Enrollment time grouping for Macs with automated device enrollment

A new Mac comes out of the box, goes through Setup Assistant and enrolls in Intune through automated device enrollment (ADE). Even so, the apps and policies are often not there yet. Intune only places a device in groups after enrollment, based on inventory data, and only then knows what the device should get. According to Microsoft, it can take up to eight hours after enrollment before a device has all apps and policies.

In the week of 15 June 2026, enrollment time grouping became generally available for Apple ADE on macOS and iOS/iPadOS. In this blog post you read what enrollment time grouping does, how to set it up in an enrollment policy for macOS, and which report Microsoft names for devices that did not end up in the group.

What is enrollment time grouping?

With enrollment time grouping you link a Microsoft Entra security group to an enrollment policy. A device that enrolls with that policy becomes a member of the group during enrollment, not afterward. Apps and policies you assign to that group can therefore be delivered by Intune sooner after enrollment.

A few points to know in advance:

• It works only in the new enrollment policies for Apple ADE (Enrollment program tokens > Enrollment policies). The older profiles under Enrollment program tokens > Profiles get no new features and will eventually disappear, according to Microsoft.
• It applies only to new enrollments. Macs that are already enrolled are not affected.
• You link one static (assigned) security group per enrollment policy. You cannot choose dynamic groups.
• In some sovereign clouds, including Azure Government and Azure operated by 21Vianet, it is not available for Apple ADE.

What do you need?

• A connection between Intune and Apple Business or Apple School Manager, with an active ADE token (see also Fully managed Apple devices with Apple Business Manager and Intune), and an Apple MDM push certificate in Intune. Apple Business is the current name of Apple Business Manager.
• New or wiped Macs that were purchased through Apple Business or Apple School Manager.
• An Intune role that lets you create enrollment policies for macOS; the source does not name which role exactly, so this is an interpretation. To link a group, you need at least the permission enrollment time device membership assignment in a custom role, under Enrollment programs.
• The security group must be assigned as a scope group to your Intune role, otherwise you cannot choose it in the policy.
• To add the Intune app as owner of the group: the Microsoft Entra Group Administrator role, the permission microsoft.directory/groups/owners/update, or you are already an owner of the group.

Create the security group

The group needs the Intune Provisioning Client service principal as its owner. You don’t need to add members yet.

1. Sign in to the Microsoft Intune admin center.
2. Navigate to Groups > All groups and click New group.
3. Set Group type to Security.
4. Give the group a name, for example “Contoso – macOS – ADE”, and a description.
5. Set Microsoft Entra roles can be assigned to the group to No.
6. Set Membership type to Assigned.
7. Under Owners, click No owners selected.
8. Search for Intune Provisioning Client with AppId f1346770-5b25-470b-88bd-d5744ab7952c, select the service principal and click Select.
9. Click Create.

💡 Note: in some tenants the same service principal is called Intune Autopilot ConfidentialClient. What matters is the AppId; it must be f1346770-5b25-470b-88bd-d5744ab7952c.

Link the group to an enrollment policy for macOS

1. In the Intune admin center, navigate to Devices, expand Device onboarding and select Enrollment.
2. Open the macOS tab and, under Bulk Enrollment Methods, select Enrollment program tokens.
3. Select your token and choose Enrollment policies > Create policy > macOS.
4. On Basics, enter a name and description and click Next.
5. On the Device group tab, select the group you just created and click Next.
6. On Configuration settings, set the other settings, such as User Affinity, Await final configuration and the Setup Assistant screens.
7. Click Next, review the summary and click Create.

Then assign the policy to the Macs under the token: open the token, go to Devices, select the devices and choose Assign policy. You can also set the policy as the default with Set Default Policy.

💡 Next, assign the apps and policies a Mac needs first to the same group. That is the whole point: what is assigned to the group, Intune can deliver sooner after enrollment.

You can change the group in the policy later. That change does not apply to devices that have already enrolled with the policy. If you remove a device from the group, Intune determines again which policies belong to it and has the device check in to get the new configuration.

Keep an eye on the failures report

Navigate to Devices > Monitor > Enrollment time grouping failures. The report shows only devices that could not be added to the group, not successful enrollments. In the list for this report, Microsoft names Apple mobile ADE, but not macOS explicitly. So for a Mac, also check whether it actually became a member of the group. New data can appear up to 20 minutes later. To see the report, you need the permission Microsoft.Intune/ManagedDevices/Read.

Microsoft recommends monitoring this report continuously. If a device does not end up in the group, the configuration can change after enrollment or disappear from the device.

Known issue

If you edit an existing Apple ADE policy under Enrollment policies, the Remove option for the linked group is missing. Microsoft names two workarounds: delete the policy and create a new one, or remove the group with Microsoft Graph. This call in the beta API unlinks the group from the policy:

DELETE https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('{policyId}')/clearEnrollmentTimeDeviceMembershipTarget

User experience

The user goes through Setup Assistant as always. According to Microsoft, the assigned apps and policies should already be on the device or be installing as soon as the home screen appears.

If Await final configuration is set to Yes, the Mac waits on a locked screen at the end of Setup Assistant until Intune has checked in. Microsoft does not name the combination with enrollment time grouping as a recommendation, but an interpretation is that Intune at that moment already knows which group-based apps and policies belong to the device.

Wrapping up

Enrollment time grouping puts a new Mac in the right group during enrollment, so Intune can deliver apps and policies without first waiting for group assignment. Create a static group with the Intune Provisioning Client as owner, link it in a new enrollment policy and keep track of the failures report.

📚 Read more in Set up automated device enrollment (ADE) for macOS on Microsoft Learn.