-->

Nov 01, 2016. Access restricted Web sites and apps and browse Internet anonymously. Apple iOS 11 opens to the amazing possibilities for augmented reality in games and apps. Clash of Clans. To create and install an App Store provisioning profile, follow these steps: Log in to the Apple Developer Portal. In Certificates, IDs & Profiles, select Provisioning Profiles Distribution. Click the + button, select App Store, and click Continue.

Use app configuration policies in Microsoft Intune to provide custom configuration settings for an iOS/iPadOS app. These configuration settings allow an app to be customized based on the app suppliers direction. You must get these configuration settings (keys and values) from the supplier of the app. To configure the app, you specify the settings as keys and values, or as XML containing the keys and values.

As the Microsoft Intune admin, you can control which user accounts are added to Microsoft Office applications on managed devices. You can limit access to only allowed organization user accounts and block personal accounts on enrolled devices. The supporting applications process the app configuration and remove and block unapproved accounts. The configuration policy settings are used when the app checks for them, typically the first time it is run.

Once you add an app configuration policy, you can set the assignments for the app configuration policy. When you set the assignments for the policy, you can choose to include and exclude the groups of users for which the policy applies. When you choose to include one or more groups, you can choose to select specific groups to include or select built-in groups. Built-in groups include All Users, All Devices, and All Users + All Devices.

Note

Intune provides pre-created All Users and All Devices groups in the console with built-in optimizations for your convenience. It is highly recommended that you use these groups to target all users and all devices instead of any 'All users' or 'All devices' groups you may have created yourself.

Once you have selected the included groups for your application configuration policy, you can also choose the specific groups to exclude. For more information, see Include and exclude app assignments in Microsoft Intune.

Tip

This policy type is currently available only for devices running iOS/iPadOS 8.0 and later. It supports the following app installation types:

• Managed iOS/iPadOS app from the app store
• App package for iOS

For more information about app installation types, see How to add an app to Microsoft Intune. For more information about incorporating app config into your .ipa app package for managed devices, see Managed App Configuration in the iOS developer documentation.

Create an app configuration policy

1. Sign in to the Microsoft Endpoint Manager admin center.

2. Choose the Apps > App configuration policies > Add > Managed devices. Note that you can choose between Managed devices and Managed apps. For more information see Apps that support app configuration.

3. On the Basics page, set the following details:

   • Name - The name of the profile that appears in the Microsoft Endpoint Manager admin center.
   • Description - The description of the profile that appears in the Microsoft Endpoint Manager admin center.
   • Device enrollment type - This setting is set to Managed devices.

4. Select iOS/iPadOS as the Platform.

5. Click Select app next to Targeted app. The Associated app pane is displayed.

6. On the Targeted app pane, choose the managed app to associate with the configuration policy and click OK.

7. Click Next to display the Settings page.

8. In the dropdown box, select the Configuration settings format. Select one of the following methods to add configuration information:

   • Use configuration designer
   • Enter XML data
     For details about using the configuration designer, see Use configuration designer. For details about entering XML data, see Enter XML data.

9. Click Next to display the Assignments page.

10. In the dropdown box next to Assign to, select either Selected groups, All users, All devices, or All users and all devies to assign the app configuration policy to.

11. Select All users in the dropdown box.

12. Click Select groups to exclude to display the related pane.

13. Choose the groups you want to exclude and then click Select.

    Note

    When adding a group, if any other group has already been included for a given assignment type, it is pre-selected and unchangeable for other include assignment types. Therefore, that group that has been used, cannot be used as an excluded group.

14. Click Next to display the Review + create page.

15. Click Create to add the app configuration policy to Intune.

Use configuration designer

Microsoft Intune provides configuration settings that are unique to an app. You can use the configuration designer for apps on devices that are enrolled or not enrolled in Microsoft Intune. The designer lets you configure specific configuration keys and values that helps you create the underlying XML. You must also specify the data type for each value. These settings are supplied to apps automatically when the apps are installed.

