Check for duplicate Company Portal configuration during Apple ADE

Source facts

During initial iOS/iPadOS ADE with Setup Assistant modern authentication, Intune sends Company Portal app configuration automatically when Install Company Portal is enabled. Microsoft warns that manually targeting the same configuration to users creates a conflict and can prompt them to download a management policy already present. The separate userless-to-user staging procedure restricts its app-configuration targeting to ADE devices without user affinity. Microsoft Learn.

Applicability

Use this diagnosis for the specific initial-enrollment combination above. Distinguish that flow from a deliberate userless-device staging transition before changing an assignment.

DSE recommendation

Trace every Company Portal configuration assignment reaching the affected device and user. Have the enrollment owner identify which settings arrive automatically and which were added for staging. Correct an unintended overlap through a reviewed targeting change; avoid instructing users to repeatedly install a management policy as the first response to this documented symptom.

Verification

Enroll a representative test device with the corrected assignments and observe the full Company Portal sequence. Confirm the expected registration and application access without the duplicate policy-download request. Test the separate staging population independently so the correction does not silently remove its needed configuration. Preserve assignment identities, enrollment options, and observed prompts without recording credentials.

Official references

Microsoft Learn: Set up automated device enrollment (ADE) for iOS/iPadOS.