📄 New Phone Setup and Enrolment

Keywords: new phone, set up phone, enrol phone, Intune, company phone, passkey setup, phone enrollment

What you need before you start

  • The new phone, unboxed and powered on.
  • The user's Entra ID email address and their current Temporary Access Pass or existing sign-in method.
  • The Microsoft Authenticator app (installed as part of setup).

Enrolling the device in Intune

  1. On the phone, open Settings > Accounts > Add account > Work or school account.
  2. Enter the user's Entra ID email address and follow the sign-in prompts. Use the Temporary Access Pass if this is a brand new user.
  3. The phone will connect to Entra ID and download the Intune management profile. This takes a few minutes.
  4. Open intune.microsoft.com on another device. Go to Devices > All devices. Search for the device (may take up to 15 minutes). It should show as Compliant or Pending.
  5. If Not compliant, click on it to see which compliance policies are failing. Common causes: screen lock not configured, or OS version out of date. Click Sync to push a check-in.

Setting up Microsoft Authenticator for passkey sign-in

  1. Install Microsoft Authenticator from the Play Store or App Store if not already present.
  2. Open Authenticator. Tap the plus icon > Add account > Work or school account > Sign in.
  3. Sign in with the user's Entra ID email. Approve using the Temporary Access Pass if prompted.
  4. Once the account is added, Authenticator will prompt to register a passkey. Follow the on-screen steps. The user confirms with biometric (fingerprint or face) or PIN.
  5. Alternatively, the user can go to aka.ms/mysecurityinfo in a browser, sign in with the TAP, and add a passkey from there.
  6. Test sign-in: open a browser on the phone, go to office.com, and sign in. Authenticator should prompt for biometric approval.
  7. Confirm Teams and Outlook are working.
  8. Update the ticket: device name, Intune enrolment status, and confirmation that passkey sign-in was tested successfully.