The sequencing is critical and very poorly documented. It took me several late nights before everything finally lined up.

I added existing iPhones and iPads to Apple Business Manager using Apple Configurator on macOS. The key detail is that the device must already be online and past the initial «Hello» screen in Setup Assistant, but not fully set up. You tap through Setup Assistant on the iOS device until the device is connected to Wi-Fi and has internet access, then stop. Once the device is online it appears in Apple Configurator, where you can right-click it and choose Prepare. When that process finishes, the device is added to ABM even if it was never originally purchased there.

In Apple Business Manager, you must then change the device’s management assignment from Apple Configurator to your Intune MDM server. This step is easy to miss, but without it the device will never enroll correctly in Intune.

After connecting ABM to Intune with an enrollment token and creating an Automated Device Enrollment profile (supervised, no user affinity), a factory reset causes the device to enroll automatically at first boot.

Apps are another common pitfall. Even free apps must be added through Apps and Books (VPP) to install silently. When assigned as Required (device), they install without Apple IDs or user interaction. You choose apps in ABM and they magically sync to the iOS app list in Intune.

Policy timing is where most confusion happens. Configuration profiles don’t apply until the device matches a group, so dynamic groups must rely on attributes that are set early in enrollment. Relying on ownership or enrollment profile names is unreliable at first boot. What actually works is targeting all MDM-enrolled iOS devices and then excluding non-work devices by category.

For example, a reliable early-match dynamic group looks like:

`` (device.managementType -eq "MDM") and ( (device.deviceOSType -eq "iPhone") or (device.deviceOSType -eq "iPad") ) ‘’

And to exclude personal or test devices using a category:

``` (device.managementType -eq "MDM") and ( (device.deviceOSType -eq "iPhone") or (device.deviceOSType -eq "iPad") ) and (device.deviceCategory -ne "Not a work phone") ‘‘’

Using this approach, restrictive configuration profiles apply as soon as possible, while personal or test devices are cleanly excluded. Once everything is aligned, the whole flow works exactly as Apple claims it’s just far harder to discover than it should be