Companies that allow employees to use their own iPhones, iPads or Macs face a fundamental challenge – how to protect corporate data without invading user privacy?
In this article, we’ll take a detailed look at how to properly prepare your environment for a BYOD approach using Microsoft Intune and Device Enrollment.
Why is BYOD specific to the Apple ecosystem?
Apple devices are becoming an increasingly common part of corporate IT environments – not just owned by companies, but by employees themselves. iPhone, iPad or MacBook are now commonly used to access Microsoft 365, email, Teams, CRM systems and sensitive documents. But this brings up key questions:
- How to separate corporate and personal data without full device management? (iOS,iPadOS)
- How to ensure compliance with NIS2 and other cybersecurity standards?
- How to set up a management that respects user privacy but guarantees corporate control?
Microsoft Intune offers a Device Enrollment mode for Apple devices that covers this exact scenario.
What needs to be prepared before you start?
The right licences and infrastructure
To implement BYOD for Apple devices, you need:
- Microsoft Intune as part of M365 Business Premium, or in conjunction with Microsoft 365 E3/E5 licenses.
- Microsoft Entra ID (formerly Azure AD), which is used for access control and conditional authentication.
- APNS certificate – Apple Push Notification Service certificate is required to manage Apple devices.
- Apple Business Manager (ABM) – not mandatory for BYOD, but important to know when combining with corporate devices.
- Mandatorily activated multi-factor authentication (MFA).
We also recommend that you have Conditional Access configured to protect your business applications from access from unauthorized devices.
Apple Device Enrollment – a modern approach to BYOD
Apple offers a Device Enrollment mode that is designed specifically for BYOD scenarios:
- Company data is separated from personal data (iOS,iPadOS)
- IT administration can only access a limited set of data – e.g. device name, corporate application, encryption status.
- You can’t delete personal data, track your location or look at private apps.
- The administrator can only delete company content if necessary
- This mode is available through Intune automatically if the device is not marked as corporate during registration.
Policies and security in Intune
For BYOD to work securely, you need to configure several levels of policies:
- Configuration profiles – Enforce settings such as Passcode, encryption, firewall. Compliance with these settings is monitored by Compliance Policy.
- Compliance policy for iOS/iPadOS/macOS ensures compliance with company policies – e.g. whether the device has Passcode, jailbreak detection and storage encryption status.
- Conditional Access prevents access to Microsoft 365 from an unsecured or unknown device.
Apple device registration process for BYOD
Employee downloads the Company Portal app, logs in with a company account and begins enrolling the device into Intune
- The Company Portal application guides the user through downloading and installing the MDM profile for device management.
- Once the regisration is complete, the facility is registered with Ownership Personal
- Intune automatically installs configuration profiles and associated business applications.
- Compliance policies evaluate whether a device is compliant or non-compliant.
- If everything meets the set conditions, access to company systems is enabled.
Legal, procedural and communication prerequisites
Without good communication with users BYOD will not succeed. It is essential:
- Explain to employees that IT does not see or manage the personal part of the device.
- Create a “BYOD rules” document and formally obtain user consent.
- Assist users in registering the device, ideally in the form of a tutorial.
We also recommend introducing onboarding communication – for example, in the form of an email with instructions and reasons why you are implementing BYOD in your company.
Summary: Secure BYOD for Apple devices is not a compromise
With a combination of Microsoft Intune, Device Enrollment and a properly configured environment, you can offer employees the freedom to work on their own iPhones, iPads or Macs – without compromising security standards.
Corporate data management remains in the hands of IT, employee privacy is protected and the process is fully scalable. BYOD can become a standard part of your mobile strategy – securely, easily and trusted.
