The administration of macOS devices in Microsoft-dominated companies It was a challenge for a long time. Apple and Microsoft have historically been in competition with each other, which meant that support for Macs was limited in many Microsoft enterprise solutions. Also the administration of macOS devices with Microsoft Intune It was only rudimentarily possible so far. However, this has fundamentally changed, particularly from 2024:
Microsoft and Apple are working together more intensively than ever before to Microsoft To significantly expand Intune as a modern solution for macOS management. Companies can now Enforce security policies, define compliance requirements, centrally manage apps, and even control operating system updates — and all of this seamlessly in one Microsoft environment integrated.
This article shows which new features Intune for macOS offers, how companies benefit from the improvements, and which best practices have been proven for secure and efficient administration.
The most important things in brief
How SOFTTAILOR supports you: As experts for Endpoint Management and Microsoft Intune Let's optimize the management of your macOS devices - efficiently, securely and scalably.
1. Why manage macOS devices with Intune?
While Windows PCs are inherently deeply integrated into the Microsoft ecosystem, IT teams for Macs often required separate UEM solutions, such as Jamf Pro or other third-party tools. This led to a fragmented management approach and made it difficult to implement uniform security and compliance standards.
With the continuous development of Microsoft Intune However, this has fundamentally changed. Companies can now manage and secure macOS devices within their existing Microsoft environment integrate and manage via Intune. This provides numerous benefits:
- Centralized administration: A unified dashboard for Windows, macOS, iOS, and Android.
- Security and compliance controls: Enforce security policies such as FileVault encryption, firewall activation, and gatekeeper rules.
- Optimized app management: Support for complex software installations and seamless integration with Apple Business Manager.
- automation: Use shell scripts and Microsoft Graph API to automate repetitive tasks
- Improved user experience: Single sign-on (SSO) with Microsoft Entra ID (formerly Azure AD) and an optimized remote help feature for Mac users.
As a result of these improvements, Intune today a powerful macOS management solution and enables secure, centralized and scalable management of Apple devices in a corporate environment.
2. Security and compliance policies for macOS in Intune
Security and compliance are two of the most important aspects of managing macOS devices in enterprises. Microsoft Intune now offers a variety of policies and controls to ensure that only compliant and protected devices have access to corporate resources.
Enforcing System Integrity Protection (SIP) and macOS versions
Intune can now force System Integrity Protection (SIP) remains activated. This macOS security feature protects critical system files from unauthorized changes. Companies can Minimum and maximum limits for macOS versions Set — including specific build numbers. This ensures that devices only run on tested and supported macOS versions. Even the new Rapid Security Response Patches can be incorporated into compliance guidelines to quickly close security gaps.
Advanced device security checks
Intune can verify and enforce various safety-critical settings on Mac devices:
- FileVault disk encryption: Protection of sensitive data through mandatory encryption.
- macOS firewall: Make sure that only authorized connections are allowed.
- Gatekeeper guidelines: Restrict app sources to App Store and verified developersto prevent malware installations.
Non-compliant devices are automatically referred to as not compliant ranked. Administrators can then define appropriate measures, such as withdrawing access to corporate applications or forcing settings to be corrected.
Preparing for device attestation with ACME certificates
A significant step forward in Intune's security architecture is the introduction of ACME certificate log. While device authentication of macOS devices in Microsoft Intune has so far been done via the Simple Certificate Enrollment Protocol (SCEP) ACME is a safer and more reliable alternative. SCEP had vulnerabilities that allowed attackers to manipulate certificate requests or extract private keys to use on fraudulent devices, for example.
With the new approach, managed macOS devices receive forgery-proof certificates, which significantly improves authentication integrity and makes certificate management more robust. At the same time, potential weaknesses of SCEP-based authentication are eliminated. In addition, ACME lays the foundation for future-proof Managed Device Attestation in Intune, which enables even more accurate verification of device compliance.
Through these advanced security and compliance features, Intune ensures that only fully protected and compliant macOS devices have access to corporate resources.
