Enrolling existing Macs in Intune: requirements and process
Which points decide the effort before existing Macs are enrolled in Intune, when a Mac has to be erased, how Platform SSO, FileVault and software deployment are set up, and where Intune reaches its limits on Macs.
Macs that are already in use can still be brought under central management. The route depends on how the devices have been enrolled and managed so far. I describe the requirements I check before enrolling existing Macs in Intune and how I prepare the move. The experience comes from Mac environments I have managed with Intune since 2023.
Why Intune for Macs
I manage Macs in production with both Intune and Mosyle. Intune is the obvious choice where Microsoft 365 is the foundation anyway: Business Premium includes the licence, Windows PCs, Macs and phones sit in the same console, and device health feeds straight into Conditional Access. I describe when a specialist Apple MDM is the better fit in my comparison of Intune, Mosyle, Jamf and Iru. This article assumes you have already decided on Intune.
What I check before enrolment
- Does the Mac belong to the company in Apple Business Manager? I match the serial numbers against Apple Business Manager (Apple now calls the service “Apple Business”). Only assigned Macs can enrol automatically and become supervised.
- Were Macs bought privately or in a shop? This happens often. I add such Macs to Apple Business Manager afterwards with Apple Configurator. They need Apple silicon or a T2 chip and at least macOS 12.0.1.
- Is the Mac already in another MDM? Then enrolment becomes a migration. From macOS 26, Apple supports changing the management service without erasing, provided the Mac is managed through Automated Device Enrollment. The move is triggered in Apple Business with a deadline; Macs added with Apple Configurator only qualify once their 30-day provisional period has ended. On older versions I remove the old profile first.
- Is FileVault already on? Then the existing recovery key has to go into Intune, or the Mac generates a new one. Otherwise there is no key when you need it.
- Who is administrator on the Mac? If users have had administrator rights themselves, I change that as part of the migration.
- Which software is needed? I clarify this beforehand so the packages are ready when enrolment starts.
Does the Mac have to be erased?
Not necessarily. It depends on how the Mac comes under management.
The enrolment prompt fills the screen. The user can postpone it once for eight hours; after that they have to enrol or erase the Mac. As a personal device, the configuration profiles still come from the MDM. Only settings that apply to supervised devices are missing, and for many requirements that is enough.
For privately bought Macs there is one more point: after handover, the user has 30 days to release the Mac from management. That is worth knowing before adding devices with Configurator.
How the Macs are set up afterwards
With Platform SSO, users sign in to the Mac with their Microsoft account. The Mac registers in Entra ID, and apps and browsers receive the sign-in. Whether the local password is synchronised with the Microsoft account or sign-in uses the Secure Enclave or a smart card depends on the mode you choose.
Intune enforces FileVault and stores the personal recovery key centrally, where administrators can rotate it. They can only view it for Macs marked as corporate devices.
I deploy applications as PKG packages through Intune, including packages with their own scripts. For common applications I also use Installomator, an open-source script that downloads the current version from the vendor and checks the signature and notarisation before installing.
Users work as standard users without local administrator rights. What they need comes through Intune.
Where Intune reaches its limits on Macs
The clearest limit is response time. A command sent from Intune sometimes only reaches the Mac after several minutes. With shell scripts it can take several hours: according to Microsoft, the Intune agent on the Mac usually checks for new or changed scripts only every eight hours, independently of the device’s regular check-in. In my experience, Mosyle, Jamf and Iru respond considerably faster here.
For day-to-day work in most companies this is not a problem, because settings and software don’t change by the minute. But if you regularly need to intervene at short notice with a script, you notice the difference. I have also moved environments from Intune to Iru and from Intune to Mosyle.
Frequently asked questions
Is Intune good enough for managing Macs?
In my experience, Intune is perfectly adequate for companies with up to around 150 Macs, especially where Microsoft 365 is the foundation. If you regularly need to intervene at short notice with a script, a specialist Apple MDM such as Mosyle, Jamf or Iru serves you better.
How do employees sign in to the Mac after enrolment?
In the environments I set up, with their Microsoft account. Through Platform SSO the Mac registers in Entra ID, and apps and browsers receive the sign-in. The details depend on the Platform SSO mode you choose.
How long does a change from Intune take to reach a Mac?
A command sent from Intune sometimes only arrives after several minutes. With shell scripts it can take several hours, because according to Microsoft the Intune agent usually checks for new or changed scripts only every eight hours.
Sources
- Enrolling Macs later, prompt from macOS 14: Apple Platform Deployment – Automated Device Enrollment and device management
- Enrolling without Apple Business Manager through Company Portal: Microsoft Learn – Set up enrollment for macOS devices
- Adding Macs with Apple Configurator, requirements and 30-day provisional period: Apple Business – Add devices using Apple Configurator
- Changing the management service without erasing from macOS 26: Apple Platform Deployment – Migrate managed devices to another device management service
- Platform SSO with Entra ID: Microsoft Learn – Configure Platform SSO for macOS devices in Microsoft Intune
- FileVault and recovery keys: Microsoft Learn – Encrypt macOS devices with FileVault using Intune
- PKG packages through Intune: Microsoft Learn – Add an unmanaged macOS PKG app to Microsoft Intune
- Check-in interval for shell scripts: Microsoft Learn – Microsoft Intune Management Agent for macOS
- Installomator: Installomator Wiki – What it does
Consistent email signatures for Microsoft 365 with CodeTwo
Set it once, centrally, and it appears under every email from every device: what consistent signatures with CodeTwo achieve, how it works and what it costs, with a price calculator.
Read article→
Email archiving: what the GoBD require and why the mailbox is not enough
Business emails must be kept complete and unalterable for six or eight years. Why the archive mailbox in Microsoft 365 is not enough, how a journal rule captures every email and what Hornetsecurity and MailStore offer.
Read article→
Privileged Identity Management: admin rights only when needed
Permanent admin rights are the biggest risk in many Microsoft 365 tenants. How PIM grants roles only when needed and for a limited time, which licence it requires and what Business Premium achieves without PIM.
Read article→