Plan for Change: Web based device enrollment will become default method for iOS/iPadOS device enrollment

Starting early 2027, web-based device enrollment will be the default for new iOS/iPadOS enrollment profiles in Intune. Existing profiles remain unchanged. Admins must deploy the SSO extension policy for just-in-time registration. Company Portal remains available but is not required for enrollment. Update documentation accordingly.

Today, when creating iOS/iPadOS enrollment profiles, “Device enrollment with Company Portal” is preselected as the default method. Starting in early 2027, the default method will change to “Web based device enrollment” during profile creation. Additionally for new tenants, if no enrollment profile is created, the user will enroll using web-based device enrollment.

Important: For web enrollment, admins need to deploy the single sign-on (SSO) extension policy to enable just in time (JIT) registration, for more information review: Set up just in time registration in Microsoft Intune

[How this will affect your organization:]

Existing enrollment profiles are not affected. This change updates the Intune admin experience for creating new iOS/iPadOS enrollment profiles. "Web based device enrollment" will be displayed and selected as the default enrollment method during profile creation.

User impact: Users enrolling through profiles that use web-based device enrollment or if no enrollment profile is completed, users will complete enrollment through the web-based flow.

Note: This change does not deprecate Company Portal for iOS/iPadOS. Company Portal will remain available because it supports experiences beyond device enrollment. However, Company Portal is not required to complete web-based device enrollment. If your organization uses Company Portal after enrollment, we recommend deploying it as a required or available app so users can continue accessing those experiences.

[What you need to do to prepare:]

Update your documentation and user guidance as needed. If you currently use device enrollment with Company Portal, we recommend moving to web-based device enrollment and deploying the SSO extension policy to enable JIT registration.

If your organization uses Company Portal after enrollment, deploy it as a required or available app. If JIT registration and Microsoft Authenticator are not configured, users may be unable to complete device registration and access protected organizational resources.

Additional information:

• Set up just in time registration in Microsoft Intune
• Set up web-based device enrollment for iOS