Intune enrollment not starting in company portal app on iPad Pro

Anonymous
2021-06-15T05:03:53.107+00:00

Hi,

I bought a new 2021 iPad Pro with M1 chip. It came out of the box with iPadOS 14.5 pre-installed. After the initial Apple setup (no DEP in use), I directly installed the company portal app and tried to enroll in our Intune instance but after logging into the company portal app, no enrollment prompt is coming and if you go to the Devices or Support tabs, they show light grey placeholder boxes instead of the actual tab content. (See screenshot below, the other tabs like Apps work fine)

I thought maybe it’s a bug with iPadOS 14.5 and upgraded to 14.6 but that didn’t make a difference. I also tried logging out and back into the company portal, deleting and re-installing the app, restarting the iPad and various combinations of those steps - no luck.

Then I unenrolled an older (2018?) iPad Pro from Intune and tried to re-enroll it which was successful. That iPad was still on iPadOS 14.4.2. Upgraded to iPadOS 14.6 and now getting there the same issue. I can’t get the enrollment process to start.

Then asked a colleague who has an iPad Air 4th Gen which has never been enrolled and was on iPadOS 14.4.x as well. He installed the company portal app, logged in and directly was prompted to enroll. He canceled enrollment, upgraded to iPadOS 14.6 and was still able to start the enrollment process.

I opened a ticket with Microsoft support last week but other than 2 hours of trouble shooting and scratching our heads, no pointers to a solution yet.

Has anyone seen this issue?

105691-a5dcf935-10f8-455f-a987-3ee5e528c5ad.png

Microsoft Intune Enrollment
Microsoft Intune Enrollment
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Enrollment: The process of requesting, receiving, and installing a certificate.
1,247 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nigel Sheridan-Smith 1 Reputation point
    2021-11-09T03:50:51.203+00:00

    I found a few issues (thanks also to @Douwe Riepma for #2)...

    1. Our federation provider didn't support WS-Trust 1.3 and the MEX endpoints... we had to go back to AzureAD password-only authentication - https://learn.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-manual#set-up-issuance-of-claims
    2. We had to explicitly exclude "Intune" and "Intune Enrolment" apps from MFA requirements so the MDM devices can register successfully in AzureAD via the Graph API
    3. For iOS native mail access: We also had to exclude MFA requirements for our MDM-compliant devices to allow "Apple Internet Accounts" for access to iOS native mail (for approved users)

    So the conditional access policies used were:

    1. MAM group - require app protection policy and approved client app (exclude MDM iOS native mail users)
    2. MDM group - require MFA and compliant devices (exclude MDM iOS native mail users?, and exclude Intune/Enrollment apps)
    3. Register or join cloud action requires MFA
    4. iOS native mail users (also in MDM group) - require compliant devices for all cloud application access (excluding Intune/Enrollment apps) - "Apple Internet Accounts" only was not sufficient
    5. Block all browsers and classic access on iOS and Android devices
    6. Geo-block other regions

    I'm not sure if I need to add iOS native mail users to the two groups in sequence - for CA policies #2 and #4 to apply successfully. If we don't do this, I guess this means we might end up with some users where we have not verified MFA but it will be on a per-exception basis.

    Cheers,
    Nigel

    0 comments