What automated device enrollment does for a Mac

With automated device enrollment (ADE), a company Mac enrolls in Microsoft Intune during Setup Assistant, before anyone signs in. It's supervised automatically, and with the right policies in place it reaches the desktop already encrypted, set up with work apps and compliant.

Before the Mac is unboxed, check four things:

• Apple Business (formerly Apple Business Manager) is linked to Intune through an enrollment program token. The token setup is the same as for iPhone, on the macOS tab: Devices > Device onboarding > Enrollment > macOS > Enrollment program tokens.
• The Apple MDM push certificate in Intune is active.
• The Mac is assigned to the Intune device management service in Apple Business (Devices > Inventory > Assign Device Management), and the token has synced since.
• The Mac can reach the internet during Setup Assistant.

The enrollment policy

Create it under the token with Enrollment policies > Create policy. Intune used to call this the enrollment profile.

Sign-in and user affinity

Choose Enroll with User Affinity for a Mac that belongs to one person. The sign-in method is Setup Assistant with modern authentication: the user signs in with their Microsoft Entra account during setup, so the Mac is tied to them from the start.

Await final configuration

Await final configuration holds Setup Assistant on a locked screen until the key configuration policies have installed, so the user never lands on a half-configured desktop. It defaults to Yes for new policies; older policies keep No until you change them. Leave it on. The local account settings (macOS 12 and later) need it, along with user affinity and modern authentication, and configuring any of them turns it on for you.

Locked enrollment

Turn on Locked enrollment so the user can't remove the management profile. Decide this before the first enrollment: changing it later only takes effect after the Mac is erased and enrolled again.

Setup Assistant panes

Each pane is set to Show or Hide. Hide what the user doesn't need for work, such as Siri, Screen Time and Apple Pay. They can still change those choices later in System Settings. On macOS 15.4 and later, the Restore pane can't be hidden.

FileVault

Turn FileVault on with an Intune policy: Endpoint security > Disk encryption > Create policy, platform macOS, profile macOS FileVault. The Full Disk Encryption settings in the settings catalog do the same job. Intune escrows the personal recovery key, so nobody has to write it down. Two settings worth knowing:

• Show Recovery Key controls whether the user sees the key when encryption starts.
• Recovery Key Rotation In Months (1 to 12) replaces the key on a schedule.

Getting the key back:

• The user: the Company Portal website, Devices, their Mac, then Get recovery key.
• A technician: in the Intune admin center, Devices > All devices, the Mac, then Monitor > Recovery keys > Show Recovery Key. Both paths work only for corporate-owned Macs. The technician's role needs the Rotate FileVault key remote task, which the Help Desk Operator and Endpoint Security Administrator roles include.

Compliance checks encryption but doesn't turn it on. Set Encryption of data storage on device to Require in the macOS compliance policy, and let the FileVault policy do the encrypting.

What to land before handoff

• Company Portal, assigned as a Required app. Microsoft recommends it on every Mac: it's where users install apps, check compliance and sync the device, and Platform SSO depends on it.
• Microsoft 365 apps, added from Apps > All apps > Create > Microsoft 365 Apps > macOS. Microsoft documents a known issue where a Required assignment can close and reinstall the apps without warning, and suggests Available for enrolled devices instead. Pick one on purpose and tell the user what to expect.
• Platform SSO, so the Mac account and the Entra account stay in step. It takes one settings catalog policy, macOS 13 or later and a current Company Portal. Registering it during Setup Assistant needs macOS 26 or later, Company Portal deployed as a Required line-of-business app, Enable Registration During Setup, an enrollment policy with modern authentication and Await final configuration, and every policy assigned to the same static user groups.
• Configuration profiles for Wi-Fi, restrictions and anything else the user needs on day one.
• A compliance policy that requires encryption, a minimum macOS version and, where you need it, the firewall.

Test run

Enroll the Mac and watch it in Devices > All devices. A healthy Mac shows as enrolled with a recent check-in, its configuration profiles and apps report success, and its compliance state is Compliant.

If it gets stuck, check in this order:

1. The Mac is assigned to the Intune service in Apple Business.
2. The token is valid and has synced since the assignment (Devices > Sync on the token).
3. The Mac has an enrollment policy, either assigned directly or through Set Default Policy.
4. Profiles and apps are assigned to the groups the Mac or its user is actually in.
5. Still stuck: delete the Mac's record in Intune (not in Apple Business), erase the Mac and run Setup Assistant again.

Don't release the Mac from Apple Business to fix enrollment. Apple warns that releasing can't be undone, and the Mac stays out of automated enrollment until it's added back with Apple Configurator or through the reseller or carrier.

Handoff checklist

• Mac assigned in Apple Business and synced, with an enrollment policy that uses user affinity, modern authentication, Await final configuration and locked enrollment.
• Setup Assistant panes trimmed to what the user needs.
• FileVault on, with the recovery key escrowed in Intune.
• Company Portal and Microsoft 365 apps installed.
• Wi-Fi, restrictions and SSO profiles applied.
• Compliance policy reports Compliant.
• A recent check-in shows in Intune.
• The user knows how to open Company Portal and where to get their recovery key.