MDM - Instructions for phone in use

First, check if your phone is too old
Intune MDM deployment in an Android phone
Intune MDM deployment in an iPhone

Perform the deployment according to the following instructions on all the phones and tablet computers with which you wish to use the M365 apps (such as Outlook, Teams, Office, OneDrive) hosted by Tampere Universities. This page applies to the work phones in use and employees' own phones. The deployment of MDM in a new phone is instructed on the page MDM – Instructions for new phone.

First, check if your phone is too old

The software of a phone should be updated always when a new version is available. If your phone's software cannot be updated regularly no more, it will become soon outdated and then it does not fulfil the information security requirements of the Universities Community. 

When MDM is deployed on a phone, the phone will present a notification if it's software is too old. 

If the software is too old, the phone is too old and it has to be replaced. If a phone owned by your employer is too old, please contact the IT contact person of your faculty or service unit at TAU or the IT Helpdesk at TAMK without delay and request a new phone for this reason. If the phone is your own, you will have to acquire a new enough phone if you want use M365 services on a phone.

Samsung

Update first the software of your phone like this: launch the Settings app and then tap Software update - Download and install. You can find the software version like this: launch the Settings app and then tap About phone - Software information. If the Android version is not 8.1 or higher after the update, the phone is too old.

All Samsung models purchased after the beginning of 2021 are OK. The Samsung models A40, A51, S8 and Tab S3 are new enough. Samsung models A3, A5, A6, J5, S7 and Tab S2 are too old.

iPhone or iPad

Update first the software of your phone like this: launch the Settings app, then tap General - Software Update. If the iOS version is not 14 or higher after the update, the phone is too old. 

iPhone 6S, iPad 5th Gen, iPad Air 2, iPad Mini 4th Gen and later models are new enough.
The following iPhone models are too old: iPhone 6 and lower versions.
The following iPad models are too old: iPad 1st..4th Gen, iPad Air (1st Gen) ja iPad Mini 1st..3rd Gen.

Intune MDM deployment in an Android phone

When you deploy Intune MDM, your own apps and data will remain completely as they are, there will be no changes to them. If the deployment does not succeed using this quick guide, you can remove the deployment according to the last step of these instructions and start again. Please study the full deployment instructions before contacting IT Helpdesk.

1. If your phone already has the Company Portal app installed, uninstall it.
2. Install the app Intune Company Portal in Play Store, launch it and deploy it like this:
   1. Sign in using your TUNI email address
   2. Tap Begin, Continue, Agree, Continue, Done, Got it, Dismiss.
3. Work profile is now created in your phone. On a Samsung phone, you can open the apps screen by swiping up when in the home screen. You can switch between personal profile and work profile by tapping Personal and Work in the bottom of the screen.
4. Installation of specified work apps starts normally after 5-10 minutes. If you want to use the work apps without waiting for the automatic installation or if the installation does not seem to start automatically, you can also install them manually like this:
   1. You can install any available work app like this: Launch Play Store in the work profile, tap the circle in top-right corner, tap Manage apps and devices and then Manage. Now you see all installed work apps. Tap Installed and then Not installed. Now you see all available work apps. Select all you want to install and tap the installation icon.
   2. The optional work apps are also available on the front page of Play Store in the work profile. Tap the app you want to install and tap Install.
5. Sign in to your work apps as usual with your TUNI email address.
6. Work profile and personal profile have separate apps, files and data. An app, for example Outlook, can be installed in both profiles – one copy of the app for personal use and one for work-related use.
7. You can share information from personal profile to work profile by selecting a work app as the target. Sharing in the other direction is limited to making the contacts from work profile Outlook available to personal profile.
8. Set a PIN code with at least 6 digits. Memorize the new PIN very carefully. If you forget it, the phone must be reset, and you will lose all data and files in the phone.
9. If you get notifications in the phone from Company Portal app, fulfil all requests.
10. If you need to, you can remove your phone from Intune MDM like this: Launch Company Portal, open menu in top-left, tap Remove Company Portal, tap OK. This will remove the work profile with all its apps and data from your phone . There will be no changes made to your personal profile.

Detailed step-by-step deployment instructions (pdf):

DownloadIntune MDM deployment in an Android phone in use

The following instructions advise you how to use the MDM in an Android phone (pdf):

DownloadUsing Intune MDM in an Android phone

Intune MDM deployment in an iPhone

When you deploy MDM, your own apps and data will remain completely as they are. MDM controls only some security settings and a small set of apps installed for working. If the deployment does not succeed using this quick guide, you can remove the deployment according to the last step of this guide and start again. Please try using the full deployment instructions before contacting the IT Helpdesk.

1. Start using Authenticator as the primary authentication method as instructed on the page Setting up multifactor authentication.
2. If you already have the app Company Portal installed on your phone, delete it.
3. Delete the following apps from your phone (all Microsoft products): Word, Excel, PowerPoint, Outlook, Teams, OneDrive, OneNote, Edge.
4. Install the app Intune Company Portal from App Store.
5. If the phone is owned by the employer:
   1. Launch Intune Company Portal, sign in with your TUNI email address.
   2. Tap OK – Allow  – Begin. Choose the topmost option and tap Continue.
   3. If you have not already installed Microsoft Authenticator, install it. After that, press home button and start again Company Portal.
   4. Tap Continue - Continue – Continue – Allow  – Close – Continue – Continue.
   5. Press the home button and open Settings app. Tap Profile Downloaded - Install. Enter your passcode. Tap Install – Install – Trust – Done.
   6. Press the home button and start again Company Portal. Tap Continue - Done.
6. If the phone is owned by you:
   1. Launch the Settings app and tap the top item. If your Apple ID ends in @tuni.fi, sign out by tapping Sign Out and then sign in into another Apple ID account or create a new one, for example using the format firstname.lastname.tuni [at] icloud.com (firstname[dot]lastname[dot]tuni[at]icloud[dot]com).
   2. Launch Intune Company Portal, sign in with your TUNI email address.
   3. Tap OK – Allow – Begin. Tap I own this device - Protect only work-related apps and data - Continue.
   4. If you have not already installed Microsoft Authenticator, install it. Press then home button and start again Company Portal.
   5. Tap Continue - Continue – Continue – Allow  – Close – Continue – Continue.
   6. Press the home button and open Settings app. Tap Enrol in TUNI.fi - Enrol My iPhone. Enter your iPhone passcode. Tap Continue. Enter your TUNI password, tap Sign in and confirm multi-factor authentication. Tap Yes.
   7. Press home button and start again Company Portal. Tap Continue - Done.
7. The installation of the automatically installed work apps will start within about 15 minutes. Accept all notifications about the installation of the apps by tapping Install.
8. You can install optional work apps in the Company Portal app like this: open the tab Apps, tap View all apps, tap an app and then Install.
9. Sign in the work apps in a normal manner using your TUNI email address.
10. If the Company Portal displays notifications, change the settings as requested by them.
11. Set a passcode with at least 6 digits. Memorize the new passcode very carefully. If you forget it, the phone must be reset, and you will lose all data and files in the phone.
12. If you need to, you can remove your phone from Intune MDM in this way: open Company Portal, open the tab Devices. Tap the name of your device (topmost), open the three dots menu and tap Remove device - Remove. All apps installed by Intune will be automatically removed with all their data. The phone has now been removed from the Intune MDM.

Detailed step-by-step deployment instructions (pdf):

DownloadMicrosoft Intune MDM Instructions for iPhone in use