One iPhone, still sealed, to a device that Conditional Access will accept as compliant, with nobody touching it but the person it belongs to. Every setting, why it is set that way, the two decisions you cannot revisit without a wipe, and the state you should see at each of eight checkpoints.
An Apple enrollment policy is read by the device once, during activation, and never again, which makes it the only object in this stack whose half-life is the hardware refresh cycle. Inside it sits an authentication choice that decides whether your fleet is governed or merely managed, and a first-party limitation that contradicts what every Zero Trust article on this site tells you to do.
Every Apple device in your estate arrives through one of four doors, and the door decides what you are allowed to do with the device for the rest of its life. Here is what each one buys, what each one forecloses permanently, and the one Apple built that Intune has not opened.
Two files cross between two vendors' portals in one browser session, one of them is a credential that is invalidated if you close a tab, and the screen where you grant a piece of destructive authority is one neither vendor documents properly. Here is the whole connection, the recovery route when it goes wrong, and a renewal procedure you can actually keep.
Two credentials connect Apple to Intune and most organisations guard the wrong one. One of them is bound to a person's password, expires on a clock nobody displays on the authoritative side, and can be destroyed in a single click from a menu Apple hid behind an ellipsis.
Devices that never came through a channel can still enter Apple Business, on a claim you make in physical possession of the hardware. Apple hedges that claim with a thirty day window in which the user can walk the device back out, and never says what happens on day thirty-one, though Microsoft says part of it. Here is the whole path, including the platform split that sends you to the wrong app.
By the end of this you have your Organization ID in the hands of every supplier who sells you Apple hardware, their Reseller Numbers in your tenant, a durable record of which opaque number belongs to whom, a monitored feed of Apple's five order progress messages, and a single test device that proves the whole chain works before you order two hundred.
Apple Business does not record that you own a device. It records that somebody sold it to you, and the record is written by the seller rather than by you. Everything downstream of that, zero touch included, rests on a claim you did not make and cannot make yourself.
