Apple ADE Devices Never Enrolled
The question it answers: Which Apple devices from Apple Business Manager never enrolled in Intune, or have no enrolment profile?
Every iPhone, iPad and Mac bought through Apple Business Manager appears in Intune before anyone unboxes it. Serial numbers that never enrol are hardware in a cupboard, lost, or handed to someone who skipped setup; devices without an enrolment profile would set up unmanaged.
At a glance
Section titled “At a glance”| Where in the app | Intune › Device Operations & Hardening › Apple ADE Never Enrolled |
| Workload | Intune |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Intune + Apple Business Manager. |
| Report id (API and MCP) | intune.operations.ade-never-enrolled |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Enrolment state | Category | Text |
| Serial number | Subject | Link |
| Check | Setting | Text |
| Profile | Value | Text |
| Finding | Finding | Text |
| Platform / token | Detail | Text |
| Imported | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Intune + Apple Business Manager.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementServiceConfig.Read.All | Microsoft Graph | Read Microsoft Intune configuration |
Data sources it reads
GET /beta/deviceManagement/depOnboardingSettingsGET /beta/deviceManagement/depOnboardingSettings/{id}/importedAppleDeviceIdentities
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.operations.ade-never-enrolled?size=100An AI assistant reads it with the MCP tool get_report and the id intune.operations.ade-never-enrolled. The client needs the Read grant for Intune. See Using the API.