If you’ve ever watched a user try to enroll their personal iPhone into Intune and completely freeze at the sign-in screen — you’re not alone. Account-Driven User Enrollment trips people up more than almost any other Intune feature, and most of the time it comes down to a few very fixable issues.
Let’s break it down.
What Even Is Account-Driven User Enrollment?
Starting with iOS/iPadOS 15, Apple introduced a more privacy-focused way for personal devices to enroll in MDM. Instead of downloading a management profile through Safari (the old way), everything now happens inside the Settings app itself.
When a user opens the Company Portal and taps to enroll, they get directed here:
Settings → General → VPN & Device Management → Sign In to Work or School Account
Sounds simple enough — but that’s where the confusion starts.
The #1 Thing That Trips Users Up
That sign-in screen looks exactly like an Apple ID login. So what do users do? They try their Apple ID. Or they think they need a special Managed Apple ID from Apple Business Manager.
They don’t.
All they need is their work email address (UPN). Once entered, the device does a background lookup to find your Intune enrollment endpoint. If your domain is federated with Entra ID, it’ll redirect them to your organization’s login page automatically.
The Discovery URL — Don’t Skip This
Here’s the part most admins miss on first setup: for that background lookup to work, your domain needs to host a JSON file at a specific path:
https:///.well-known/com.apple.remotemanagement
No discovery URL = no enrollment. The Settings app just returns a vague “Profile Not Found” or “Connection Failed” error and leaves the user completely stuck.
Quick Admin Checklist
Before you go further, verify these in the Intune admin center under Devices → iOS/iPadOS → Enrollment Types:
- ✅ Your enrollment type profile is set to Account-Driven User Enrollment (not Web Enrollment)
- ✅ The
.well-knowndiscovery URL is live and returning a valid response - ✅ Just-in-Time (JIT) Registration is enabled — this uses the Apple SSO extension to automatically register the device in Entra ID during enrollment, cutting down on repeated sign-in prompts
- ✅ The Microsoft Authenticator app is deployed to the device (required for JIT)
Common Errors and What They Actually Mean
| Error | What’s Really Happening |
|---|---|
| “No profile found” | The .well-known discovery URL is missing or misconfigured |
| Redirect to Safari loop | Enrollment Type profile mismatch — check your profile assignment |
| Authentication failed | Entra ID federation issue — verify your domain federation status |
| Compliance errors after enrollment | JIT not configured, or Authenticator isn’t deployed |
The Bottom Line
Account-Driven User Enrollment is genuinely better than the old Safari-based method — it’s cleaner for users and more private by design. But it requires a bit more backend setup to get right. Nail the discovery URL, set your enrollment type profile correctly, and turn on JIT registration, and the experience becomes almost seamless.
