Managing Macs with Microsoft Intune: A Practical Setup Guide (No Jamf Required)

Every few months an IT team in a Microsoft-heavy shop asks me the same question: we have thirty or forty Macs, we already pay for Intune, do we really need to stand up Jamf too? The honest answer is that you can run a Mac fleet entirely from Microsoft Intune — enrollment, compliance, configuration, scripts and apps all work. After building this setup for smaller fleets alongside larger Jamf deployments, here is how to do it properly, and the limits worth knowing before you commit.

Get enrollment right with Apple Business Manager

Intune-managed Macs still need Apple’s enrollment layer underneath them. Connect Apple Business Manager to Intune as an MDM server, assign your devices or serial ranges to that server, and build an enrollment profile that supervises the device and locks MDM on. The result is a Mac that enrolls automatically during Setup Assistant with no user steps beyond signing in.

• Automated Device Enrollment (ADE): the path for company-purchased Macs — supervised, non-removable management, zero-touch.
• Company Portal enrollment: the fallback for existing or personally-owned machines — user-driven, not supervised, fewer controls available.
• The token trap: the ABM-to-Intune token and the Apple push certificate both expire yearly. Put both renewal dates on a calendar — an expired push certificate silently breaks management for every Mac and iPhone you own.

Compliance policies feed Conditional Access

This is the main reason to manage Macs at all in a Microsoft environment. An Intune compliance policy for macOS can check OS version, FileVault encryption, firewall state, Gatekeeper, and the presence of a system password. Devices that fail are marked non-compliant, and an Entra ID Conditional Access policy can then block them from Microsoft 365 and any other integrated app. Start the compliance policy in a permissive state, watch the reporting for a week, then tighten the thresholds once you know what your fleet actually looks like.

Configuration: settings catalog first, custom profiles when you must

Intune’s settings catalog covers a growing slice of macOS: restrictions, the login window, software update deferrals, Microsoft AutoUpdate, Wi-Fi and VPN payloads. When the setting you need is not there, you drop to a custom configuration profile — a .mobileconfig file you build with Apple Configurator or iMazing Profile Editor and upload as raw XML. Keep a source-controlled copy of every custom profile; the uploaded blob is not something you want to reverse-engineer later.

Shell scripts, with realistic expectations

Intune can push shell scripts to macOS, run them as root or as the signed-in user, and report success or failure. It is genuinely useful, but it is not Jamf’s policy engine:

• Scripts run on a roughly weekly cadence after the first execution — not on demand, and not on a schedule you fully control.
• There is a size limit and a 30-minute runtime cap; the script either succeeds once or retries a set number of times.
• Nothing is idempotent for you. Write every script to check state before acting, because it will run again.

For anything time-sensitive — reacting to a new browser zero-day the same day — this cadence will frustrate you.

Apps: packaging and the wrapper tool

Line-of-business apps go through the Intune App Wrapping Tool, which turns a .pkg into a .intunemac file for upload. Intune also handles DMG apps, Microsoft 365 as a first-party deployment, and volume-purchased apps synced from Apple Business Manager. What you do not get is a self-service catalog with the polish of Jamf Self Service — the Company Portal app store is functional but plain, and users notice.

Platform SSO for a real single sign-on

On macOS 13 and later, Platform SSO lets users sign in to the Mac with their Entra ID credentials and keeps that token available to apps and the browser. Configured through an Intune profile and the Microsoft Enterprise SSO plug-in, it is the closest thing to the seamless identity experience Windows users get from Entra join. It takes some tuning, but it removes a whole category of password friction.

Where Intune stops and Jamf earns its licence

Be clear-eyed about the gaps before you decide. Compared with Jamf Pro, Intune gives you a weaker patch-orchestration story, no equivalent of Smart Groups for continuously re-targeted automation, limited inventory and no custom extension attributes, a plainer self-service experience, and a scripting cadence you cannot rely on for urgent work. For a few dozen Macs in a Microsoft shop where the priority is Conditional Access and baseline compliance, none of that may matter. For hundreds of Macs, or a team that lives in the Apple ecosystem, it will.

Bottom line

Managing Macs with Intune alone is a legitimate choice, not a compromise you should be embarrassed by. Wire up Apple Business Manager, lean on compliance policies to drive Conditional Access, use the settings catalog before custom profiles, and treat shell scripts as a blunt instrument rather than an automation platform. Know the ceiling — patching, self-service, and deep inventory — and add Jamf the day you hit it, not before.