Why enroll in Intune?

How Do I Enroll My Mobile Device in Intune?

If you have upgraded to a new phone, you will need to reinstall the company portal on your new mobile device, then enroll it using the steps listed below, do not migrate the company portal with the built-in migration tool.

NOTE: Each Office 365 mobile application has a different sign-in frequency, the following table highlights the sign-in frequency setting for each application and client

Application	Client	Sign-In Frequency
Outlook	Mobile*	30 days; PIN prompt every 5 minutes
OneDrive	Mobile	30 days; PIN prompt every 5 minutes
Teams	Mobile	30 days; PIN prompt every 5 minutes

NOTE: If you are using the native iOS mail and calendar apps there is no need to sign in after you configure the account on your mobile device.

Choose the option that applies to you:

I have not used Outlook Mobile; I use the Mail, Calendar, and Contact apps on an iPhone or iPad device
I have not used Outlook Mobile; I use the Mail, Calendar, and Contact apps on an Android phone or tablet
I use Microsoft Outlook mobile on an iPhone or iPad
Use these installation instructions for iPhone or iPad
I use Microsoft Outlook mobile on an Android phone or tablet
Use these installation instructions for Android phone or tablet

Mail, Calendar, and Contact Apps on iPhone or iPad

NOTE: UCSF currently supports the latest three versions of the Android OS on devices. The OS of your Android device will need to be upgraded to one of the supported versions to be able to enroll in Intune.

Delete your UCSF account from your device. Go to Settings > Mail > Accounts, select your UCSF account and tap Delete Account. Your email, calendar, and contacts will be downloaded again after enrollment, when you add your account back. Note: it can take several minutes to delete the account, depending on how much data you have on your mobile device.
Go to the App Store and search for Microsoft Intune Company Portal, then tap Get.
Open the Company Portal app and tap Sign In.
Sign in to your UCSF account. Make sure you have Duo installed and ready to use to complete your sign-in.
Review notifications message then tap Continue.
Tap Allow to receive notifications from Company Portal.
Tap on Devices at the bottom of the Company Portal app screen.
Tap Begin Setup.
Tap Begin to start enrollment. Review the privacy information, then download the UCSF device management profile. For more information on how Intune protects your mobile device while also protecting your privacy see What information can my organization see when I enroll my device?
Install the UCSF device management profile.
Complete enrollment and review your security settings. If you don't already have a 6-digit, complex PIN you will be asked to create one. Simple PINs – those with 3 sequential or repeated numbers – are not allowed. For example, 123579 or 111122 would not be accepted. Also, if your iPhone is paired with your Apple Watch you will need to have a 6-digit, complex PIN on your watch.
Verify your enrollment.
Now you can either add your UCSF account to your iPhone or iPad to use the Mail, Calendar, and Contacts apps, or you can install Microsoft Outlook mobile, other Microsoft apps and UCSF private apps via the Company Portal.

If you run into any trouble, or if you have further questions about Intune, please check our Intune FAQs, or contact the IT Service Desk.

Mail, Calendar, and Contact Apps on Android phone or tablet

NOTE: UCSF currently supports the latest three versions of the Android OS on devices. The OS of your Android device will need to be upgraded to one of the supported versions to be able to enroll in Intune.

Delete your UCSF account from your device. Go to Applications > Email, bring up the settings menu and tap Accounts, then press and hold the account you want to delete until the Menu window opens, then click Remove Account. Your email, calendar, and contacts will be downloaded again after enrollment, when you add your account back.
Install the Intune Company Portal app. Go to the Google Play Store and search for Microsoft Intune Company Portal, then tap Install.
Open the Intune Company Portal and sign in to your UCSF account. Make sure you have Duo installed and ready to use to complete your sign-in.
1. Follow the instructions to download and install the UCSF security management profile. You may be instructed to download and install the Microsoft Authenticator app. For more information on how Intune protects your mobile device while also protecting your privacy see What information can my organization see when I enroll my device?
2. If you don't already have a 6-digit, complex PIN you will be asked to create one. Simple PINs – those with 3 sequential or repeated numbers – are not allowed. For example, 123579 or 111122 would not be accepted.
Finalize your enrollment.
Introduction to your work profile.
Now you can install Microsoft Outlook mobile, other Microsoft apps and UCSF private apps via the Google Play Company Store. The Gmail app is not available at this time.

If you run into any trouble, or if you have further questions about Intune, please check our Intune FAQs, or contact the IT Service Desk.

Microsoft mobile apps on iPhone or iPad

NOTE: UCSF currently supports the latest three versions of the Android OS on devices. The OS of your Android device will need to be upgraded to one of the supported versions to be able to enroll in Intune.

