- Platforms
- iOSmacOS
- Products
- IntuneApple BusinessCitrixEntra ID
- Result
- Company-owned Apple devices re-enroll automatically into Intune after the move in Apple Business
Overview
Move company-owned iPhones, iPads and Macs enrolled through ADE from one MDM server to another in Apple Business, here from Citrix XenMobile to Microsoft Intune.
In this post I show the basic steps to move company-owned Apple devices (iOS/iPadOS or macOS) from one MDM server to another, when they were bought from Apple or a reseller and enrolled through Automated Device Enrollment (ADE, formerly DEP).
The devices are moved in Apple Business (formerly Apple Business Manager) from one MDM server to another, in my example from Citrix Endpoint Management (XenMobile) to Microsoft Intune.
For more detailed migration steps, see the Microsoft blog Migrating ADE iOS devices to Intune.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 for the users (device licence for devices without user affinity) | Licensing |
| Admin role | Policy and Profile Manager in Intune (enrollment programs), and an Apple Business role that can assign devices to device management services | RolesAssign devices |
| Apple Business | Company-owned devices bought from Apple or a reseller, supported by both MDM servers | Apple BusinessADE |
| Both MDM servers linked in Apple Business, each with its ADE token | Link MDMIntune ADECitrix | |
| Intune | ADE token in Intune with an enrollment policy; Company Portal as a required VPP app with device licensing | Set up ADE |
| Devices | Optional no-wipe migration: iOS 26, iPadOS 26 or macOS 26 and later | Migrate devicesDeployment guide |
Migration
Reassign the device in Apple Business, let Intune sync it, then wipe it from the old MDM.
Both MDM servers must already be added in Apple Business (business.apple.com):
Note: you can add several MDM servers in Apple Business, each with its own ADE token.
In my example, company-owned iOS/iPadOS devices are enrolled in Citrix Endpoint Management (XenMobile) and should move to Intune. The XenMobile console shows a company iPhone synced from Apple Business and enrolled through ADE:
To move this device to the new MDM server (Intune), change its device management in Apple Business (see Assign, reassign or unassign devices):
You can do the same for one device or a group of devices, for example by order number or by source (a reseller or manually added devices).
The new MDM server (Intune) needs the ADE integration (ADE token uploaded) to sync the newly assigned device from Apple Business:
Note: the steps to set up ADE between Apple Business and Intune are in Microsoft's documentation and in my other blog post.
When the iPhone appears in Intune, assign an enrollment policy to it (formerly enrollment profile; the default policy works well):
When the device is synced and has the policy assigned (name: ADE_iOS_iPadOS), the old MDM server (XenMobile) can full wipe it (factory reset), and right after that it enrolls into the new server (Intune):
Update (October 2026): devices on iOS 26, iPadOS 26 or macOS 26 no longer need a wipe, as long as both MDM servers are linked to the same Apple Business account (it doesn't cover transferring serial numbers from one Apple Business account to another). In Apple Business, select the devices, choose Assign Device Management, pick the new service and add a deadline (1 to 90 days). Users migrate before the deadline, and after it the migration is enforced. iPhone and iPad can keep their apps and data (see Migrate devices to a new management service and the Microsoft blog Apple making device migration to Microsoft Intune easy).
User Experience
After the wipe, the iPhone enrolls into Intune through Setup Assistant.
My test device was an iPhone 6s on iOS 14. Citrix Endpoint Management (XenMobile) full wiped it, and the screenshots show it enrolling into Microsoft Intune through ADE:
I use Managed Apple Accounts (formerly Managed Apple IDs) owned by the organization (@company.com), with federated authentication with Microsoft Entra ID. Users sign in to their Apple Account with the same Microsoft Entra ID credentials they use for Company Portal and other Microsoft apps:
Note: with Managed Apple Accounts, users can't download apps from the App Store. Only apps that the admin publishes as Required or Available in Company Portal are available.
The message Guided Access is unavailable. Please contact an administrator was expected in 2020, because the enrollment profile had Run Company Portal in Single App Mode until authentication turned on. The screen held the user until Company Portal was installed through the Volume Purchase Program (VPP) and opened, so the user could sign in with Microsoft Entra ID credentials:
For this, the VPP token must be in Intune and Company Portal (a free app) must be bought in Apple Business with enough licenses for all devices:
Update (October 2026): Single App Mode until authentication is no longer supported and must be set to No. Microsoft now recommends Setup Assistant with modern authentication, which supports MFA during Setup Assistant (see Create an Apple enrollment policy).
The prompt for Microsoft Entra ID credentials:
Then the management profile installs:
When the management profile is installed, the device is managed by Intune:
