macOS configuration in Intune uses two distinct mechanisms that exist alongside each other and serve different purposes. Understanding which one to use for which settings – and why both are sometimes necessary – prevents the confusion that comes from treating them as interchangeable.
Settings Catalog is the modern approach. It provides a searchable, documented list of supported macOS configuration settings that Intune can deliver declaratively. Settings Catalog for macOS has expanded significantly and continues to grow with each Intune release. For any setting that exists in Settings Catalog, use it – it’s the supported, documented path, and the settings are visible and reportable in the Intune portal.
Custom configuration profiles – mobileconfig files – are the legacy mechanism. They use Apple’s MDM specification directly, configuring settings as XML payload delivered to the device. Many settings that are configurable on macOS through MDM haven’t been surfaced in Intune’s Settings Catalog yet, and for those settings, a custom mobileconfig profile is the only option. The intune-my-macs repository uses both – Settings Catalog for the settings it covers, custom mobileconfig profiles for settings like screensaver idle time and login window configuration that aren’t available in Settings Catalog.
Use Settings Catalog when the setting exists there. Use a custom mobileconfig profile when it doesn’t. Don’t use mobileconfig profiles for settings that are in Settings Catalog – you’ll create unnecessary complexity and potential conflicts.
Creating custom mobileconfig profiles requires knowledge of Apple’s MDM payload specification. The profile is an XML file with a specific structure – payload type, payload identifier, payload UUID, and the configuration values for the specific preference domain being configured. Apple’s documentation covers the available payload types and their settings. Creating a profile incorrectly – wrong payload type, incorrect key names, malformed XML – results in the profile failing silently on the device, which is harder to diagnose than a Intune policy conflict.
OIB – OpenIntuneBaseline – has a macOS baseline in the same repository as the Windows baseline. It covers a set of security-relevant macOS settings using both Settings Catalog and custom profiles, and it follows the same modular, well-documented approach as the Windows baseline. It’s worth reviewing as a reference even if you’re starting from intune-my-macs, because the two complement each other – intune-my-macs provides a deployment-ready configuration, OIB provides a security-focused baseline with documented rationale for each setting decision.
The practical approach for macOS baselines is to start with intune-my-macs as the operational foundation, reference OIB for security hardening decisions, and add custom mobileconfig profiles only for settings not available in Settings Catalog. As Settings Catalog coverage expands with Intune updates, settings that were delivered via custom profiles can be migrated to Settings Catalog – reducing the number of custom profiles in the environment over time.
Conflict behavior between Settings Catalog policies and custom mobileconfig profiles on macOS follows the same general principle as on Windows – avoid configuring the same setting through two different mechanisms. The outcome when two profiles attempt to configure the same preference domain value is unpredictable. Map ownership of each setting to one policy and one mechanism, and document that mapping so it survives the next administrator who inherits the environment.
Intune Deployment Guide · Phase 11: Mac Management
‹ Previous: [11.4] Mac Application Deployment: PKG, DMG, and the App Store
Next: [11.6] Migrating Macs to Intune from Jamf or No MDM ›
