Nick Falzetti
Managing iPhones with Intune: The Default iPhone Configuration
admin
July 22, 2026
7:24 pm

Intune · iOS · Field Notes

Managing iPhones with Intune

The default iPhone configuration we use to provision and lock down corporate iPhones at Eisenhower Center - through Intune and Apple Business Manager.

By Nick Falzetti  ·  July 22, 2026  ·  6 min read

These are the steps we use to provision and manage corporate iPhones at Eisenhower Center for staff use - a repeatable configuration built on Intune and Apple Business Manager.

There are two situations for a managed phone. Both are fully managed; the difference is whether the Apple account is locked to IT.

Model 1Fully Managed + Account Lockdown

All settings applied and the account is locked down to an account managed by IT. Used for phones that could be shared - for example, the MOC phone.

Model 2Fully Managed, No Account Lockdown

The same settings and restrictions, except the Apple account is not locked. Used for phones individually assigned to a person - for example, assigned to Nick F.

Prerequisite. The phone must already be set up in Apple Business Manager (automatically or manually) and showing up in Entra before you begin. If this is not done first, enrollment and account sign-in will not work as expected.

GroupsGroup identification

Assign a phone to exactly one of these groups - never both.

  • mdm-iOS-CorpOwned-FullyManaged - for phones that could be shared. Applies all settings and a locked-down account (example: MOC).
  • mdm-iOS-CorpOwned-IndividuallyAssigned - all settings and restrictions minus account lockout (example: assigned to Nick F).

PoliciesConfiguration policy identification

  • ...FullyManaged-DeviceRestrictions - software update settings, USB restriction, app installation off, mirroring, and the full restriction list.
  • ...FullyManaged-HomeScreen - sets the home screen layout and app list.
  • ...FullyManaged-HideApps - hides a defined list of apps.
  • ...FullyManaged-AccountLockdown - Allow Account Modification set to false.

RunbookGeneral iPhone documentation & setup

  1. Document the iPhone in Snipe-IT.
  2. Give the iPhone a unique name in Snipe-IT.
  3. Find the iPhone in Intune using its serial number.
  4. Rename the iPhone in Intune so it matches Snipe-IT.
  5. Fully Managed only: sign in to the Apple ID and verify iCloud backup settings now. If this is not done before group assignment, you will not be able to sign in.
  6. Assign the iPhone to the desired group - only one: IndividuallyAssigned or FullyManaged.
  7. Verify the configuration applies via General > Device Management. You can also confirm by the asset info shown on the lock screen.
  8. IndividuallyAssigned only: sign in to the Apple ID now.
  9. Once applied, create a contact with the phone's own number and the name of the phone.
  10. Ensure apps like Outlook and Authenticator are showing.

ReferenceHome screen app list

The FullyManaged-HomeScreen policy lays out this core set of apps:

Weather, Calendar, Photos, Clock, FaceTime, Notes, Maps, Contacts, Outlook, Teams, Authenticator, UKG Pro/Ready, Safety Zone, Phone, Safari, Messages, Camera - plus a Utilities folder. The full home-screen and hide-apps lists are maintained in internal documentation.

Category : Intune