Summary
- Intune will change the default iOS/iPadOS enrollment method in the profile creation experience from Company Portal-based enrollment to web-based device enrollment.
- Existing iOS/iPadOS enrollment profiles are not affected; the change applies to new profile creation and, for new tenants without an enrollment profile, to the default enrollment flow.
- Administrators using web-based enrollment must deploy the SSO extension policy to enable just-in-time registration and should ensure Microsoft Authenticator is in place if required by their enrollment/access design.
- Company Portal is not being deprecated, but if your organization relies on it after enrollment, it should still be deployed as a required or available app.
- IT should review documentation, update user guidance, and plan any enrollment workflow changes before the default switches.
Starting early 2027, web-based device enrollment will be the default for new iOS/iPadOS enrollment profiles in Intune. Existing profiles remain unchanged. Admins must deploy the SSO extension policy for just-in-time registration. Company Portal remains available but is not required for enrollment. Update documentation accordingly.
Message ID: MC1476216
Primary Service: Intune
Admin Impact: Medium
User Impact: Low
Release Start: 21 Sept 2026
Release End: 21 Sept 2026
Service: Microsoft Intune
Category: Plan for change
Tags: User impact, Admin impact, Admin Action, User Adoption
Rollout: January 2027
History
9/21/2026 Item Added to Message Center
Microsoft Message
Today, when creating iOS/iPadOS enrollment profiles, “Device enrollment with Company Portal” is preselected as the default method. Starting in early 2027, the default method will change to “Web based device enrollment” during profile creation. Additionally for new tenants, if no enrollment profile is created, the user will enroll using web-based device enrollment.
Important: For web enrollment, admins need to deploy the single sign-on (SSO) extension policy to enable just in time (JIT) registration, for more information review: Set up just in time registration in Microsoft Intune
How this will affect your organization
Existing enrollment profiles are not affected. This change updates the Intune admin experience for creating new iOS/iPadOS enrollment profiles. “Web based device enrollment” will be displayed and selected as the default enrollment method during profile creation.
User impact: Users enrolling through profiles that use web-based device enrollment or if no enrollment profile is completed, users will complete enrollment through the web-based flow.
Note: This change does not deprecate Company Portal for iOS/iPadOS. Company Portal will remain available because it supports experiences beyond device enrollment. However, Company Portal is not required to complete web-based device enrollment. If your organization uses Company Portal after enrollment, we recommend deploying it as a required or available app so users can continue accessing those experiences.
What you need to do to prepare
Update your documentation and user guidance as needed. If you currently use device enrollment with Company Portal, we recommend moving to web-based device enrollment and deploying the SSO extension policy to enable JIT registration.
If your organization uses Company Portal after enrollment, deploy it as a required or available app. If JIT registration and Microsoft Authenticator are not configured, users may be unable to complete device registration and access protected organizational resources.
Additional information:
- Set up just in time registration in Microsoft Intune
- Set up web-based device enrollment for iOS