Managing company iPhones with Microsoft 365

If your business already runs on Microsoft 365, you can manage every company iPhone from the same place you manage your users. The tools are Microsoft Intune and Apple Business Manager (ABM), and together they turn a drawer full of phones into a controlled, secure fleet.

This article explains why managing company phones matters, what Intune can do, how ABM fits in, and what it really takes to run the system day to day. It is written for business owners and managers, but it is upfront about the technical side: this is a capable system, not a simple one.

Prices are approximate Australian dollar figures from reseller pricing, and GST treatment varies by source. Microsoft and Apple change plans and pricing regularly, so confirm a current quote before you budget.

Quick answers

• Intune manages iPhones centrally. Enforce passcodes, push apps, Wi-Fi and VPN settings, block non-compliant phones from company email, and lock or wipe a phone remotely.
• Apple Business Manager (ABM) is the missing piece. Phones bought through ABM enrol themselves and are supervised, which unlocks the strongest controls.
• Cost: ABM is free. Intune Plan 1 is included in Microsoft 365 Business Premium, or costs about AU$11 per user per month on its own.
• Real-time GPS tracking is not available covertly. Locating an iPhone means using Lost Mode, which locks the phone and shows a clear message to the employee.
• Administration takes real Microsoft skills. Intune, Entra ID, licensing and security groups are not a job for reception or general admin staff.
• Without management software you cannot reliably enforce security, recover a lost phone or reuse devices when staff change.

1. Why managing company phones matters

An unmanaged company phone puts email, files and client data in a pocket you do not control. Phones are lost, upgraded, handed between staff and left in taxis, and every one of those events is a risk if the business cannot see or act on the device.

• Data protection. Phones hold email, Teams chats, contacts and documents. Management lets you require a passcode, encryption and approved apps only.
• Loss and theft. A managed phone can be locked, wiped or put into Lost Mode in minutes, rather than hoping the finder is honest.
• Staff turnover. When someone leaves, you can remove company data and hand the phone to the next person without a shoebox of old Apple IDs.
• Compliance and insurance. Insurers and customers increasingly ask about MFA, patching and device controls. Managed phones give you evidence rather than assurances. Our guide to cybersecurity basics for Australian SMBs covers what they tend to ask for.
• Consistency. Every phone gets the same Wi-Fi, email, apps and security settings, which means fewer support calls.

2. What Intune can do once it is configured

Once a phone is enrolled, Intune lets you set the rules and act on the device remotely. Several of the strongest controls only work on supervised phones, which is why enrolment through ABM matters (see the next section).

• Passcode and encryption rules. Require a minimum passcode strength and lock timeout on every phone.
• Compliance policies. Define what a healthy phone looks like (passcode set, current iOS, not jailbroken) and flag any phone that fails.
• Conditional Access. Block email, Teams and SharePoint on any phone that is not enrolled and compliant. Needs Entra ID P1, which is included in Microsoft 365 Business Premium.
• Configuration profiles. Push Wi-Fi, VPN, email, certificates and restrictions to every phone automatically.
• App deployment. Install required apps silently, offer optional ones through the Company Portal, and remove them when no longer needed.
• Update enforcement. Control when iOS updates are installed so phones do not sit on vulnerable versions.
• Remote actions. Lock, restart, wipe or retire a phone, and remove company data while leaving personal data alone where the phone is not fully corporate.
• Lost Mode and Locate. Lock a lost phone, show a message and phone number on the screen, and request its location (supervised phones only).
• Activation Lock bypass. Recover a supervised phone that would otherwise be locked to a former employee's Apple account.
• Reporting. See every device, owner, iOS version and compliance state in one list, which is also your evidence for insurers and auditors.

3. How Intune and Apple Business Manager work together

ABM is where Apple records which phones your business owns, and Intune is where you manage them. When the two are linked, a new iPhone enrols itself the first time it is switched on. Microsoft calls this automated device enrollment, and recommends it for corporate iPhones because it puts phones into supervised mode.

1. Link ABM to Intune. Create an enrolment token in ABM and upload it to Intune, so the two systems stay in sync.
2. Buy iPhones through ABM. Purchase from Apple or an authorised reseller that registers the devices to your ABM account.
3. Assign devices to Intune. In ABM, point the phones at your Intune server. They appear in Intune before anyone unboxes them.
4. Build an enrolment profile. Choose supervised mode and locked enrolment, so staff cannot remove management from the phone.
5. Hand the phone over. The employee switches it on, signs in with their Microsoft 365 account, and policies and apps arrive on their own.
6. Manage from then on. Policies, compliance checks and remote actions all run from Intune.