3. Improved software distribution and management
Microsoft Intune has received significant improvements in recent years to enable the progressive management of macOS applications in enterprises.
Support for complex app installations
Intune now offers the ability to use applications with multi-part software packages or to manage specific installation steps, making software delivery more flexible and efficient. This is particularly beneficial for Microsoft 365 apps, which consist of several components and require coordinated installation.
Individually adapted business applications, which require additional configuration steps, as well as software with certain dependencies, which must meet certain requirements before installation, also benefit. To facilitate such complex installation processes, Intune allows scripts to run before or after installation, so that necessary preparation and post-processing steps can be automated.
Architecture-dependent app assignment
With the growing prevalence of Apple Silicon processors Like M1 and M2, companies must ensure that Macs always get the right version of an application. To ensure this, Intune now offers the option of architecture-dependent app assignment, in which applications are specifically based on Device features such as processor architecture (Intel or Apple Silicon) be filtered.
This function ensures that the correct app version — for example x86 for Intel Macs or ARM for Apple Silicon — is provided automatically. As a result, Incompatibilities avoided, while Apple Silicon Macs from an optimized Performance through native applications profit.
Integration with Volume Purchase Program (VPP)
Microsoft Intune is deep in Apple Business Manager (ABM) integrates and synchronizes purchased app licenses via the Volume Purchase Program (VPP). Companies benefit from:
- Device-based licensing: Apps can be installed directly on the Mac without the user needing an Apple ID
- Automatic installation and update via the MDM channel
- Simplified management of large software assets, as app updates are controlled centrally
These improvements enable organizations to more efficiently deploy, update, and manage their Mac applications while improving the user experience.
4. Optimize user experience with Intune
In addition to security and app management, which make life easier for IT departments, user experience also plays a decisive role. Microsoft has significantly improved Intune for macOS in recent years to optimize usage for end users and IT administrators alike.
Single sign-on (SSO) with Microsoft Entra ID
Microsoft Intune expands the Single sign-on (SSO) features for macOS, by clicking on the Microsoft Enterprise SSO Extension Set. This enables seamless authentication with Microsoft Entra ID per Applications and services in the corporate environment.
A significant feature of this extension is Platform Single Sign-On (Platform SSO). Users can connect directly with their Sign in Entra ID credentials to the macOS device, which automatically creates and synchronizes the local account with the company directory. This simplifies administration, increases security, and reduces the need for separate local user accounts.
The implementation of Platform SSO in Intune ensures consistent login at device and application levels, improves access to corporate resources, and seamlessly integrates macOS devices with existing Zero Trust Security Strategies.
Remote Help for macOS: Secure remote maintenance via Intune
Microsoft Intune has the Remote help functionality now fully expands and supports macOS devices. Companies that previously relied on third-party tools can now perform secure remote maintenance directly via Intune.
Helpdesk employees receive via the screen sharing Access to the user's screen to identify issues in real time IT administrators can also provide users with interactive support guide you through specific configuration steps. The entire session takes place via encrypted Microsoft channels, which minimizes potential security risks.
This new feature makes IT support for macOS devices significantly more efficient and enables quick troubleshooting directly within the Microsoft Intune Suite. This comprehensive solution combines advanced endpoint management and security features, so businesses can use a unified platform for all managed devices, including macOS.
Optimizing Intune tools for Apple Silicon
Die Intune company portal (Company Portal) app as well as the Intune Management Agent for macOS were used for Apple Silicon (M1/M2) optimized.
- Better performance: The tools now run natively and use the power of the new chips more efficiently.
- Higher stability: Reduced crashes and smoother integration with macOS.
- Improved user interface: The company portal app has been redesigned to make registration and app installation even easier.
These measures make working with Intune on the Mac much more convenient and productive.
5. Support for new macOS versions and OS updates
Microsoft Intune is constantly being adapted to new macOS versions and ensures that companies can always take advantage of the latest features and security updates.
