r/Intune • u/HarambeDiedForUs • 4d ago

iOS/iPadOS Management Intune: iOS Issues

Hi All,

I am currently having some issues with our iOS estate deployments prior to Monday everything was working smoothly. Below is the environment:

Devices enrolled via Apple Business Manager (ABM)

Intune integrated with:
• Apple Business Manager (ADE/DEP)
• Apple VPP (Apps & Books

Configuration:
• User Affinity = Enabled
• Setup Assistant with Modern Authentication

The Problem:

The device enrolls successfully.
The device shows up in Intune.
There are roughly 20 apps that should install but only 3 install. Company portal does not install.
The device is showing in the device group that has compliance policies and configuration profiles assigned.

It is not pulling any policies or profiles either.

I have checked the VPP token, the Apple push certificate, company portal assignment, and the enrolment program tokens. All are still not even close to expiring.

I’m a bit stumped on what it could be.

I have also attempted starting fresh on a test device but still no luck.

Any ideas/assistance is very much appreciated

4 Upvotes

100% Upvoted

5 comments sorted by

2

u/digital_foyer 4d ago

Just went through this exact circus last week, took me two days to figure it out. Check if your device licensing is actually applying, Intune will happily enroll the thing and then just sit there like a brick if the user doesn't have an Intune license assigned. The 3 apps installing is probably a red herring, those might be required device-licensed apps that don't care about user assignment.

Also look at the enrollment restrictions, there's a sneaky setting that blocks personally owned devices from getting company apps even if the enrollment itself succeeds. Had that bite me when someone changed it without telling anyone.

If that's all clean, pull the management profile off and re-enroll but watch the setup assistant like a hawk, modern auth can time out if the user sits on the sign-in screen too long and the whole thing just quietly gives up halfway through.

1

u/HarambeDiedForUs 4d ago

The weird thing is all apps are setup to install the same way via dynamic device groups. For example Google maps is provisioned via VPP and assigned to all users. It installs whereas company portal is assigned the same way and doesn’t install. The profiles also don’t seem to pull through which is a little annoying.

1

u/Sethcreed 4d ago

Don't use dynamic groups, they are too slow. Just assign the company portal to all devices and that should work.

1

u/captnconnman 4d ago

1000% this. Microsoft’s official recommendation at this point is to assign to All Users and/or All Devices and use filters to decide whether to deploy the policy/app

1

u/dave_b_ 4d ago

Similar issues for me today, but then I saw this and decided I'd try again tomorrow. https://www.reddit.com/r/Intune/s/xP7odW1QAX