Sync the Microsoft 365 GAL to iPhone contacts with Intune

Your users find colleagues in the Outlook and Teams global address list (GAL), but when one of them calls, the iPhone shows a bare number. As the Intune administrator, you want to fix it once, for every managed iPhone, without asking anyone to import a file. This guide shows how to get the Microsoft 365 GAL into iPhone contacts with Microsoft Intune, step by step, and how to keep work contacts out of personal iCloud accounts along the way.

Why the iPhone does not show the GAL

When an iPhone connects to Microsoft 365, through the Exchange account in iOS settings or through Outlook for iOS, it syncs the user's own mailbox: mail, calendar and the contacts the user created. The GAL stays on the Exchange side. The options built into Microsoft 365 and Intune all stop short of it:

• Outlook contact sync. Outlook for iOS can save contacts to the native Contacts app, and an Intune app configuration policy can turn it on. But it only syncs the contacts of the user's mailbox, not the company directory.

• Directory search in the Exchange account. The Contacts app can look up a name in the directory. Nothing is saved on the phone, so an incoming call is still not recognised.

• Scripts that copy the GAL into every mailbox. They work, at the cost of a scheduled task to maintain, elevated rights on every mailbox, and one more copy of the directory per user.

• CSV or vCard imports. Correct on day one, then out of date with every hire, departure and number change.

To show a colleague's name when the phone rings, iOS needs that colleague on the device, kept up to date. That takes an app that reads Microsoft Entra ID and identifies calls, deployed by Intune like any other managed app.

Prerequisites

• iPhones enrolled in Intune: company devices through Apple Business Manager (ideally supervised), or personal devices through user enrolment.

• For company devices, Apple Business Manager connected to Intune with an Apps and Books (VPP) token, so the app can be installed without an Apple Account.

• The Intune Administrator role, and a Microsoft Entra ID administrator for the one-time consent.

• Phone numbers filled in for users in Entra ID: only users with a number are synced.

Step 1: grant admin consent in Microsoft Entra ID

Calliente reads the directory with delegated Microsoft Graph permissions: User.Read.All to read user names and phone numbers, GroupMember.Read.All for group filtering, plus the standard sign-in scopes. An Entra ID administrator approves them once for the whole tenant. Nothing is written to the directory, and consent can be revoked at any time from Enterprise applications. The details are in Microsoft Entra ID permissions used by Calliente.

Step 2: add the app to Intune

There are two ways to bring Calliente into Intune:

• Through Apple Business Manager (recommended for company devices). In Apple Business Manager, open Apps and Books, search for Calliente and get the number of licences you need, assigned to the location linked to your Intune token. After the next token sync, the app appears in Intune under Apps > iOS/iPadOS. Licences are assigned to devices, so users do not need an Apple Account.

• As an iOS store app (pilot or personal devices). In the Microsoft Intune admin center, go to Apps > iOS/iPadOS > Add, choose iOS store app, search the App Store for Calliente and save. Users then install it with their own Apple Account.

Step 3: assign it to your users

Open the app, then Properties > Assignments > Edit. Add the user or device groups that should receive the directory: Required to install it automatically, or Available for enrolled devices to offer it in the Company Portal for a pilot. For VPP apps, choose device licensing. On supervised devices the installation is silent; on other devices, iOS asks the user to confirm it.

Step 4: decide where work contacts are stored

This is the step most deployments skip. On iPhone, a contact written by an app goes to the default account in the Contacts settings, and on many phones that account is the user's personal iCloud. The directory then follows the user to their Mac, their iPad and their backups, and stays there after they leave. Two options:

• Native address book. Colleagues appear in the Contacts app like any other contact. Before rolling it out on personal devices, check which account receives them, and test your Intune restrictions on managed and unmanaged data on a pilot device.

• Secure Call ID. Calls are identified with the colleague's name, but nothing is written to the Contacts app, so nothing reaches iCloud. The directory stays in the Calliente app. It is the safer choice for BYOD. See Secure Call ID on iOS; it is turned on at your request.

The background is in Work contacts on iPhone: the iCloud risk nobody plans for.

Step 5: users sign in once

Each user opens Calliente, signs in with their Microsoft 365 account and allows the access iOS asks for: Apple does not let an MDM grant it on the user's behalf, so plan one line about it in your rollout message. Colleagues' calls then show up with their name, and the directory refreshes automatically every day: arrivals, departures and number changes follow Entra ID with no action from IT.

Going further

• Sync only some groups. With the Business plan, group filtering limits each team to the contacts it needs.

• Block contact export. Also in the Business plan, on iOS.

• No copy of your directory elsewhere. The app reads Entra ID from the phone; Calliente does not store your contacts on its servers.

• Android too. The same approach, with contacts kept in the work profile: Sync the Microsoft 365 GAL to Android contacts with Intune.

For the user-side view of the problem, read Why your Microsoft 365 directory doesn't show up in your iPhone contacts.

Try it on your tenant

The 30-day free trial runs on your own Microsoft 365 tenant, for 2 users and with no credit card: assign it to two test iPhones through Intune and watch real colleagues show up on a real call. After that, Calliente costs €6 per user per year (€8 for the Business plan).