Publish corporate applications to iOS using Configuration Manager and Intune

Q. How can I publish corporate applications to an iOS device using Configuration Manager via Intune?
Dept - Intune

A. Intune enables full management of mobile devices including iOS, Android and Windows Phone. Often organizations wish to deploy applications to these devices and ensure corporate data stays within the corporate applications, not being able to leak into personal applications on the device. In this walkthrough I will go through all the steps required to enable this for iOS using Intune and performing the actual configuration using Configuration Manager (which connects to Intune).

First make sure you have connected Intune to your Configuration Manager instance via the Administration workspace - Cloud Services - Microsoft Intune Subscription. As part of this connection you can configure logos and contact details. Once the connection is established select the Intune subscription and from the Home tab select Create APNs certificate request which enables a certificate request to be generated that is saved to a file. This is then uploaded to the Apply Push Certificate Portal and then the certificate downloaded. There is no charge for this certificate and it enables deployment to iOS devices.

Still selecting the Intune subscription select Configure Platforms from the Home tab and select iOS. Check the box to enable iOS enrollment and select the certificate you downloaded from the Apple site. Note you can also select Android and other platforms to enable enrollment.

The next step is to create a Configuration Item and Configuration Baseline for iOS which will block corporate data being used in personal applications.

1. Select the Assets and Compliance workspace
2. Select Compliance Settings - Configuration Items
3. Select Create Configuration Item. Select a name and set the target device to be iOS and Mac OS X from the list of device types and click Next
4. For the platforms select iPhone and iPad and click Next
5. For the list of device settings select Data Protection and click Next
6. Set the Open documents in managed apps in other unmanaged apps to Disabled and optionally enable unmanaged apps to open data in managed apps to Enabled. Make sure Remediate noncompliant settings is checked and click Next
7. Click Next to all remaining questions
8. Select Compliance Settings - Configuration Baselines
9. Select Create Configuration Baseline
10. Enter a name for the baseline and add the configuration item that was created and click OK
11. Right click the new baseline and select Deploy. Select the target collection (e.g. All Mobile Devices) and check the Remediate noncompliant rules when supported. Click OK

You are now ready to actually publish applications which will be via the Apple Store.

1. Open the Software Library workspace
2. Open Application Manager - Application Management Policies
3. Select Create Application Management Policy
4. Enter a name and click Next
5. Select the Platform as IOS and the policy type as General then click Next
6. Configure all required settings. Critical settings are:
   Allow app to transfer data to other apps: Policy Managed Apps
   Prevent "Save As" : Yes
   Require simple PIN for access :
7. Click Next
8. Once complete click Close. You may choose to create different policies for different applications
9. Select Application Management - Applications
10. Select Create Application
11. For the application type select App Package for iOS from App Store and enter the URL for Outlook, e.g. https://itunes.apple.com/us/app/microsoft-outlook-email-calendar/id951937596?mt=8. Click Next
12. Click Next and enter any specific details then click Next until complete
13. Repeat the process for additional applications
14. Right click on the application and select Deploy
15. Specify a collection, e.g. All Mobile Devices under Device Collections and click Next
16. Click next to all the sections until you get to Application Management. Select the application management policy previously created
17. Click Next to all other dialogs until complete

Enrolled iOS devices will now have the applications available via the Company Portal application once enrolled and data (including clipboard) will not be able to leave the corporate deployed applications to personal applications.

I have a video walking through this at https://youtu.be/wfWoLLx8WeA.

For more details on device enrollment see https://technet.microsoft.com/en-us/library/jj884158.aspx.