Enroll your macOS device with the Intune Company Portal app to gain secure access to your work or school email, files, and apps.
- Review the Intune service support blog for tips and recommendations that may be relevant to you during this change. Ensure your users update to the latest version of the Intune Company Portal for their platform. Available now in the iOS App Store and through Microsoft AutoUpdate on macOS.
- Download a sample script to install Company Portal for macOS from Intune Shell Script Samples - Company Portal. Follow instructions to deploy the macOS Shell Script using macOS Shell Scripts. Set Run script as signed-in user to No (to run in the system context).
- Set up your Mac; Get the Company Portal app. Download the Intune Company Portal app for macOS on your device. The app lets you monitor, sync, add, and remove your device from management, and install apps. These steps also describe how to register your device with Company Portal.
When you install the Company Portal app and enroll your macOS device in Intune, you can use the Company Portal app to: Access the company's network, and your email and work files. Get company apps from the Company Portal. Remotely reset your phone to factory settings if it is lost or stolen. Automatically set up your company email account.
Organizations typically require you to enroll your device before you can access proprietary data. After your device is enrolled, it becomes managed. Your organization can assign policies and apps to the device through a mobile device management (MDM) provider, such as Intune. To get continuous access to work or school information on your device, you must configure your device to match your organization's policy settings.
This article describes how to use the Company Portal app for macOS to enroll, configure, and maintain your device so that you meet your organization's requirements.
What to expect from the Company Portal app
During initial setup, the Company Portal app requires you to sign in and authenticate yourself with your organization. Company Portal then informs you of any device settings you need to configure to meet your organization's requirements. For example, organizations often set minimum or maximum character password requirements that you'll be required to meet.
After you enroll your device, Company Portal will always make sure that your device is protected according to your organization's requirements. For example, if you install an app from an untrusted source, Company Portal will alert you and might restrict access to your organization's resources. App protection policies like this one are common. To regain access, you'll likely need uninstall the untrusted app.
If after enrollment your organization enforces a new security requirement, such as multi-factor authentication, Company Portal will notify you. You'll have the chance to adjust your settings so that you can continue to work from your device.
Get your macOS device managed
Use the following steps to enroll your macOS device with your organization. Your device must be running macOS 10.12 or later.
Note :
Throughout this process, you might be prompted to allow Company Portal to use confidential information that's stored in your keychain. These prompts are part of Apple security. When you get the prompt, type in your login keychain password and select Always Allow. If you press Enter or Return on your keyboard, the prompt will instead select Allow, which may result in additional prompts.
Install Company Portal app
- Go to Enroll My Mac.
- The Company Portal installer .pkg file will download. Open the installer and continue through the steps.
- Agree to the software license agreement.
- Enter your device password or registered fingerprint to install the software.
- Open Company Portal.
Important
Microsoft AutoUpdate might open to update your Microsoft software. After all updates are installed, open the Company Portal app. For the best setup experience, install the latest versions of Microsoft AutoUpdate and Company Portal.
Enroll your Mac
Sign in to Company Portal with your work or school account.
When the app opens, select Begin.
Review what your organization can and can't see on your enrolled device. Then select Continue.
If prompted to, enter your device password on the Install management profile screen.
On the Confirm device management screen, select Open System Preferences.
Your device's system preferences will open. Select Management Profile from the device profiles list and then select Approve > Approve.
Return to Company Portal and select Continue.
Your organization might require you to update your device settings. When you're done updating settings, select Check settings.
When setup is complete, select Done.
As Microsoft starts to empower the integration for non Windows devices and also the available apps for macOS devices you might want to profit from your existing MDM solution of choice (Microsoft Intune) and enable features like conditional access or Windows Defender ATP on your macOS devices. This post covers the enrollment with the company portal app. If you want to enroll your devices with DEP (device enrollment program) you can find a great guide here.
Mind the enrollment restrictions
Let’s start and check the configured enrollment restrictions to make sure that the macOS enrollment is not blocked for your tenant. You’ll find them on your Intune dashboard under: Microsoft Intune > Device enrollment - Enrollment restrictions
Get an Apple MDM push certificate
Without loosing into details - you need an Apple MDM push certificate (also called APNs) to manage apple devices with MDM. The push certificate allows your MDM solution to send notifications about device actions to your end devices (e.g. wipe, app installation, new policy). To request a push certificate you need a valid Apple ID.
In Intune navigate to the Apple enrollment section and download your CSR. The CSR is required to request the APNs certificate.
Now access the Apple push certificate portal and sign in with a valid apple ID.
Request a new certificate and upload your CSR when prompted. Afterwards switch back to your Intune portal and upload the issued APNs certificate.
Intune For Mac
Enroll your first macOS machine
Microsoft Intune For Mac
Here a little walk trough from an end users perspective.
First sign in to the Intune device portal with your browser and Microsoft account: https://portal.manage.microsoft.com/.
Intune Company Portal Website
Now you’re ready to empower the Microsoft power on your macOS devices!