Intune macOS Management Intune macOS Management

Level-500-Referenz für macOS Enrollment, Apple Business Manager, Konfigurationsprofile, Platform SSO, FileVault, Apps, Compliance, Declarative Device Management und Troubleshooting. Level 500 reference for macOS enrollment, Apple Business Manager, configuration profiles, Platform SSO, FileVault, apps, compliance, declarative device management, and troubleshooting.

Architektur und Betriebsmodell Architecture and operating model

Intune verwaltet macOS über Apples MDM-Frameworks. Für belastbare Designs werden ABM, Intune, Entra ID, Zertifikatsdienste, Recovery-Prozesse und Support-Runbooks gemeinsam geplant. Intune manages macOS through Apple MDM frameworks. Durable designs plan ABM, Intune, Entra ID, certificate services, recovery processes, and support runbooks together.

Enrollment-Methoden Enrollment methods

Microsoft Learn unterscheidet auf macOS zwischen Automated Device Enrollment, Device Enrollment über Company Portal, direkter Enrollment und User Approved MDM. Die Wahl hängt an Besitzmodell, Reset-Fähigkeit und gewünschter Zero-Touch-Tiefe. Microsoft Learn differentiates on macOS between automated device enrollment, device enrollment through Company Portal, direct enrollment, and user-approved MDM. The choice depends on ownership, reset capability, and the desired zero-touch depth.

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'macOS'" -All |
  Select-Object DeviceName,UserPrincipalName,ComplianceState,ManagementAgent,EnrolledDateTime

Apple Business Manager / School Manager Apple Business Manager / School Manager

ABM und ASM liefern die Gerätequelle für ADE und die Lizenzquelle für Mac-App-Store-Apps. Tokenpflege, Gerätezuweisung, Enrollment Profiles und Await configuration gehören in ein festes Betriebsverfahren. ABM and ASM provide the device source for ADE and the license source for Mac App Store apps. Token hygiene, device assignment, enrollment profiles, and await configuration belong in a fixed operational procedure.

{
  "displayName": "macOS ADE Corporate",
  "description": "User-affinity profile with await configuration",
  "awaitDeviceConfigured": true,
  "deviceNameTemplate": "MAC-%SERIAL%",
  "supervisedModeEnabled": true,
  "configuredSetupItems": ["AppleID", "Siri", "Privacy", "ScreenTime"]
}

Konfigurationsprofile und Einstellungen Configuration profiles and settings

Die macOS-Konfigurationsfläche in Intune deckt Device Features, Device Restrictions, VPN, Wi-Fi, E-Mail, Endpoint Protection, Extensions, PPPC und Custom Profiles ab. Eine belastbare Referenz strukturiert diese Payloads nach Abhängigkeiten statt nach Portalmenüs. The macOS configuration surface in Intune covers device features, device restrictions, VPN, Wi-Fi, email, endpoint protection, extensions, PPPC, and custom profiles. A durable reference organizes these payloads by dependencies rather than portal menus.

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
  <dict>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadContent</key>
    <array>
      <dict>
        <key>PayloadType</key>
        <string>com.apple.notificationsettings</string>
      </dict>
    </array>
  </dict>
</plist>

Platform SSO, PPPC, Extensions und FileVault Platform SSO, PPPC, extensions, and FileVault

Platform SSO verbindet Entra ID mit der lokalen Anmeldeerfahrung. Zusammen mit Kerberos, Secure Enclave, PPPC, System Extensions und FileVault entsteht die moderne macOS-Sicherheitskette in Intune. Platform SSO connects Entra ID with the local sign-in experience. Together with Kerberos, Secure Enclave, PPPC, system extensions, and FileVault, it forms the modern macOS security chain in Intune.

$uri = "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations"
Invoke-MgGraphRequest -Method GET -Uri $uri |
  Select-Object -ExpandProperty value |
  Where-Object { $_.displayName -like '*macOS*' } |
  Select-Object id, displayName, '@odata.type'

Shell Scripts und Custom Attributes Shell scripts and custom attributes

Shell Scripts ergänzen fehlende native Intune-Einstellungen, während Custom Attributes Inventardaten und Zustandswerte liefern. Die Trennlinie ist wichtig: Konfigurationen ändern Systeme, Custom Attributes beschreiben Systeme. Shell scripts complement missing native Intune settings, while custom attributes provide inventory and state values. The distinction matters: configuration changes systems, custom attributes describe systems.

#!/bin/zsh
logFile="/Library/Logs/Contoso/intune-health.log"
mkdir -p "$(dirname "$logFile")"
profiles status -type enrollment >> "$logFile"
fdesetup status >> "$logFile"

#!/bin/zsh
if /usr/bin/pgrep oahd >/dev/null 2>&1; then
  echo "RosettaInstalled=True"
else
  echo "RosettaInstalled=False"
fi

Apps, Compliance, Updates und DDM Apps, compliance, updates, and DDM

Auf macOS gehören App-Lebenszyklus, Compliance und Software Update eng zusammen. Unternehmens-Apps müssen mit Gatekeeper, FileVault, Platform SSO und Update-Deadlines harmonieren; DDM bringt dabei mehr lokale Intelligenz auf das Gerät. On macOS, app lifecycle, compliance, and software update belong together. Enterprise apps must harmonize with Gatekeeper, FileVault, Platform SSO, and update deadlines; DDM adds more local intelligence on the device.

Graph API, PowerShell und Troubleshooting Graph API, PowerShell, and troubleshooting

Für Automation und Fehleranalyse sind Graph API, Graph PowerShell SDK, legacy Microsoft.Graph.Intune-Skripte und lokale Apple-Logs relevant. Ein gutes Runbook verbindet Portalzustand, lokale Profile, Setup-Assistant-Symptome und Company-Portal-Logs. Graph API, the Graph PowerShell SDK, legacy Microsoft.Graph.Intune scripts, and local Apple logs matter for automation and troubleshooting. A good runbook links portal state, local profiles, Setup Assistant symptoms, and Company Portal logs.

Connect-MSGraph
Get-IntuneManagedDevice -Filter "contains(operatingSystem,'macOS')" |
  Select-Object deviceName, complianceState, enrolledDateTime

profiles show -type enrollment
log show --predicate 'subsystem == "com.apple.ManagedClient"' --last 30m
sudo fdesetup status