First steps to take when turning on your work-managed iPhone or iPad

• Very important: before turning on your iOS device, please skim the following so that when you come to that step in the setup process, you'll be ready to follow the directions. Pay special attention to the 5 Critical steps bolded in red below. Also note, this only applies to special iOS devices that are both owned by your org and managed by the help desk.
• Please note that due to the frequent changes Apple makes to its products, it's not possible to list in detail or provide screenshots of every single step in the setup process. The good news is that there's only a 5 or so critical, important steps. All the other steps such as choosing a language, etc, you should be able to choose what you see fit. 
• For the purposes of this guide below, iPhone, iPad, iOS device all refer to mobile devices Apple makes and the terms can be interchanged (so just in case you expected to see iPhone and see iPad instead, for the purposes of this guide, they basically mean the same thing)
• (for org owned cell phones that have cellular service and phone numbers) If at any point in this process you see your assigned cell phone number, please record/take picture/write down that 10 digit phone number in case your management team asks for it later.

Part 1: Out of box setup experience (OOBE)

• Before iOS loads and is ready to use, there's some initial, one-time setup questions your iPhone or iPad will ask. This is called the out of box setup experience (OOBE). Make the choices you think appropriate for Language, Country, and color contrast mode. Stop when you get to the option to set up with or without a device.
• Critical step 1: During OOBE, when asked if you want to use another iPhone/iPad to set up this device, choose "Set up without another device"

• Join a WiFi network. If you're in your org's office, the guest WiFi is a good choice.

• Critical step 2: During OOBE, when told "This iPad/iPhone is owned by [your org]" , choose "Enroll this iPad" This is a very important step, if you don't see this message that your org enrolls the device and the option to enroll, that means that everything that should happen after this step won't. Please do not proceed further and rather contact the help desk.

• During OOBE, if you're asked about a SIM card, eSIM, or cellular setup, you can skip that step. Any questions above SIM card, eSIM, or enabling cellular phone servie, please ask your management team later on (you can do that after you've finished the other steps below).

Part 2: Set a passcode and register your iOS device

• After OOBE finishes you'll see some Apple apps, and other apps will start to automatically install. If needed, connect to a WiFi network.
• Critical step 3: It's very important that you do not do anything else until you've set/changed a passcode and registered the device using the Microsoft Authenticator app. So basically, this step is a friendly reminder to do nothing else until you've both changed your passcode and registered your iOS device. If you didn't follow this direction, it could potentially result in hours or days of troubleshooting and remediation from the help desk, which is why this step and the next two are so important to follow. There's no screenshot for this step, simply don't do anything else first except wait for your apps to load, and then do steps 4 and 5 below.
• Critical step 4:  Go to your iOS settings (it's the gear icon, or you can search for 'settings'), Touch ID and Passcode, and choose either Set Passcode or Change passcode or Turn passcode on. We recommend a passcode of 6 numbers, and it can't be super easy to guess like 123456. If you do not do this initial step you may be locked out of your iPad/iPhone and it could take major (hours or days) of troubleshooting effort by the help desk to resolve the issue. If you've just set a 6 digit passcode for your iOS device, you can skip this step. As you normally use your iOS device it would prompt you to set or change your passcode. Since this is such an important step, we need to manually set a passcode right away if we haven't done that already.

• Wait until you see that the Microsoft Authenticator app has installed. It'll be automatically installing in the background along with the other apps your org has approved. Depending on the speed of your internet, it might take 5-15 minutes, maybe a little longer, for all these apps to install.
• Critical step 5: In certain rare cases it may take a while for your Microsoft Authenticator app to install. If it hasn't auto installed after 30 minutes (and you can't even see a pending install for it), then please restart your iOS device by pressing up volume, down volume, and hold down the side button until you see power off, then power back on again. Give things 30 more minutes, if you still don't see at least a pending install, then please make sure your iOS is fully updated: https://support.apple.com/guide/iphone/update-ios-iph3e504502/ios#:~:text=At%20any%20time%2C%20you%20can,%3E%20Software%20Update%20%3E%20Automatic%20Updates. If even after an iOS update you're still not seeing the Microsoft Authenticator app install after 30 minutes, please contact the help desk and don't proceed further.
• After the Microsoft Authenticator app has installed (it'll automatically install after short period of time), do the following steps:
  • Open the Microsoft Authenticator app
  • If you see setup steps, it's ok to send diagnostic data to Microsoft, then choose Skip in the top right
  • Tap on the three bars/lines in the top left
  • Tap Settings
  • Tap Device Registration
  • Either choose to register your device, or tap the plus "+" sign to register your device
  • Sign in with your work email and password you normally sign into your computer with. On a separate phone, likely your personal cell phone, approve MFA if asked
  • You should now see your device is registered.

• Now you can sign into Outlook and Teams, and use your iPad normally. Outlook and Teams will likely ask you to create 4-digit pins to be able to help secure your org's data. If Teams or Outlook ask you setup questions, usually it's the right choice to tap "Allow". While setting up Teams or Outlook, you may be asked to approve an MFA prompt.
• The help desk does not recommend actually adding MFA to your work-managed iPhone or iPad. The reason is, in the event its lost or stolen, while the help desk can send a signal to remote wipe as soon as the help desk is made aware, with MFA actually added to this device, someone could potentially use that MFa to access org data until the device is wiped. Registering the device as directed to above is fine, but actually adding MFA like you've likely added MFA on your own personally owned phone is highly NOT recommended.