Enrolling an IOS Device with MFA Enabled

Question

I am having difficulty enrolling a new IOS device for a user who has MFA enabled. After entering the username and password for MFA, the device is unable to receive a code. I have tried setting up a Temporary Access Pass (TAP) and configuring a new number via a browser login, but the device is not enrolled and can't receive an SMS code. Some suggest excluding the user from MFA initially or excluding Microsoft Intune enrollment from conditional access policy, but these options reduce security in the environment. Has anyone resolved this issue without compromising security?

Answer 1

Hi,

Thank you for posting in Microsoft Q&A forum.

Is it a BYOD iOS devices? If it is enrolled via Apple automated device enrollment, a second device is required to complete the MFA for iOS devices. Because the primary device can't receive calls or text messages during the provisioning process.

Per the official article: Require multifactor authentication for Intune device enrollments

Thanks for your time. Have a nice day!

Best regards,

Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.