Enroll iPads in Intune: Shared iPad, Education, Kiosk · CloudEngineerHub
Device Enrollment10 min read1 views
How to Enroll iPads in Intune: Shared iPad Mode, Education Setups and Kiosk Builds
Deploy iPads at scale in Intune: ADE profiles, Shared iPad mode with federated accounts and temporary sessions, education setups, kiosk single-app builds, and fixes.
C
CloudEngineerHub Team
Published: September 14, 2026· Last Updated: September 28, 2026·10 min read
Enrolling iPads in Intune: Shared iPad, Education, Kiosk
A fleet of iPads passed between shifts, wards, or classrooms is a different animal from one iPad per person: the risk is not the device, it is the last user's data lingering on it. Apple's Shared iPad mode, temporary sessions, and single-app lockdown solve this — but only if the enrollment profile, account model, and configuration are all set correctly before the cart leaves IT. This guide covers the ADE setup, the account federation decision, education builds, kiosk patterns, and the failures that show up on rollout morning.
Visual Walkthrough
Automated Device Enrollment steps that make iPhones zero-touch.
C
CloudEngineerHub Team
Author
The CloudEngineerHub editorial team — Microsoft endpoint management and cloud engineers writing hands-on guides on Intune, Azure, Entra ID, Autopilot, Defender and PowerShell. Every article is reviewed against current Microsoft documentation.
iOS Enrollment — ABM to Supervised Device. 1. ABM/ASM sync: Devices purchased via Apple Business Manager appear in Intune. — 2. ADE profile assigned: Supervision, affinity, locked enrollment defaults set. — 3. Setup Assistant runs: User unboxes; Wi-Fi + profile fetch happens in OOBE. — 4. Supervised enrollment: Device enrolls with supervision — richer controls unlocked. — 5. Company Portal + apps: VPP apps, email/Wi-Fi and compliance land. — 6. Managed end-to-end: Locked enrollment prevents un-enrollment; lifecycle clean.
Prerequisites
Apple Business Manager or Apple School Manager tenant with the Intune MDM server token connected (Intune admin center > Devices > Enrollment > Apple > Apple enrollment program tokens)
iPads on iPadOS 13.4 or later for Shared iPad mode; check Microsoft Learn for the currently supported iPadOS versions
All iPads enrolled through Automated Device Enrollment — Shared iPad cannot be enabled on already-deployed devices without a wipe and re-enrollment
An identity plan: Managed Apple IDs (created in ABM/ASM or via federated authentication) for user-based shared sign-in, or temporary-session-only operation if users have no accounts
Wi-Fi reachability during Setup Assistant, and a network design that allows Bonjour/mDNS if you plan to use the Classroom app
What Shared iPad mode actually is
Shared iPad mode turns an ADE-enrolled iPad into a multi-user device. Each user signs in with a Managed Apple ID, iOS creates a separate container for their data, and up to a configured number of users stay cached on the device so sign-in is fast. When a user signs out, their data stays (if cached) or is purged (if evicted). Temporary sessions extend this: a guest signs in with no Apple ID at all, gets a clean session, and the device wipes that session's data at sign-out.
The account model is the hard prerequisite: user-based shared sessions require Managed Apple IDs sourced from Apple School/Business Manager — either created there manually or provisioned through federated authentication with your identity provider. If your front-line users will never have accounts, skip user sessions entirely and configure the profile for temporary sessions only.
ADE enrollment for shared iPads
Enrollment profile settings that matter
Create the profile in the Intune admin center under Devices > Enrollment > Apple > Apple enrollment program tokens > Profiles > Create profile, platform iPadOS, enrollment type with user affinity. The Shared iPad switches appear here:
Setting
Range/Values
Practical guidance
Shared iPad
On/Off
Must be On before enrollment; cannot be toggled later
Max cached users
2–24
Higher = faster sign-ins for a small user pool; warehouse carts usually 4–10
Temporary session only
On/Off
On for guest-style devices (no Managed Apple ID needed at sign-in)
Temporary session timeout (minutes)
e.g., 15–120
Force sign-out for forgotten sessions; pick your ward/shift length
Aggressive cache purge
On/Off
Evicts cached users sooner to reclaim storage on small-capacity iPads
Battery charge threshold
Percentage
Below this charge, the device purges inactive users to save power
Assign, wipe, enroll
Assign the profile to the device serials (or set the ABM default MDM server), wipe any existing iPads, and run Setup Assistant. A correctly configured Shared iPad shows a Shared iPad sign-in screen instead of a normal Apple ID prompt. If you see the ordinary setup flow instead, the profile applied without the shared flag — re-check the profile, re-assign, wipe, and try again, because this setting is enrollment-time only.
