Taking over Macs in Intune: what I check first

Many companies use Microsoft 365 and have Macs in use that nobody manages centrally. Bringing them into Intune is quite feasible. Before I enrol the first Mac, though, I check a few things that decide how much work it will be. Here is what they are and how the Macs are set up afterwards. The experience comes from Mac environments I have managed with Intune since 2023.

Why Intune for Macs

I manage Macs in production with both Intune and Mosyle. Intune is the obvious choice where Microsoft 365 is the foundation anyway: the licence is included in Business Premium, Windows PCs, Macs and phones sit in the same console, and device health feeds straight into Conditional Access. When a specialist Apple MDM is the better fit is covered in my comparison of Intune, Mosyle, Jamf and Iru. This article assumes the decision for Intune has been made.

What I check before the takeover

1. Does the Mac belong to the company in Apple Business Manager? I match the serial numbers against Apple Business Manager (Apple now calls the service “Apple Business”). Only assigned Macs can enrol automatically and are supervised afterwards.
2. Were Macs bought privately or in a shop? This happens often. I add such Macs to Apple Business Manager afterwards with Apple Configurator. They need Apple silicon or a T2 chip and at least macOS 12.0.1.
3. Is the Mac already in another MDM? Then the takeover is a migration. From macOS 26, Apple supports changing the management service without erasing, provided the Mac is managed through Automated Device Enrollment. On older versions the old profile has to be removed first.
4. Is FileVault already on? Then the existing recovery key has to be stored in Intune, or a new one generated on the Mac. Otherwise there is no key when it is needed.
5. Who is administrator on the Mac? If users have had administrator rights themselves, I change that as part of the takeover.
6. Which software is needed? I clarify this beforehand so the packages are ready when the Mac is taken over.

Does the Mac have to be erased?

Not necessarily. It depends on how the Mac comes under management.

• The Mac is in Apple Business Manager and assigned to the MDM, but was set up without management: it does not have to be erased. From macOS 14, macOS shows the user a full-screen prompt to enrol. It can be postponed once for eight hours; after that the user has to enrol or erase the Mac.
• The Mac is to be enrolled without erasing: this works as a personal device. The user enrols the Mac through Company Portal, and the configuration profiles still come from the MDM. Management is more limited, because settings that apply only to supervised devices are missing. For many requirements that is enough.
• The Mac was bought privately and is to be added to Apple Business Manager with Apple Configurator: here erasing is required, because the Mac has to be sitting in Setup Assistant. I back up the data first.
• The Mac is moving from another MDM: from macOS 26 this is possible without erasing. On older versions it depends on whether the old profile can be removed.

For privately bought Macs there is one more point: after handover, the user has 30 days to release the Mac from management. That is worth knowing before adding devices with Configurator.

How the Macs are set up afterwards

Where Intune reaches its limits on Macs

The clearest limit is response time. A command sent from Intune sometimes only reaches the Mac after several minutes. With shell scripts it can take several hours: according to Microsoft, the Intune agent on the Mac usually checks for new or changed scripts only every eight hours, independently of the device’s regular check-in. In my experience, Mosyle, Jamf and Iru respond considerably faster here.

For day-to-day work in most companies this is not a problem, because settings and software don’t change by the minute. But if you regularly need to intervene at short notice with a script, you notice the difference. I have also moved environments from Intune to Iru and from Intune to Mosyle.

Sources

• Enrolling Macs later, prompt from macOS 14: Apple Platform Deployment – Automated Device Enrollment and device management
• Enrolling Macs without Apple Business Manager through Company Portal: Microsoft Learn – Set up enrollment for macOS devices
• Adding Macs with Apple Configurator, requirements and 30-day provisional period: Apple Business – Add devices using Apple Configurator
• Changing the management service without erasing from macOS 26: Apple Platform Deployment – Migrate managed devices to another device management service
• Platform SSO with Entra ID: Microsoft Learn – Configure Platform SSO for macOS devices in Microsoft Intune
• FileVault and recovery keys: Microsoft Learn – Encrypt macOS devices with FileVault using Intune
• PKG packages through Intune: Microsoft Learn – Add an unmanaged macOS PKG app to Microsoft Intune
• Check-in interval for shell scripts: Microsoft Learn – Microsoft Intune Management Agent for macOS
• Installomator: Installomator Wiki – What it does