What expires every year

Three connections to Apple must be renewed every 365 days: the Apple MDM push certificate, the ABM enrolment token and the app purchasing (VPP) token. If the push certificate lapses, you can no longer manage enrolled Apple devices. There is a 30-day grace period to renew it, and renewal must use the same Apple ID that created it. If it has to be recreated instead, every Apple device has to be enrolled again.

4. Real-world scenarios

Management earns its keep on the awkward days. These are the situations where businesses with enrolled phones are usually glad they set it up.

A phone is left in a taxi

The employee reports it within minutes. An administrator puts the phone into Lost Mode with a message and a callback number, and requests its location. If it does not come back, the phone is wiped. Company email is never exposed.

A new starter on Monday morning

The phone was bought through ABM and assigned to Intune weeks ago. The new starter unboxes it, signs in with their work account, and email, Teams, Wi-Fi and the line-of-business apps appear without anyone from IT touching the device.

A staff member leaves

Administrators remove company data, wipe the phone and reassign it to the next person. Because the phone is supervised, it is not stuck on Activation Lock tied to the former employee's personal Apple ID.

An old iPhone tries to read company email

A phone falls behind on iOS updates or loses its passcode. Its compliance state changes, and Conditional Access blocks it from company mail until it is fixed. Nobody had to notice.

5. The downsides of managing iPhones without management software

Without management software, a company iPhone is really a personal phone that happens to be paid for by the business. The business owns the hardware but has very little control over it.

• No enforced security. You can ask staff to set a passcode and update iOS, but you cannot require it or check it.
• Weak remote control. Find My and remote erase depend on whoever's Apple ID is signed in. If that is the employee's personal account, the business is relying on them.
• Activation Lock traps. A phone locked to a former employee's Apple ID can become an expensive paperweight if they will not or cannot unlock it.
• No separation of data. Company email and files sit alongside personal apps, with no way to remove only the business data.
• Manual setup. Every phone is configured by hand, so Wi-Fi, email and apps differ from person to person.
• No inventory. There is no reliable list of who has which phone, what version it runs or whether it is still in use.
• Nothing to show an insurer. You cannot prove controls are in place across the fleet.

This is workable with two or three phones and a trusting team. It stops working as soon as the fleet grows, someone leaves on bad terms, or a phone is lost.

6. Running an iPhone fleet properly: ABM, licensing and your network

If your business buys iPhones for staff, ABM is the right foundation, and it costs nothing to join. The real costs are the Intune licences and the time to set it up properly.

• Apple Business Manager. Free
• Microsoft 365 Business Premium. Roughly AU$30 to AU$38 per user per month, depending on reseller. Includes Intune Plan 1, Entra ID P1 and Defender for Business, for up to 300 users.
• Intune Plan 1 on its own. About AU$11 per user per month
• Intune Plan 1 per-device licence. Priced per device instead of per user, useful for shared or user-less phones. Ask your reseller for a current AUD quote.
• Intune Plan 2 add-on. About AU$4.50 per user per month, rarely needed for a standard iPhone fleet
• Intune Suite add-on. About AU$15 per user per month, adds tools such as Remote Help and advanced analytics

Plan structure and US list prices are from SpotSaaS and TrustedTech. Australian pricing varies by reseller: Telstra lists Business Premium at AU$38.01 per user per month including GST on an annual term, and other resellers quote in the low-$30s. Ask for a current local quote. If you are already on Business Premium, Intune is already paid for.

AUD figures are from Precision IT's Australian pricing guide.

Network considerations for iOS devices

• Apple push services. Managed iPhones must be able to reach Apple's push notification service, which uses Apple's 17.0.0.0/8 address range on TCP port 5223, with a fallback to port 443. Block it and policies stop arriving promptly.
• Microsoft endpoints. Phones need outbound access to Intune and Microsoft 365 services. Firewalls and web filters that break these cause enrolment and compliance failures that look like phone problems.
• Wi-Fi profiles. Intune can deliver your Wi-Fi settings and certificates, which is how you roll out WPA2/WPA3-Enterprise without typing passwords on each phone.
• Private Wi-Fi Address. iOS can use a different MAC address on each network. If your network relies on MAC filtering or MAC-based reservations, plan for this.
• Cellular and VPN. Per-app or always-on VPN profiles can be pushed to phones that need access to internal systems.

7. GPS tracking: what an iPhone will and will not allow

Intune cannot quietly track an iPhone, and Apple designed it that way. Some owners expect a live map of every company phone, and it is better to set that expectation correctly before you buy anything.

