Also update required apps via Intune app deployments (Intune can push app updates for VPP or line-of-business apps; App Store apps update through the App Store automatically unless restricted).

  • Renew Certificates and Tokens: Mark your calendar for important renewals. The Apple MDM Push (APNs) certificate needs renewal every year[2]. Do this in the Intune portal > Tenant Administration > Connectors and Tokens > Apple MDM Push certificate, and also renew the token with Apple. If you integrated Apple Business Manager, the ABM token in Intune (Enrollment Program token) expires every 1–3 years (as set when you created it, up to 5 years max). Ensure it’s renewed via Devices > iOS/iPadOS > Enrollment program tokens before expiry, or devices will fail to enroll. Similarly, if using the Volume Purchase Program (VPP) for deploying apps or Apple Volume Content, renew those tokens annually.

  • Policy and Profile Maintenance: Periodically re-evaluate your Intune compliance and configuration profiles. You might strengthen policies over time (for instance, raising minimum iOS version as older ones become unsupported, or adjusting password length requirements). Intune will automatically prompt devices to comply with any new settings. Remove or update profiles that are no longer needed. Keep an eye on new Intune features or iOS capabilities that you can take advantage of (for example, new settings in Apple’s iOS Security Configuration Framework updates).

  • Conditional Access and Azure AD Monitoring: Check Azure AD sign-in logs for blocked sign-in attempts due to device non-compliance or other conditions. This can reveal if users are attempting to bypass policy (e.g., using an unmanaged device). Adjust conditional access policies if needed (for example, if you onboard additional cloud apps or if certain scenarios require exceptions). Azure AD’s Sign-in logs and Policy failures can be filtered to show failures due to CA, which is useful for troubleshooting.

  • Incident Response – Lost or Stolen Device: Have a process in place for lost or stolen iPhones. In Intune, you can issue a Remote Wipe (factory reset) or a Selective Wipe (corporate data removal) for a managed device. For corporate-owned devices, usually a full wipe (erase) is appropriate to protect data[12]. For BYOD, you might do a selective wipe which removes the Intune management profile and all company data/apps but leaves personal data intact[12]. Train your helpdesk or IT staff how to execute a wipe from the Intune portal (Devices > [select device] > Wipe). Also consider enabling Activation Lock bypass for supervised devices (Intune can display the bypass code if needed to reactivate a wiped device). Ensure users know to report lost devices immediately.

  • Device Lifecycle Management: If the device is replaced or the user leaves the organisation, you should retire the device from Intune. Intune’s Retire action will remove managed apps and data and the management profile. For corporate devices that will be reassigned, you may then wipe and re-enroll them for the new user. Always keep your Intune device inventory up to date—remove or retire devices that are no longer in use or haven’t checked in for a long time, to maintain security hygiene (Intune can have an auto-cleanup rule for devices inactive for X days).

  • Audit and Compliance Reporting: Periodically audit the Intune settings against your compliance requirements. Intune supports logging and reports for changes and device events. The Microsoft 365 compliance center can also show device compliance as part of broader compliance posture. If your organisation needs to demonstrate compliance (for example, for a certification or audit), maintain documentation of your Intune compliance policy settings and results. Intune aligns with data protection and regulatory compliance commitments by offering these controls[10], but you should verify and record that devices are indeed compliant. Use Intune’s compliance reports, or export device compliance data, to have evidence that all devices have encryption, passwords, etc., as required by policy.

  • User Support and Training: Continue to educate users about security best practices on their iPhone. For example, remind them not to install untrusted apps, to beware of phishing texts or emails (which Defender for Endpoint can help mitigate), and to keep their device in their possession. Provide an updated user guide if things change (e.g., if you roll out a new VPN solution or a new required app). Empower users via the Company Portal app to manage certain aspects: they can use it to check compliance, initiate a manual check-in, or even remotely locate or lock their device if you enable those features. Well-informed users are partners in security, not just endpoints to manage.

  • Stay Updated on Intune and iOS Features: Microsoft Intune and iOS both release frequent updates with new capabilities. For instance, Apple might introduce new MDM controls in a future iOS version (like enhanced VPN controls, or new restrictions) – keep an eye on Intune release notes and plan to implement new beneficial settings. Likewise, Apple’s hardware changes (e.g., eSIM management, new authentication methods) could be relevant. Keeping your device management practices current ensures you maintain a strong security posture.

By following this step-by-step checklist, your organisation will have a fully managed iPhone that is protected by Microsoft 365 Business Premium’s security features and compliant with your policies. The device will be under robust management: from initial enrollment with Intune, through enforced security configurations (passcode, encryption, jailbreak protection, etc.), to continuous compliance monitoring and conditional access enforcement.

In summary, M365 Business Premium provides the tools (Intune, Azure AD Conditional Access, Defender for Endpoint) to manage iPhones in a holistic way. Implementing these steps enables you to: protect corporate data on mobile devices, prevent unauthorized access with conditional compliance requirements, and simplify user onboarding while respecting user privacy on personal devices. Regular maintenance and user communication ensure that the iPhone remains secure throughout its lifecycle in your environment.

References

[1] Enroll iOS iPadOS devices in Intune: Complete Guide – Prajwal Desai

[2] Enroll iOS/iPadOS Devices in Intune Step by Step Guide

[3] Tutorial – Use Apple Business Manager to enroll iOS/iPadOS devices in …

[4] Microsoft 365 Device Management / Intune best practices checklist

[5] iOS/iPadOS device compliance settings in Microsoft Intune

[6] Enforce device compliance and app protection policies on BYOD with M365 …

[7] Enforce device compliance with Conditional Access – Microsoft Entra ID

[8] Microsoft Defender for Endpoint on iOS

[9] Microsoft 365 for business security best practices

[10] memdocs/memdocs/intune/fundamentals/compliance-in-intune.md at main …

[11] Use Microsoft Intune to manage software updates for supervised iOS …

[12] Manage devices enrolled in Mobile Device Management in Microsoft 365