The following list of steps and screenshots are taken during the enrolment process to add an iPhone to Office 365 once the free MDM solution that comes with Office 365 is enabled for a user.
| Step | Details | Image |
|
1. |
Once your IT Administrator enables MDM for your Office 365 account you will get the following email on your device if you already have email configured. It may take 24 hours from the admin configuring MDM for this to arrive. Once this email arrives no further email will arrive from that account any device until the devices are enrolled with the company for management. |
 |
|
2. |
Click “Enrol your device” link in Step 1 of the email. This will take you to the relevant app store of your device to install the Company Portal (iPhone as shown and Android devices). Windows Phone users will see the Workplace Join settings (not shown) In this example, the Company Portal app is already installed so we can click Open at the top. Most users will need to install this free app from the page they see in the App Store. |
 |
| 3. | You are required to login. Enter your Office 365 username. Upon entering your username you will either be directed to your network to login (if your company uses AD FS to login) or you enter the password here. Step 4 shows the AD FS login page, which will probably have your company logo on it. If your IT department does not use AD FS you enter your password here (the page will wait for you to enter it) |
 |
| 4. | This is an example AD FS login page with company logo. If you are required to login with other information as well as your password you will be prompted for this as well. |  |
| 5. | Upon login being successful your device will start the enrolment process by connecting to both Office 365 and the device manufacturer to download required secure management info. |  |
| 6. | Click Enroll to start the process.
The company you are enrolling your phone into will have some rights over some of the data on your phone – for example they will be able to remove the work email account from it if you leave the company. Enrolment conditions will be enforced based on your companies requirement for using phones to access company data, for example a PIN number of a minimum length (see http://bit.ly/o365mdm for more on this) |
 |
| 7. | Enrolment goes through a series of steps with the screen changing a few times automatically. Within a seconds you end up at the “Install” screen. Click Install to add the management profile for the displayed company here. |  |
| 8. | A unique encryption key is generated for your device |  |
| 9. | You need to click install at the personal settings screen |  |
| 10. | You need to confirm that you trust this company for remote management of your device |  |
| 11. | The management profile is installed and you can click Done. |  |
| 12. | Device checks that it is enrolled and what the device settings are and if these settings are compatible with the companies required restrictions on the device. |  |
| 13. | Enrolment is confirmed. Notice that my device(s) are displayed and my current device is not compliant with company policy (the red exclamation mark) |  |
| 14. | Clicking my device in the Company Portal app shows the compliance status of the device. Here the device is still checking compliance |  |
| 15 | And here the device is shown not to be compliant. |  |
| 16 | Details on compliance state are shown when clicking the “This device is not in compliance” message.
Further details on the compliance failure are shown under the message. In this case the device is unable to set up an email profile on the device. |
 |
| 17 | Clicking the “Unable to set up email on the device” message shows the full details. In this case the device already has an email profile configured and for the iPhone this needs to be removed and the Company Portal will recreate it. It is this recreated email profile that the iPhone/iPad can manage.
Android and Windows Phone users do not need to delete their email profile and have the device recreate it. |
 |
| 18 | For the iPhone/iPad the steps to delete the existing profile are Settings > Mail, Contacts, Calendars > Click the email profile > click Delete Account |  |
| 19 | Once the account is deleted it is not visible in the list of email accounts.
In this example the iCloud account remains along with two Exchange / Office 365 accounts that are not managed by MDM. You can only have one MDM managed account per device at any given time. Other compliance settings may be required such as a PIN number. You have 60 minutes to enabled this if required. |
 |
| 20 | Once the Company App checks for compliance again, a new email profile for your work appears. Clicking it (called “Office 365 email”) requires entry of your password. |  |
| 21 | You then see the email profile created. Compare this to the image in Step 19 for the difference. |  |
| 22 | It is possible to rename the email profile. In this case it is via Settings > Email, Contacts, Calendars > Office 365 email > Account and then change the “Description” value |  |
| 23 | Updated email profile listed |  |
| 24 | Email should now sync with your device again. Notice that the email about needing to set up MDM is now missing and has been removed automatically |  |
| 25 | Now that the device is compliant (excepting the PIN number, which gives you 60 minutes of grace to complete this step) you can start other Office 365 aware applications. Here we are going to sign into OneDrive and show our OneDrive for Business data |  |
| 26 | Your app requires a login |  |
| 27 | Which if you have an AD FS additional login you may also see |  |
| 28 | Your other app is now working, and in the case of OneDrive for Business did not need configuring |  |