Your network contains an Active Directory domain named contoso.com. Contoso.com is synchronized to a
Microsoft Azure Active Directory. You have a Microsoft Intune subscription.
Your company plans to implement a Bring Your Own Device (BYOD) policy. You will provide users with access
to corporate data from their personal iOS devices.
You need to ensure that you can manage the personal iOS devices.
What should you do first?

A.
Install the Company Portal app from the Apple App Store.

B.
Create a device enrollment manager account.

C.
Set a DNS alias for the enrollment server address.

D.
Configure the Intune Service to Service Connector for Hosted Exchange.

E.
Enroll for an Apple Push Notification (APN) certificate.

Explanation:
An Apple Push Notification service (APNs) certificate must first be imported from Apple so that you can manage
iOS devices. The certificate allows Intune to manage iOS devices and institutes an accredited and encrypted IP
connection with the mobile device management authority services.
Incorrect Answers:
A: Users can only install the Company Portal app after they have been added as Intune users, which require the
Apple Push Notification (APN) certificate to be in place.
B: The device enrollment manager account is a special Intune account that has permission to enroll more thanfive corporate-owned devices. It is not used for BYOD.
C: The Set a DNS alias for the enrollment server address setting is an optional setting for enrolling Windows
devices.
D: The Configure Intune service to service connector for hosted Exchange setting is used to connect Microsoft
Intune and hosted Exchange without an on-premises infrastructure.

https://technet.microsoft.com/library/dn408185.aspx
https://technet.microsoft.com/en-us/library/dn764961.aspx
https://technet.microsoft.com/en-us/library/mt346003.aspx
https://technet.microsoft.com/en-us/library/dn646988.aspx