Instant support for new macOS releases
Apple releases new macOS versions every year with advanced security and management features. Microsoft Intune guaranteed by Day-0 supportthat companies can use these updates immediately. This means that Intune is updated as soon as a new version of macOS is released so that existing features work as expected.
This allows companies to test at an early stage which new features can be managed in Intune. This allows security measures to be implemented immediately, as new restrictions and configuration settings are immediately available to administrators. One example of this is the support for macOS 15 Sequoia, which was provided at the same time as the release of the operating system.
In addition, Intune offers the option of Software update guidelines for macOS to configure. Administrators can decide how and when to install updates to ensure devices are always up to date.
Through this proactive approach, Microsoft Intune ensures that companies can immediately take advantage of new macOS versions without sacrificing important management and security features.
Raising the minimum requirements for Intune
With the introduction of macOS 15 (Sequoia) Does Microsoft Intune fit the minimum requirements for device management. Future Intune releases will be at least macOS 13 Ventura or higher While older macOS versions can only be managed to a limited extent and can therefore be compliant.
new Features and safety measures are therefore reserved for the current macOS generations. This adjustment ensures that companies are always up to date with the latest safety standards benefit and at the same time outdated macOS versions are gradually removed from the network.
Controlled macOS updates via Intune
Microsoft Intune now offers advanced control options for macOS updates. Administrators can specify precisely When and how updates are installedto ensure a balance between safety and productivity.
Key features include:
- Automatic security patches: Critical security updates can be rolled out immediately.
- Delayed feature updates: Major macOS upgrades can be deferred for a period of time to avoid compatibility issues.
- Maintenance periods: Updates can only be carried out during certain time windows so as not to disrupt work processes.
- Update deadlines: Administrators can set deadlines after which an update must be installed.
These improvements keep the macOS ecosystem in enterprises up to date and secure without affecting daily operations.
6. Automation & scripting for macOS management
As the number of Mac devices in companies increases, so does the need for individual solutions and automation. Microsoft Intune provides powerful tools for centralized administration, script control, and remote actions in macOSto make administrative tasks more efficient.
Settings Catalog: Central management of all macOS settings
The Settings Catalog in Intune provides a comprehensive collection of manageable macOS options. Administrators can configure almost all MDM options supported by Apple at the click of a button, including:
- FileVault disk encryption
- Firewall and gatekeeper rules
- Declarative device management features
- System updates and security policies
Since Intune works closely with Apple, new management policies for macOS are constantly being added and integrated directly into Intune. As a result, administrators can make many configurations directly via the Settings Catalog instead of having to create separate, user-defined configuration profiles. This reduces manual effort and ensures more robust management, as the policies provided by Intune are usually directly compatible with the latest macOS versions.
Shell scripts for customization
For specific requirements that go beyond standard MDM features, Intune offers the option to user-defined shell scripts run on macOS devices. Scripts can be pushed directly to devices via the Intune Management Agent to cover various scenarios—regardless of whether they're written in Bash or Zsh.
This includes e.g. automatic installation of Rosetta 2to keep Intel-based applications running on Apple Silicon Macs. You can also individual system configurations implement that are not available in the Settings Catalog. In addition, can regular maintenance tasks be automated through scheduled script executions. These features significantly reduce manual administration and ensure a consistent and efficient device management.
Remote actions & APIs to automate tasks
Intune not only provides local automation options via script, but also enables Remote control of macOS devices. About the Intune portal or the Microsoft Graph API administrators can perform various actions remotely. This includes the Restart or lock a Mac, that Reset or completely erase devices as well as the automated adjustment of policies for specific device groups.
By integrating the Graph API, Intune features can be seamlessly integrated into existing ITSM processes integrate, which allows numerous recurring tasks to be fully automated. With these powerful automation features, Intune provides a flexible and scalable solution for corporate Mac management ready.
