Taking over Macs in Intune: what I check first

Many companies use Microsoft 365 and have Macs in use that nobody manages centrally. Bringing them into Intune is quite feasible. Before I enrol the first Mac, though, I check a few things that decide how much work it will be. Here is what they are and what the Macs look like afterwards. The experience comes from Mac environments I have managed with Intune since 2023.

Why Intune for Macs

I manage Macs in production with both Intune and Mosyle. Intune is the obvious choice where Microsoft 365 is the foundation anyway: Business Premium includes the licence, Windows PCs, Macs and phones sit in the same console, and device health feeds straight into Conditional Access. I describe when a specialist Apple MDM is the better fit in my comparison of Intune, Mosyle, Jamf and Iru. This article assumes you have already decided on Intune.

What I check before the takeover

1. Does the Mac belong to the company in Apple Business Manager? I match the serial numbers against Apple Business Manager (Apple now calls the service “Apple Business”). Only assigned Macs can enrol automatically and become supervised.
2. Were Macs bought privately or in a shop? This happens often. I add such Macs to Apple Business Manager afterwards with Apple Configurator. They need Apple silicon or a T2 chip and at least macOS 12.0.1.
3. Is the Mac already in another MDM? Then the takeover is a migration. From macOS 26, Apple supports changing the management service without erasing, provided the Mac is managed through Automated Device Enrollment. On older versions I remove the old profile first.
4. Is FileVault already on? Then the existing recovery key has to go into Intune, or the Mac generates a new one. Otherwise there is no key when you need it.
5. Who is administrator on the Mac? If users have had administrator rights themselves, I change that as part of the takeover.
6. Which software is needed? I clarify this beforehand so the packages are ready when the takeover starts.

Does the Mac have to be erased?

Not necessarily. It depends on how the Mac comes under management.

• The Mac is in Apple Business Manager and assigned to the MDM, but went through setup without management: it does not need erasing. From macOS 14, macOS shows the user a full-screen prompt to enrol. They can postpone it once for eight hours; after that they have to enrol or erase the Mac.
• The Mac should enrol without erasing: this works as a personal device. The user enrols the Mac through Company Portal, and the configuration profiles still come from the MDM. Management is more limited, because settings that apply only to supervised devices are missing. For many requirements that is enough.
• The Mac is a private purchase that I add to Apple Business Manager with Apple Configurator: here the Mac needs erasing, because it has to be sitting in Setup Assistant. I back up the data first.
• The Mac is moving from another MDM: from macOS 26 this is possible without erasing. On older versions it depends on whether I can remove the old profile.

For privately bought Macs there is one more point: after handover, the user has 30 days to release the Mac from management. That is worth knowing before adding devices with Configurator.

How the Macs are set up afterwards

Where Intune reaches its limits on Macs

The clearest limit is response time. A command sent from Intune sometimes only reaches the Mac after several minutes. With shell scripts it can take several hours: according to Microsoft, the Intune agent on the Mac usually checks for new or changed scripts only every eight hours, independently of the device’s regular check-in. In my experience, Mosyle, Jamf and Iru respond considerably faster here.

For day-to-day work in most companies this is not a problem, because settings and software don’t change by the minute. But if you regularly need to intervene at short notice with a script, you notice the difference. I have also moved environments from Intune to Iru and from Intune to Mosyle.

Frequently asked questions

Is Intune good enough for managing Macs?

In my experience, Intune is perfectly adequate for companies with up to around 150 Macs, especially where Microsoft 365 is the foundation. If you regularly need to intervene at short notice with a script, a specialist Apple MDM such as Mosyle, Jamf or Iru serves you better.

How do employees sign in to the Mac after the takeover?

With their Microsoft account. Through Platform SSO the Mac registers in Entra ID, and apps and browsers receive the sign-in.

How long does a change from Intune take to reach a Mac?

A command sent from Intune sometimes only arrives after several minutes. With shell scripts it can take several hours, because according to Microsoft the Intune agent usually checks for new or changed scripts only every eight hours.

Sources

• Enrolling Macs later, prompt from macOS 14: Apple Platform Deployment – Automated Device Enrollment and device management
• Enrolling without Apple Business Manager through Company Portal: Microsoft Learn – Set up enrollment for macOS devices
• Adding Macs with Apple Configurator, requirements and 30-day provisional period: Apple Business – Add devices using Apple Configurator
• Changing the management service without erasing from macOS 26: Apple Platform Deployment – Migrate managed devices to another device management service
• Platform SSO with Entra ID: Microsoft Learn – Configure Platform SSO for macOS devices in Microsoft Intune
• FileVault and recovery keys: Microsoft Learn – Encrypt macOS devices with FileVault using Intune
• PKG packages through Intune: Microsoft Learn – Add an unmanaged macOS PKG app to Microsoft Intune
• Check-in interval for shell scripts: Microsoft Learn – Microsoft Intune Management Agent for macOS
• Installomator: Installomator Wiki – What it does