Delete any Microsoft apps you use for UCSF work on your mobile device. You will add them back after enrolling your device. You can leave the Authenticator app, but you won't need it for UCSF after your Intune enrollment.
Go to the App Store and search for Microsoft Intune Company Portal, then tap Get.
Open the Company Portal app and tap Sign In.
Sign in to your UCSF account. Make sure you have Duo installed and ready to use to complete your sign-in.
Review notifications message then tap Continue.
Tap Allow to receive notifications from Company Portal.
Tap on Devices at the bottom of the Company Portal app screen.
Tap Begin Setup.
Tap Begin to start enrollment. Review the privacy information, then download the UCSF device management profile. For more information on how Intune protects your mobile device while also protecting your privacy see What information can my organization see when I enroll my device?
Install the UCSF device management profile.
Complete enrollment and review your security settings. If you don't already have a 6-digit, complex PIN you will be asked to create one. Simple PINs – those with 3 sequential or repeated numbers – are not allowed. For example, 123579 or 111122 would not be accepted. Also, if your iPhone is paired with your Apple Watch you will need to have a 6-digit, complex PIN on your watch.
Verify your enrollment.
Now you can install Microsoft Outlook mobile, other Microsoft apps and UCSF private apps via the Company Portal.

If you run into any trouble, or if you have further questions about Intune, please check our Intune FAQs, or contact the IT Service Desk.

Microsoft mobile apps on Android phone or tablet

NOTE: UCSF currently supports the latest three versions of the Android OS on devices. The OS of your Android device will need to be upgraded to one of the supported versions to be able to enroll in Intune.

Delete any Microsoft apps you use for UCSF work on your mobile device. You will add them back after enrolling your device. You can leave the Authenticator app, but you won't need it for UCSF after your Intune enrollment.
Watch this 3-minute video which guides you through Intune enrollment: Enroll your Android phone or tablet in Microsoft Intune.

Or, if you prefer written instructions:
1. Install the Intune Company Portal app. Go to the Google Play Store and search for Microsoft Intune Company Portal, then tap Install.
2. Open the Intune Company Portal and sign in to your UCSF account. Make sure you have Duo installed and ready to use to complete your sign-in.
3. Follow the instructions to download and install the UCSF security management profile. You may be instructed to download and install the Microsoft Authenticator app. For more information on how Intune protects your mobile device while also protecting your privacy see What information can my organization see when I enroll my device?
4. If you don't already have a 6-digit, complex PIN you will be asked to create one. Simple PINs – those with 3 sequential or repeated numbers – are not allowed. For example, 123579 or 111122 would not be accepted.
Now you can install Microsoft Outlook mobile, other Microsoft apps and UCSF private apps via the Google Play Company Store.

If you run into any trouble, or if you have further questions about Intune, please check our Intune FAQs, or contact the IT Service Desk.

Why Enroll Your Mobile Device in Intune Company Portal?

To protect UCSF data we all have to comply with minimum security standards. On mobile devices (mobile phones and tablets) this means using a PIN to unlock your phone or tablet, and the ability to remotely wipe your device if it's ever lost or stolen.

UCSF has used Exchange ActiveSync for many years to enforce minimum security standards on mobile devices. If you are using the Mail, Calendar, and Contact apps on your phone then you are using ActiveSync. Microsoft is ending support for ActiveSync this year, and UCSF is disabling ActiveSync by December 17, 2021. Microsoft Intune replaces Exchange ActiveSync, and allows you to use either the Mail, Calendar, and Contact apps, or Outlook and other Microsoft mobile apps.

For more information about how Intune protects your mobile device while also protecting your privacy see What information can my organization see when I enroll my device?

What Does Intune Enrollment Entail?

Prerequisites: You must have your account enrolled in Duo in order to complete the Intune enrollment. Intune requires iOS 13.1 or later, or Android 10.0 or later.

Enrollment involves first removing your UCSF account from your device (if using ActiveSync), or removing the Microsoft mobile apps from your mobile device. Next you will download and install Microsoft's Intune Company Portal app, then log into your account to install the UCSF security management profile to complete the enrollment. You will be asked to create a complex PIN if you don't already have one.

After that you can either set up the Mail, Calendar, and Contacts apps again, or you can install the Microsoft apps and UCSF private apps from the Company Portal (for iPhone and iPad) or through the Google Play Company Store (for Android phones and tablets).

If you are already using Intune through another organization please see our FAQ for your options.

What Happens if I Don't Enroll in Intune?

Once ActiveSync is disabled you will lose access to your UCSF email, calendar, and contacts from the Mail, Contact, and Calendar apps. You will be able to access your UCSF account from mobile web at email.ucsf.edu, or using the Microsoft mobile apps without Intune. If you use the Microsoft mobile apps without Intune you will be required to set up a PIN for each Microsoft mobile app, and you won't be able to copy or print from Microsoft mobile apps.

Intune Mobile Device Management (MDM) Privacy

Content Restricted