7. Integrating Microsoft Intune with Microsoft and Apple Services
Another big advantage of Microsoft Intune is seamless integration with other Microsoft services as well as Apple's management ecosystem. As a result, macOS devices can be managed more efficiently and better integrated into existing business processes.
Microsoft Defender for Endpoint also for macOS: Integrated security solution
Microsoft Defender for Endpoint is one of the most powerful solutions for protecting end devices and can be accessed directly via Intune managed on macOS devices become. The integration enables a central deployment of the Defender client, so that security policies and configuration requirements can be consistently enforced.
In addition, Intune provides automatic updates and policy adjustmentsto keep the Defender agent always up to date. Another advantage is the Real time device evaluation: If Defender detects a threat, such as malware, Intune can use the device as not compliant Level and automatically block access to corporate resources.
Jamf Pro & Intune: The future of Mac management from 2024
Many companies continue to rely on Jamf Pro to manage their macOS devices. Microsoft has a direct Jamf integration with Intune created, which makes it possible to Compliance status of Macs with Entra ID (formerly Azure AD) to synchronize.
Since fall 2024, integration has changed: The previous ability to use Macs via Jamf in Register Entra ID and thus integrate it into conditional access policies, was discontinued. Instead, the collaboration is now based on a new compliance partnership between Microsoft and Jamf. In doing so, Jamf transmits the Device status directly to Intune, so companies can seamlessly integrate Macs into their compliance policies regardless of the management tool they use.
The aim of this adjustment is a Unified management of all Macsregardless of whether they are primarily managed with Intune or Jamf.
Apple Business Manager (ABM): Zero-Touch Deployment for Macs
Microsoft Intune works closely with Apple Business Manager (ABM) together to one fully automated deployment and management of macOS devices to enable. Through this integration, companies benefit from smooth device deployment (zero-touch enrollment) and direct login with Microsoft Entra ID.
With ABM and Intune companies can roll out new Macs without manual configuration. As soon as a device is removed from the box and connected to the Internet, it automatically logs on to Intune. It then receives the predefined Policies, Security Measures, and Applicationsso it's ready to use right out of the box. ABM is also involved with Volume Purchase Program (VPP) integrated so that companies can centrally manage purchased apps and distribute them directly to devices via Intune.
After automatic registration, allows Platform Single Sign-On (Platform SSO) eine direct login with Microsoft Entra ID.
By combining Zero-touch enrollment via ABM and seamless authentication via Platform SSO Microsoft Intune significantly simplifies macOS management. Businesses benefit from consistent and secure device deployment while making the most of the benefits of the Apple ecosystem.
{{cta-box-alt=” /dev/components "}}
8. Conclusion
Microsoft Intune has become a powerful solution for managing macOS devices. Companies can now adopt security policies such as FileVault Encryption, System Integrity Protection (SIP), and Firewall Rules consistently implement and via Microsoft Defender for Endpoint Better defend against threats.
Even the app management has been optimized: Intune supports complex installations, enables a architecture-dependent software distribution and integrates seamlessly with Apple Business Manager. At the same time, Intune provides more precise control of macOS updatesto quickly close security gaps.
Die user experience benefits from Single sign-on (SSO) with Microsoft Entra ID, an optimized company portal app for Apple Silicon and the new Remote help feature for more efficient remote maintenance. This is supplemented by automation options like Shell scripts and Microsoft Graph API, which can significantly simplify routine tasks.
Thanks to these improvements, companies can Manage macOS devices as efficiently and securely as Windows deviceswithout continuing to rely on third-party tools.
Since 2011, Thore has focused exclusively on endpoint management and endpoint security topics. Initially focused on software packaging and software distribution with Microsoft MECM/SCCM and Ivanti DSM, he is now a sought-after interlocutor when it comes to unified endpoint management, system hardening, patch management and endpoint protection. The focus is in particular on the Microsoft technologies Intune, Configuration Manager, Entra and Defender. Thore is co-founder of the “Endpoint Management” expert group at IAMCP e.V.
Jahre Erfarung
Verwaltete Endgeräte