Add a setting

1. For each key and value in the configuration, set:
   • Configuration key - The key that uniquely identifies the specific setting configuration.
   • Value type - The data type of the configuration value. Types include Integer, Real, String, or Boolean.
   • Configuration value - The value for the configuration.
2. Choose OK to set your configuration settings.

Delete a setting

1. Choose the ellipsis (...) next to the setting.
2. Select Delete.

The {{ and }} characters are used by token types only and must not be used for other purposes.

Allow only configured organization accounts in multi-identity apps

As the Microsoft Intune administrator, you can control which work or school accounts are added to Microsoft apps on managed devices. You can limit access to only allowed organization user accounts and block personal accounts on enrolled devices. For iOS/iPadOS devices, use the following key/value pairs in a Managed Devices app configuration policy:

Note

The following apps process the above app configuration and only allow organization accounts:

• Edge for iOS (44.8.7 and later)
• Office, Word, Excel, PowerPoint for iOS (2.41 and later)
• OneDrive for iOS (10.34 and later)
• OneNote for iOS (2.41 and later)
• Outlook for iOS (2.99.0 and later)
• Teams for iOS (2.0.15 and later)

Enter XML data

You can type or paste an XML property list that contains the app configuration settings for devices enrolled in Intune. The format of the XML property list varies depending on the app that you are configuring. For details about the exact format to use, contact the supplier of the app.

Intune validates the XML format. However, Intune does not check that the XML property list (PList) works with the target app.

To learn more about XML property lists:

• Refer to Understand XML Property Lists in the iOS Developer Library.

Example format for an app configuration XML file

When you create an app configuration file, you can specify one or more of the following values by using this format:

Supported XML PList data types

Intune supports the following data types in a property list:

• <integer>
• <real>
• <string>
• <array>
• <dict>
• <true /> or <false />

Tokens used in the property list

Additionally, Intune supports the following token types in the property list:

• {{userprincipalname}}—for example, John@contoso.com
• {{mail}}—for example, John@contoso.com
• {{partialupn}}—for example, John
• {{accountid}}—for example, fc0dc142-71d8-4b12-bbea-bae2a8514c81
• {{deviceid}}—for example, b9841cd9-9843-405f-be28-b2265c59ef97
• {{userid}}—for example, 3ec2c00f-b125-4519-acf0-302ac3761822
• {{username}}—for example, John Doe
• {{serialnumber}}—for example, F4KN99ZUG5V2 (for iOS/iPadOS devices)
• {{serialnumberlast4digits}}—for example, G5V2 (for iOS/iPadOS devices)
• {{aaddeviceid}}—for example, ab0dc123-45d6-7e89-aabb-cde0a1234b56

Install Ios Application Store

Configure the Company Portal app to support iOS and iPadOS DEP devices

DEP (Apple's Device Enrollment Program) enrollments are not compatible with the app store version of the Company Portal app. However, you can configure the Company Portal app to support iOS/iPadOS DEP devices using the following steps.

1. In Intune, add the Intune Company Portal app if necessary, by going to Intune > Apps > All apps > Add.

2. Go to Apps > App configuration policies, to create an app configuration policy for the Company Portal app.

3. Create an app configuration policy with the XML below. More information on how to create an app configuration policy and enter XML data can be found at Add app configuration policies for managed iOS/iPadOS devices.

   • Use the Company Portal on a DEP device enrolled with user affinity:

   • Use the Company Portal on a DEP device enrolled without user affinity:

     Note

     The user signing in to Company Portal is set as the primary user of the device.

4. Deploy the Company Portal to devices with the app configuration policy targeted to desired groups. Be sure to only deploy the policy to groups of devices that are already DEP enrolled.

5. Tell end users to sign into the Company Portal app when it is automatically installed.

Monitor iOS/iPadOS app configuration status per device

Once a configuration policy has been assigned, you can monitor iOS/iPadOS app configuration status for each managed device. From Microsoft Intune in the Microsoft Endpoint Manager admin center, select Devices > All devices. From the list of managed devices, select a specific device to display a pane for the device. On the device pane, select App configuration.

Additional information

Next steps

Ios Store Application State

Continue to assign and monitor the app.