Building a macOS management configuration in Intune from scratch involves a lot of decisions – FileVault policy, Firewall, Gatekeeper, login window security, screensaver enforcement, compliance policy, application deployment, scripts, custom attributes. Each requires research, testing, and an understanding of what macOS MDM can and can’t enforce. Microsoft has already done most of that work and published it.
intune-my-macs – github.com/microsoft/intune-my-macs – is an official Microsoft repository maintained by the Intune Customer Experience Engineering team. It’s a production-ready macOS management baseline for Intune, deployable from a single PowerShell script, that covers the full configuration stack for a modern Mac fleet. It is not a community project. It is Microsoft’s own opinionated reference implementation for macOS management.
intune-my-macs is the best starting point for macOS management in Intune that currently exists. It encodes decisions that would take weeks of research and testing to arrive at independently – and it’s maintained by the team closest to the product.
What the script deploys covers every major area of macOS management. On the security and configuration side: FileVault disk encryption policy, Firewall configuration, Gatekeeper enforcement, login window security, screensaver idle timeout and password requirement, guest account restrictions, managed login items, NTP time server configuration, Microsoft Office settings, and Declarative Device Management configuration. On the compliance side: a macOS compliance policy with the settings that reflect reasonable baseline requirements. Scripts include Company Portal installation and auto-update, Dock customization, and Escrow Buddy for FileVault recovery key escrow. Applications include Swift Dialog – which provides an interactive onboarding splash screen showing real-time installation progress – Office 365, Teams, Microsoft 365 Copilot, and Windows App. Custom attributes include hardware compatibility checks that determine the maximum supported macOS version for each device. And optionally, with the --mde flag, full Defender for Endpoint onboarding using your org-specific onboarding package.
The script connects to your tenant via Microsoft Graph, previews what it will create in dry-run mode by default, and creates nothing until you add the --apply flag. You specify an Entra group and everything gets assigned to that group. The naming convention is consistent and uses a configurable prefix – you can override the default with --prefix to match your existing naming standards. Individual artifact categories can be scoped with flags like --apps, --config, --compliance, and --scripts if you want to import specific components rather than the full baseline.
Before running the script, three things need to be in place. An MDM authority must be set in your tenant – this is a prerequisite for any Intune enrollment. An APNS certificate must be configured – required for macOS enrollment, without it no Mac can enroll. And the account running the script needs appropriate Graph permissions – Intune Administrator role is sufficient, or you can grant the specific Graph permissions listed in the repository README.
The recommended approach is to run in dry-run mode first, review the artifact catalog in the repository documentation, understand what each policy does and why, then apply to a pilot group. The repository includes a full documentation file – INTUNE-MY-MACS-DOCUMENTATION.md – that catalogs every artifact with complete settings details. Reading that before applying gives you a clear picture of exactly what will be created in your tenant.
Don’t apply intune-my-macs blindly to production. Run dry-run, read the documentation, understand what each artifact does, then pilot. It’s a starting point – review it like you’d review any baseline before deploying it at scale.
Platform SSO configuration is included in the repository – it’s one of the configuration artifacts. But intune-my-macs is not a Platform SSO tool. It’s a full Mac management baseline that happens to include Platform SSO as one of many components. Platform SSO implementation specifics – the authentication method decision, the user registration experience, and what to verify after deployment – are covered in the next article.
One practical note on assignment: the repository documentation notes that dynamic device groups cause unpredictable enrollment delays and recommends assignment filters as the preferred approach for enrollment-time policy targeting. This aligns with the assignment filter guidance from Phase 2 – filters are evaluated at policy delivery time without group evaluation delay, making them more reliable for time-sensitive policy application during enrollment.
Intune Deployment Guide · Phase 11: Mac Management
‹ Previous: [11.1] Managing Macs with Intune: What’s Different and Why It Matters
Next: [11.2] Platform SSO: What It Is and Why It Changes Everything for Mac ›
