Device enrollment, the four paths
Autopilot, BYOD, Apple ADE, Android Enterprise — when to pick each, and what they actually do under the hood.
Enrollment is how a device tells your tenant "I exist, manage me." There are four common paths and picking wrong is the main reason rollouts go sideways.
1. Windows Autopilot
For corporate-owned Windows. The device's hardware hash gets uploaded to your tenant (usually by the OEM). When the user signs in for the first time, Autopilot pulls down your profile, joins Entra, and enrolls into Intune. No imaging, no IT touch.
2. BYOD enrollment (Company Portal)
For personally-owned devices. The user installs the Company Portal app, signs in, and consents to management. You get less control by design — usually MAM (app-level) policies instead of full MDM.
3. Apple ADE (Automated Device Enrollment)
Apple's equivalent of Autopilot for iPhone, iPad, and Mac. Device serial numbers are registered to your Apple Business Manager account, which syncs to Intune. First boot → managed setup.
4. Android Enterprise
Modes: fully managed (corporate-owned, COPE), work profile (BYOD), and dedicated (kiosk). Pick the mode before you write any policies — they don't share a config namespace cleanly.
Rule of thumb: if you bought it, use Autopilot or ADE. If the user bought it, use Company Portal or work profile.