Field note: Test with two real Managed Apple IDs before fleet day. Create them in ABM or via federation, sign in, sign out, sign in again on a wiped device. Account caching behavior is discovered in a hallway at 7:55 a.m. with thirty students waiting — never in the lab.
Managed Apple IDs and federation
Federate Entra ID with Apple
In Apple Business/School Manager under account settings, enable federated authentication with your Microsoft Entra ID domain: users then sign in to Shared iPads with their existing corporate credentials, and password resets stay in one place (Apple pushes resets back to the IdP). Federation is the difference between an account model that scales and a spreadsheet of manually created Apple accounts that rot the first month.
When federation is not an option
Regulated environments sometimes refuse IdP federation on shared hardware. Your alternatives, in order of preference: create Managed Apple IDs directly in ABM for a small stable user pool; use temporary sessions only; or move the workload to a dedicated-device kiosk model (below) where per-user identity is not required at all.
Education configurations for classrooms
Education fleets share hardware at the highest density and need three things wired together:
Shared iPad enrollment profile as above, with Max cached users tuned to class size and aggressive cache purge enabled on 64 GB models.
The Classroom app deployed through Intune (Apps > iOS/iPadOS), with an iOS device configuration profile that enforces education settings — automatically joining classes and locking student screens when the teacher does.
Network allow-listing for Apple Classroom traffic, which relies on Bonjour/mDNS across the student and teacher VLANs; many campus networks block this by default and the app appears broken when it is not.
Apple School Manager simplifies this further: rosters sync, Managed Apple IDs provision per student, and Schoolwork assignments ride on the same accounts. If you are rebuilding an education tenant, do ASM federation first — everything downstream assumes those accounts exist.
Kiosk builds: single-app lockdown and ASAM
Standard supervised single-app mode
For lobby directories, registration kiosks, and point-of-sale iPads, create a kiosk configuration profile in the Intune admin center (Devices > Configuration > Create > iOS/iPadOS > Kiosk template, or the equivalent single-app device features profile). The device locks to one installed app at boot; exiting requires MDM. The app must already be deployed via Intune before the profile applies, or the device can lock to an empty home screen — a mistake that guarantees a drive to the site.
Autonomous Single App Mode (ASAM)
ASAM is a different mechanism: the app itself holds the ASAM entitlement and asks iOS to enter or exit lockdown as needed — useful for accessibility and transaction apps that must occasionally show other UI. From Intune you still supervise the device and deploy the app; the app controls the lockdown lifecycle. If your vendor's app does not advertise ASAM support, use standard single-app mode instead — there is no way to grant the entitlement yourself.
Characteristic
Standard single-app (MDM)
ASAM (app-driven)
Who controls lockdown
Intune profile, always-on
The app, on demand
App requirement
Any installed app
App must ship with ASAM entitlement
Exit path
MDM only
The app can release itself
Best fit
Kiosks, signage, POS
Guided workflows, assistive apps
Visual Walkthrough
What employees actually see, and why each screen exists.
Interactive FlowCompany Portal — The End-User Journey6/6
1
Sign in
Work account + MFA; branding sets the first impression.
status
2
Device status
Compliance state and "what we can see" transparency.
apps
3
Install apps
Company apps self-service; required apps silent.
help
4
Get help
Contact IT, diagnostics, remote actions where permitted.
Clean offboarding path removes org data on farewell.
Company Portal — The End-User Journey. 1. Sign in: Work account + MFA; branding sets the first impression. — 2. Device status: Compliance state and "what we can see" transparency. — 3. Install apps: Company apps self-service; required apps silent. — 4. Get help: Contact IT, diagnostics, remote actions where permitted. — 5. Self-service actions: Rename, reset PIN, remote lock — autonomy reduces tickets. — 6. Retire / transfer: Clean offboarding path removes org data on farewell.
Verification and troubleshooting
Verify a shared iPad by signing in as a test user, checking that data lands in that user's container, signing out, and confirming a second user sees nothing of the first. For kiosks, reboot the device and confirm the app relaunches locked. In the Intune admin center under Devices > iOS/iPadOS, confirm the device record, user affinity, and compliance state.
