Plan for Change: Web based device enrollment will become default method for iOS/iPadOS device enrollment

🚨 The Signal: Intune will default to web-based iOS/iPadOS device enrollment for new profiles and tenants from early 2027. This streamlines enrollment but requires explicit SSO extension policy deployment for Just-In-Time registration, impacting device identity and access.

The Impact

Intune admins and iOS/iPadOS users are affected, with a potential security risk if SSO extension policies are not correctly deployed for Just-In-Time registration.

• Intune Admins: Must deploy SSO extension policy for secure Just-In-Time registration.
• iOS/iPadOS Users: Will experience a web-based enrollment flow by default for new profiles.
• Security Teams: Need to validate device identity and access controls for web enrollment.
• Compliance Teams: Review new default enrollment against device provisioning policies.

The Action

1. Review existing iOS/iPadOS enrollment profiles; no immediate action needed for them.
2. Plan to deploy an SSO extension policy for iOS/iPadOS devices to enable Just-In-Time registration.
3. Familiarize with the 'Web based device enrollment' flow for new profile creation.
4. Update internal documentation and user guides for the new default enrollment experience.
5. Assess the impact on device compliance and conditional access policies with web enrollment.

Domain: Intune · Impact: medium · Workload: Intune