• Locating needs supervision and Lost Mode. Microsoft's Locate device action works on supervised iPhones only, and the phone must be in Lost Mode.
• Lost Mode is obvious. It locks the phone and shows your message and phone number on the screen. The employee cannot use the phone until an administrator turns it off. Microsoft's Lost Mode guide describes the behaviour.
• It leaves a trace. Even after Lost Mode is switched off, the phone shows a message that it was enabled. There is no silent way to look and cover your tracks.
• It is a lookup, not a live feed. No location is sent to Intune until the action is used, and the result is a point in time rather than a continuous trail.
• Not for personal phones. Unsupervised and personally owned phones cannot be located by Intune at all.

Lost Mode is for lost and stolen phones. It is not a replacement for tracking staff, and it should never be presented to employees as one.

If your business genuinely needs ongoing location, such as for vehicles or field crews, the honest route is a purpose-built vehicle or asset tracker, or an app that staff know about, backed by a written policy. In New South Wales, the Workplace Surveillance Act 2005 requires employers to give staff written notice before tracking them. Other states and territories have their own rules, so get advice before you start.

8. Administration: set your expectations before you start

Setting up Intune is only the first half of the job. Running it every week takes real Microsoft 365 experience, and the people who do it need to be trusted with powerful admin roles. This is not a system a receptionist or office administrator can pick up from a help article.

What day-to-day administration looks like

• Staff changes. Moving a phone from one person to another means retiring or wiping the device, changing its assigned user, and moving Intune and Microsoft 365 licences. Get the order wrong and the new user ends up unlicensed or the old user's data is still on the phone.
• Groups and policies. Policies are assigned to security groups. A phone in the wrong group can receive the wrong settings, or none.
• Licensing. Every managed user needs a licence assigned and removed correctly, or compliance and Conditional Access stop working for them.
• Troubleshooting. When a phone will not enrol, will not receive an app or shows as non-compliant, the cause could be a profile, a group, a certificate, a network rule or a licence. Finding it means reading Intune and Entra logs.
• Annual renewals. The push certificate, enrolment token and app token all expire every 12 months. Missing the push certificate is a fleet-wide outage.
• Automation. Bulk changes and reporting often use Microsoft Graph or PowerShell, which means scripting skills and care.

The risks of getting it wrong

The same power that makes Intune useful makes mistakes expensive. A badly scoped Conditional Access policy can lock an entire company out of email, administrators included. A wipe sent to the wrong group deletes the wrong phones. An over-permissioned account is a security risk in its own right.

Who should administer it

The administrator should understand Intune, Entra ID, security groups, role-based permissions and licence assignment, and should be comfortable working with Microsoft Graph. Microsoft's Endpoint Administrator certification (MD-102) is a good indicator of that depth. They also need to hold admin roles in your Microsoft 365 tenant, so they must be someone you trust with that level of access.

If you expect a simple screen where anyone can click "assign phone", Intune is not it. That is also the main reason many businesses use an IT partner to run it for them.

FAQ

Can Microsoft 365 manage company iPhones?

Yes. Microsoft Intune manages iPhones and is included in Microsoft 365 Business Premium. It handles enrolment, security policies, apps, compliance checks and remote actions such as lock and wipe. Linking it to Apple Business Manager gives you the strongest controls.

Do we need Apple Business Manager to manage iPhones?

Not strictly, because phones can be enrolled manually or by the user. But supervised mode, hands-off enrolment, Lost Mode and Locate, and Activation Lock bypass all depend on the phone being a corporate device, and ABM is the recommended way to get there.

Can we track company iPhones in real time?

No. Intune can only request a phone's location on supervised iPhones in Lost Mode. Lost Mode locks the phone and shows a clear message to the employee, so it is a recovery tool and not a way to monitor staff.

What happens if the Apple MDM push certificate expires?

You lose the ability to manage enrolled Apple devices until it is renewed. There is a 30-day grace period, and renewal must use the same Apple ID that created it. If the certificate has to be recreated, every Apple device must be enrolled again.

Can we manage staff members' personal iPhones the same way?

Not to the same level. Personal phones are not supervised, so features such as Lost Mode and Locate are unavailable. Businesses usually limit personal phones to protecting company apps and data, and keep full management for company-owned devices.

Can our reception or admin staff run Intune day to day?

We do not recommend it. Intune administration involves security groups, licensing, policies and admin roles, and a small mistake can lock people out or wipe the wrong phones. It is best run by someone with Microsoft 365 and Intune experience.

Where to from here

Managing company iPhones through Intune and ABM is the right way to secure a business fleet, provided you go in with realistic expectations about cost, tracking and the skills needed to run it.

In our next article, we look at how businesses can keep that control without needing Microsoft administration skills in-house.

If you are planning to roll out company iPhones, or want to bring an existing fleet under management, talk to Layer 3. You can also read more about our Microsoft business services.