Symptom
Likely cause
Fix
No "Shared iPad" sign-in after enrollment
Profile enrolled without Shared iPad enabled
Enable in the enrollment profile, re-assign, wipe, re-enroll
Users cannot sign in at all
Federation not enabled or Managed Apple ID missing
Verify federated accounts in ABM/ASM; confirm the account exists
Temporary session data survives sign-out
Temporary session only/purge settings off
Enable temporary-session-only mode and session timeout, wipe, re-enroll
Classroom app cannot see students
mDNS/Bonjour blocked between VLANs
Allow Apple Classroom traffic; test from the classroom subnet
Kiosk locks to a blank screen
Single-app profile applied before app installed
Deploy the app first, then assign the kiosk profile
Cached users evicted constantly
Max cached users too low, aggressive purge on, or storage saturated
Raise the cache limit or disable aggressive purge; audit storage
Field note: The most expensive shared-iPad mistake is silent: a kiosk profile assigned before the kiosk app finishes installing. The device locks itself to nothing and the fix is a site visit. Sequence app deployment, wait for install status, then assign the kiosk profile.
Key takeaways
Shared iPad mode is an enrollment-time setting over ADE: enable it in the enrollment profile, and plan a wipe/re-enroll cycle for any existing device.
User-based shared sessions require Managed Apple IDs; federating Entra ID with ABM/ASM is the scalable way to provide them.
Temporary sessions give account-free guest access with data purged at sign-out — the right default for wards, carts, and loaner pools.
Tune Max cached users, aggressive cache purge, and the battery threshold per hardware capacity; a 64 GB iPad behaves very differently from a 256 GB one.
Education builds need the Classroom app plus network allowances for Bonjour — a blocked mDNS path looks like an app failure.
Standard single-app lockdown is MDM-controlled and always-on; ASAM requires an app-side entitlement you cannot add yourself.
Sequence matters for kiosks: deploy the app, confirm install, then assign the kiosk profile.
Frequently asked questions
Do shared iPads need an Intune license for every user?
Temporary-session-only devices do not check in with per-user licensing in any meaningful way — they are anonymous guest sessions. Devices used with per-user Managed Apple ID sessions behave like user-affinity devices and the users should carry Intune licenses, since compliance and management features are evaluated in the user context. When in doubt, license the user pool and keep temporary-only devices for the anonymous ones.
Can I convert an existing, already-deployed iPad to Shared iPad mode?
No — Shared iPad is part of the enrollment profile and only applies during Setup Assistant. The conversion is always wipe plus re-enrollment with a shared-enabled profile, which is why the account and caching decisions should be settled before the fleet ships.
Does kiosk single-app mode survive a reboot?
Yes. Standard supervised single-app mode is enforced by the MDM-installed profile and re-applies at every boot — the device comes back locked to the app. ASAM re-entry depends on the app's own logic; test the reboot path with your specific app, because a kiosk that boots unlocked is a compliance finding, not a feature.
Appendix: admin-side verification snippets
After an enrollment wave, verify device state from Graph before touching the portal UI — it is faster, scriptable, and exportable for change records.
PowerShell
1
2
3
4
5
6
7
8
# Connect and list Shared iPad-mode devices with their Shared Device status
Connect-MgGraph -Scopes"DeviceManagementManagedDevices.Read.All"
Get-MgDeviceManagementManagedDevice -All -Filter"contains(operatingSystem,'iOS')" |
Select-Object deviceName, userPrincipalName, complianceState,
@{n='Enrolled';e={$_.enrolledDateTime.ToString('yyyy-MM-dd HH:mm')}},
@{n='Shared';e={$_.deviceOwnership -eq'company' -and$_.isSharedDevice}} |
Format-Table -AutoSize
PowerShell
1
2
3
4
5
6
# Flag iPads that enrolled but never checked in for more than 24 hours$cutoff = (Get-Date).AddHours(-24)
Get-MgDeviceManagementManagedDevice -All -Filter"contains(operatingSystem,'iOS')" |
Where-Object { $_.lastSyncDateTime -lt$cutoff -and$_.enrolledDateTime -gt$cutoff.AddDays(-30) } |
Select-Object deviceName, enrolledDateTime, lastSyncDateTime |
Sort-Object lastSyncDateTime
Field note:isSharedDevice is only populated for iPads actually activated in Shared iPad mode — a fleet of "shared" carts where this flag is false means your ADE profile's Shared Device toggle never reached the device, usually because the profile was assigned after first boot and the cart was never wiped.
Comments
0No comments yet — be the first to share your thoughts.