IOS Enrollment Policys - User affinity with modern auth, does not work with Company Portal VPP

GT 0 Reputation points
2026-07-28T02:53:21.45+00:00

IOS Enrollment Policys - User affinity with modern auth, does not work with Company Portal VPP

I am trying to test the newer iOS Enrollment Policies using User Affinity with Modern Authentication instead of the older Enrollment Profiles.

One thing I've noticed is that the "Install Company Portal with VPP" setting exists in Enrollment Profiles, but I don't see an equivalent setting in the new Enrollment Policies.

My test Policy configuration is using:

  • User Affinity with Modern Authentication
  • Company Portal deployed as a VPP app

I tested deploying Company Portal as a required VPP app, and it installs successfully. However, when I launch Company Portal and sign in with my Entra ID credentials, it immediately prompts me to set up company access and download a management profile.

This doesn't seem correct because the device was already enrolled through ADE. If I select Postpone, Company Portal reports that I can't access company resources, and when I check further, it states that the device must be managed before apps can be installed.

this has to be a bug or something right? the microsoft docs on this are very confusing or missing details.

I also noticed that the device initially appears in Intune/entra as "iPad". After some time, the name eventually updates in entra and intune, However, within the Company Portal app, I end up seeing two devices:

  1. "iPad" (This is the Ipad that you're currently using)
  2. "ipad123-testing" ( this is the proper name and matches intune / entra)

Under Settings > General > VPN & Device Management, I can see the correct Intune management profile installed. Sync and restart actions from Company Portal also work successfully.

It appears that Company Portal is not associating itself with the existing ADE enrollment record. Instead, it seems to be attempting a user-driven enrollment workflow on a device that is already enrolled and managed through ADE.

Has anyone else seen this behavior when using the new iOS Enrollment Policies with User Affinity and Modern Authentication? its unusable in this state.

i saw a random blog about using an app config to set xml for the company portal app but that cant be right for such a vanilla use case? didnt need to do that with the old profiles.I am trying to test the newer iOS Enrollment Policies using User Affinity with Modern Authentication instead of the older Enrollment Profiles.

One thing I've noticed is that the "Install Company Portal with VPP" setting exists in Enrollment Profiles, but I don't see an equivalent setting in the new Enrollment Policies.

My test Policy configuration is using:

  • User Affinity with Modern Authentication
  • Company Portal deployed as a VPP app

I tested deploying Company Portal as a required VPP app, and it installs successfully. However, when I launch Company Portal and sign in with my Entra ID credentials, it immediately prompts me to set up company access and download a management profile.

This doesn't seem correct because the device was already enrolled through ADE. If I select Postpone, Company Portal reports that I can't access company resources, and when I check further, it states that the device must be managed before apps can be installed.

this has to be a bug or something right? the microsoft docs on this are very confusing or missing details.

I also noticed that the device initially appears in Intune/entra as "iPad". After some time, the name eventually updates in entra and intune, However, within the Company Portal app, I end up seeing two devices:

  1. "iPad" (This is the Ipad that you're currently using)
  2. "ipad123-testing" ( this is the proper name and matches intune / entra)

Under Settings > General > VPN & Device Management, I can see the correct Intune management profile installed. Sync and restart actions from Company Portal also work successfully.

It appears that Company Portal is not associating itself with the existing ADE enrollment record. Instead, it seems to be attempting a user-driven enrollment workflow on a device that is already enrolled and managed through ADE.

Has anyone else seen this behavior when using the new iOS Enrollment Policies with User Affinity and Modern Authentication? its unusable in this state.

i saw a random blog about using an app config to set xml for the company portal app but that cant be right for such a vanilla use case? didnt need to do that with the old profiles.

Microsoft Security | Intune | Enrollment
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-07-28T02:54:00.0066667+00:00

    What is happening matches the documented behavior when Setup Assistant with modern authentication is used.

    With User Affinity + Setup Assistant with modern authentication:

    1. Company Portal can be installed during enrollment.
    2. When the user reaches the Home screen, Intune automatically applies the correct app configuration policy to Company Portal.
    3. A separate Company Portal app configuration policy must not be deployed after enrollment, because it causes errors.
    4. If Company Portal is installed outside that enrollment flow, the app can behave like a normal user-driven enrollment experience and prompt for company access / management profile.

    The key point is that for Setup Assistant with modern authentication, the documented path is to enable Company Portal installation from the enrollment policy itself, not just assign Company Portal later as a required VPP app.

    The documentation states:

    • For ADE with user affinity, Setup Assistant with modern authentication is the recommended authentication method.
    • In that flow, there is an Install Company Portal setting in the enrollment policy.
    • If VPP is used, Company Portal can be installed automatically without user Apple IDs.
    • Intune then pushes the correct Company Portal configuration automatically during initial enrollment.

    It also explicitly warns:

    • Don’t deploy the Company Portal configuration manually to users during initial enrollment with Setup Assistant with modern authentication, because it conflicts with the configuration Intune sends.
    • Don’t send a separate app configuration policy to Company Portal for iOS/iPadOS devices after enrolling with Setup Assistant with modern authentication, because it results in an error.

    Based on the described test, the likely issue is that Company Portal was only deployed as a required VPP app, instead of being installed through the ADE enrollment policy’s Company Portal installation path. In that case, Company Portal is not getting the enrollment-time configuration that ties it to the existing ADE-managed device, so it falls back to prompting for user-driven enrollment.

    Use this path instead:

    1. In Intune admin center, open the Apple enrollment policy for the ADE token.
    2. Configure Enroll with User Affinity.
    3. Select Setup Assistant with modern authentication.
    4. Set Install Company Portal to Yes.
    5. If available in that policy flow, select the VPP token so Company Portal installs without Apple ID prompts.
    6. Do not separately target Company Portal with a manual app configuration policy for that same modern-auth ADE scenario.
    7. Re-enroll the test device so the enrollment-time configuration is applied from the start.

    For already enrolled devices, the documented approach is different: add Company Portal as a required device licensed app, create an app configuration policy for Company Portal as a device licensed app, and deploy that policy to the same device group as the enrollment policy. But that guidance is for the already enrolled devices scenario, not the initial Setup Assistant with modern authentication enrollment flow.

    So this does not read like a general bug from the documented behavior. It reads like the device is missing the enrollment-time Company Portal installation/configuration path that modern auth expects.

    The duplicate device names in Company Portal are not explained in the provided documentation, so no supported conclusion can be made from that symptom alone.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.