Push contacts to iPhones with Intune and Microsoft 365

Intune cannot push a list of contacts to iPhones. It can set up the Exchange account with contact sync and turn on Save Contacts in the Outlook app, but both only bring each user’s own mailbox contacts to the phone. To push colleagues or a shared list, the contacts have to be written into every mailbox in Microsoft 365.

1. Set up the Exchange account with an email profile

For enrolled iPhones, an iOS/iPadOS email profile in Intune adds the Exchange account to the phone. Under Exchange data to sync, choose All data or an option that includes Contacts. Set Allow users to change sync settings to No if users should not be able to switch Contacts off. Both settings apply to iOS 13 and newer.

The account then syncs the Contacts folder in the user’s own mailbox, and nothing else.

2. Turn on Save Contacts in the Outlook app

If users read mail in the Outlook app, an app configuration policy can switch on Save Contacts for them. In the Intune admin center, go to Apps › App configuration policies › Add › Managed devices, choose iOS/iPadOS and target Microsoft Outlook. Then turn on Save Contacts in the configuration settings. Microsoft also supports the setting through a managed apps policy for phones that are not enrolled.

Three things to know:

• The user still has to allow Outlook to access Contacts. iOS does not let a policy grant that.
• If an app protection policy sets Sync policy managed app data with native apps or add-ins to Block, Save Contacts is switched off and the configuration is ignored.
• Separate settings control which contact fields Outlook copies to the phone, for example notes or home numbers.

3. What Intune cannot do

Apple’s device management payloads for contacts set up accounts on the phone, such as Exchange, CardDAV or LDAP. None of them carries contact entries, and a custom profile in Intune uses the same payloads. So there is no Intune profile that delivers a list of colleagues, keeps it current, or removes people who leave.

4. The script route with Microsoft Graph

The usual workaround is a script that writes contacts directly into each mailbox through Microsoft Graph. In outline:

1. Register an app in Microsoft Entra ID with the application permission Contacts.ReadWrite and grant admin consent. That permission covers every mailbox, so limit it with an application access policy to the mailboxes that should receive contacts.
2. Read the members of the group you want to share.
3. Create, update and delete contacts in each mailbox’s Contacts folder.
4. Run it on a schedule and check that it ran.

The hard parts are in steps 3 and 4. The script must recognise the contacts it created so it never edits a user’s own contacts, handle people who leave, store its credentials safely and alert someone when it fails. Someone has to own it after the person who wrote it moves on.