Clarification on Intune licensing for iOS/iPadOS enrollment without user affinity (ADE)

Question

Clarification on Intune licensing for iOS/iPadOS enrollment without user affinity (ADE)

Anant Bera 271

Hi everyone,

I’m currently working on enrolling iOS/iPadOS devices into Microsoft Intune using Automated Device Enrollment (ADE) without user affinity (device-based enrollment).

I understand the technical flow (ABM → Intune sync → enrollment profile → device setup), and I’m able to successfully enroll devices without assigning a primary user.

However, I have a question regarding Intune licensing:

In user-affinity (BYOD or user-driven) scenarios, it’s clear that an Intune license must be assigned to the user.

In user-affinity (BYOD or user-driven) scenarios, it’s clear that an Intune license must be assigned to the user.
But in non-user-affinity (device-only) scenarios, I don’t see any explicit step where a license is assigned to the device or user.

My questions are:

How does Intune validate licensing in ADE deployments without user affinity?
Is a device license required, or does Intune rely on tenant-level/user-based licensing in the background?

Is there any official guidance on how licensing is consumed or enforced for device-only enrollments?

Thanks in advance!

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2026-06-04T16:26:14.8766667+00:00

Hello @Anant Bera ,
This is a follow-up on the response above. If it helped answer your question, kindly mark it as Accepted Answer.

If you need more help, please share additional details in the comments.

Thanks!

1 answer

Your answer

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2026-06-04T16:26:14.8766667+00:00

Hello @Anant Bera ,
This is a follow-up on the response above. If it helped answer your question, kindly mark it as Accepted Answer.

If you need more help, please share additional details in the comments.

Thanks!

Answer 1

For ADE without user affinity, Intune treats the enrollment as a device-only scenario. Licensing is validated based on whether the device is covered by an Intune device license (or by association with an Intune-licensed user, if one is later assigned as primary user). In the Apple ADE context, devices enrolled without user affinity are considered “userless” and do not have a user-based Intune license at enrollment time. Instead, they require an Intune device license, unless a licensed user is associated with the device:

“Users on devices enrolled with user affinity must have an Intune license assigned. Devices enrolled without user affinity need an Intune device license, unless an Intune-licensed user is associated with the device.”

This aligns with the general Intune device-only licenses model, which is explicitly called out for:

“Apple Device Enrollment Program without user affinity”

as one of the supported enrollment methods for device-only licensing.
A device license is required for ADE without user affinity, unless a licensed user is later associated with the device as its primary user. Official guidance states:
- Device-only licenses are intended for “devices that aren't affiliated with specific users.”
- They apply when a device is enrolled through “Apple Device Enrollment Program without user affinity.”
- “Devices enrolled without user affinity need an Intune device license, unless an Intune-licensed user is associated with the device.”
When a device is enrolled userless and stays userless (kiosk, POS, shared utility), licensing is therefore consumed as a device license, not a user license. If later a primary user is associated (for example, via staging using the Company Portal and IntuneUDAUserlessDevice), the device can instead be covered by that user’s Intune license. Note that device-only licenses have functional limitations:
- No Intune app protection policies
- No Conditional Access
- No user-based features such as email and calendaring
These limitations are part of the official device-only license definition and apply to ADE userless enrollments using device licenses.

References: