Mobile device management for iOS and Android through Intune is simpler than most businesses think — and more important than most businesses implement. Here's the complete picture.
Key takeaways
- 1Push configuration profiles (Wi-Fi, VPN, email, apps)
- 2Enforce passcode requirements
- 3Control which apps can be installed
- 4Remote wipe the entire device
- 5Supervision mode enables additional restrictions (e.g. blocking App Store entirely)
Most Intune conversations focus on Windows PC management. But the mobile device story is equally important — and often more neglected. A team of 30 people might have 30 laptops and 30+ personal iPhones all accessing company email and files. The laptops may be managed. The phones almost certainly aren't.
Two approaches to mobile management in Intune
Option 1: Full MDM enrolment (corporate-owned devices)
For company-owned iPhones and iPads, full MDM enrolment gives complete management control:
- Push configuration profiles (Wi-Fi, VPN, email, apps)
- Enforce passcode requirements
- Control which apps can be installed
- Remote wipe the entire device
- Supervision mode enables additional restrictions (e.g. blocking App Store entirely)
Option 2: App Protection Policies (BYOD)
For personal devices, App Protection Policies apply controls only to managed Microsoft 365 apps — not the whole device. This is the right approach for BYOD: company data is protected without any privacy invasion of the personal device.
Apple Business Manager and Automated Device Enrolment
For businesses managing corporate iOS devices, Apple Business Manager (ABM) enables Automated Device Enrolment — the iOS equivalent of Windows Autopilot. Devices purchased through ABM automatically enrol in Intune on first power-on. Optimyze sets up ABM for clients with corporate iOS devices, linking it to their Intune tenant for seamless provisioning.
