Identify devices as corporate-owned

Applies to:

• iOS/iPadOS
• Android

Ensure that corporate devices are marked as corporate-owned as soon as they enroll by adding their corporate identifiers ahead of time in the Microsoft Intune admin center. Corporate devices unlock more device management capabilities than personal devices. For example, Microsoft Intune can collect more information about corporate-owned devices for you, such as full phone number and app inventory.

You can upload a file of corporate identifiers in the admin center or enter each identifier separately. It isn't necessary to add corporate identifiers for all deployments. During enrollment, Intune automatically assigns corporate-owned status to devices that join to Microsoft Entra via:

• Device enrollment manager account (all platforms)
• An Apple device enrollment program such as Apple School Manager, Apple Business Manager, or Apple Configurator (iOS/iPadOS only)
• Co-management with Microsoft Intune and group policy (GPO)
• Azure Virtual Desktop
• Automatic MDM enrollment via provisioning package
• Knox Mobile Enrollment
• Android Enterprise management:
  • Coporate-owned devices with work profile
  • Fully managed devices
  • Dedicated devices.
• Android Open Source Project (AOSP) management:
  • Corporate-owned user-associated devices
  • Corporate-owned userless devices
  • Google Zero Touch

Microsoft Intune marks devices that register with Microsoft Entra as personal.

Role based access control

You must be an Intune administrator or global administrator to add corporate identifiers, or a custom Intune role assigned corporate device identifier permissions. Permissions include:

• Update
• Read
• Delete
• Create

Supported corporate identifiers

Before you begin, determine the type of corporate identifiers you want to add. You can add one type of corporate identifier per CSV file. Devices that enroll without corporate identifiers are marked as personal. Intune supports the following identifiers:

• IMEI
• Serial number

Support by platform

The following table shows the identifiers supported for each platform. When a device with a matching identifier enrolls, Intune marks it as corporate-owned.

Platform	IMEI number	Serial number
Windows	Not supported	Not supported
iOS/iPadOS	✔️ Supported in some cases. For more information, see Step 1: Create CSV file.	✔️ We recommend using a serial number for iOS/iPadOS identification when possible.
macOS	Not supported	✔️
Android device administrator	✔️ Supported with Android 9 and earlier.	✔️ Supported with Android 9 and earlier.
Android Enterprise, personally owned work profile	✔️ Supported with Android 11 and earlier.	✔️ Supported with Android 11 and earlier.

Step 1: Create CSV file

Create a list of corporate identifiers and save it as a CSV file. You can add up to 5,000 rows or 5 MB of data per file, whichever comes first. Don't add headers.

Important

Remember, only add one type of corporate identifier per CSV file.

To add corporate identifiers for Android and iOS/iPadOS platforms, list one IMEI or serial number per line as shown in the following example.

01234567890123,device details  
02234567890123,device details  

Remove all periods, if applicable, from the serial number before you add it to the file. You can add device details after each corporate identifier. Details are limited to 128 characters and are for administrative use only. They don't appear on the device.

Android and iOS/iPadOS devices can have multiple IMEI numbers. Intune reads and records one IMEI per enrolled device. If you import an IMEI that's different from the one already in Intune, Intune will mark the device as personal. If you import multiple IMEI numbers for the same device, the identifiers that haven't been inventoried appear with an unknown enrollment status.

Android serial numbers are not guaranteed to be unique or present. Check with your device supplier to find out if the serial number is a reliable device ID. Serial numbers reported by the device to Intune might not match the ID shown on the device in Android settings or Android device information. Verify the type of serial number reported by the device manufacturer.

Step 2: Add corporate identifiers in admin center

You can upload a CSV file of corporate identifiers, or manually enter the corporate identifiers in the Microsoft Intune admin center.

Upload CSV file

Upload the CSV file you created in Step 1: Create CSV file to add corporate identifiers.

1. Sign in to the Microsoft Intune admin center.

2. Go to Devices > Enrollment.

3. Select the Corporate device identifiers tab.

4. Choose Add > Upload CSV file.

5. Select the identifier type. Your options:

   • IMEI
   • Serial

6. Under Import identifiers, find and select the CSV file.

7. Wait while Intune validates the CSV file. When the total device identifiers count appears onscreen, validation is complete.

   Tip

   If your import fails, check that the CSV file meets formatting requirements.

8. Select Add, and then look for the success notification at the top of the admin center to confirm that the file is imported.

   Note

   A pop-up window prompting you to review duplicate identifiers appears if the CSV file contains corporate identifiers that are already in Intune but have different device details. To resolve the duplicates, select the identifiers that you want to overwrite in Intune. Then select Ok to add the identifiers. Intune only compares the first duplicate of each identifier.

Manually enter corporate identifiers

Applies to Android and iOS/iPadOS

Enter corporate identifiers in the Microsoft Intune admin center to add corporate identifiers.

1. In the Microsoft Intune admin center, go to Devices > Enrollment.

2. Select the Corporate device identifiers tab.

3. Choose Add > Enter manually.

4. Select the identifier type. Your options:

   • IMEI
   • Serial

5. Enter the corporate identifier and details. When you're done entering identifiers, select Add.

6. Select Refresh to reload your list. The corporate identifiers you added should now be visible.

   Note

   A pop-up window prompting you to review duplicate identifiers appears if your entries contain corporate identifiers that are already in Intune but have different device details. To resolve the duplicates, select the identifiers that you want to overwrite. Then select Ok to add the identifiers. Intune only compares the first duplicate of each identifier.

Check enrollment status

Follow up on imported devices to ensure that they enroll in Intune. After you add corporate identifiers, you can see the status of the devices in the admin center:

• Enrolled: The device completed enrollment.
• Not contacted: The device hasn't made contact with the Microsoft Intune service.
• Not applicable:
• Failed: The device did not complete enrollment.

Delete corporate identifiers

2. In the admin center, go to Devices > Enrollment.
3. Select the Corporate device identifiers tab.
4. Select the device identifiers you want to delete, and choose Delete.
5. Confirm the deletion.

Deleting a corporate identifier for an enrolled device does not change the device's ownership.

Change device ownership

To edit a device's identification after enrollment, change its ownership setting in the admin center. An ownership property appears for each device record in Microsoft Intune.

1. Go to Devices > All devices.

2. Select a device.

3. Choose Properties.

4. For Device ownership, select Personal or Corporate.

   

When you change a device's ownership type from corporate to personal, Intune deletes all app information previously collected from that device within seven days. If applicable, Intune also deletes the phone number on record. Intune still collects the inventory of apps installed by the IT admin on the device, and a partial phone number.

When you change the ownership of an iOS/iPad or Android device from personal to corporate, a push notification is sent through the Company Portal app to inform the device user of the change. To configure push notifications, go to Tenant administration > Customization. For more information, see Company Portal - Configuration.

Block personal devices

To prevent all personal devices from enrolling, configure an enrollment platform restriction for personal devices.

To confirm the reason for an enrollment failure, go to Devices > Enrollment failures and look in the table under Failure reason. In this case, the reason is Enrollment restriction not met. Select the reason to open failure details.

Resources

For details about International Mobile Equipment Identifiers, see 3GGPP TS 23.003.