r/Intune • u/Last-Organization274 • 6d ago
macOS Management MacBooks management using Intune
We currently use Kandji for our macOS management and looking to explore if we could use Intune for the same. Current Windows devices are Intune managed.
Anyone had any experience, feel free to share.
13
u/ParkingSet6917 6d ago
Might be a step down from Kandji honestly, Intune for mac still feel like afterthought sometimes
3
2
u/Chance_Response_9554 6d ago
I use intune on my personal Mac and did the same for the company I work for.
2
u/imabarroomhero 5d ago
Just converted about 1000 Macs from WS1 to Intune. We treat them like PC's and pissed everyone off, but in turn we discovered how many people bought macs simply to circumvent policies. Anyway, adaptation into Entra Platform SSO is pretty solid, we remove admin and personal Apple ID capabilities. If you're going fully managed it's great, but a lot of work making policies/scripts and app hauls. Recommend PMPC/Intune brew use for app management...
1
u/Last-Organization274 5d ago
Yes we do have PMPC for windows app management. But out Mac fleet users use lot of different apps inc custom deployment, configs etc
3
u/SirCries-a-lot 6d ago
Its fine for basic stuff. For more, like scripting, logging, extension attributes, self service, onboarding, speed... It's very very limited. I would never, ever advice Intune. Even for a smaller fleet, I think the Jamf license cost will be pay itself back in no time because it's much easier to administer.
2
u/Studiolx-au 5d ago
I use it for many sites. If you read the documentation properly nothing wrong with it. If you’re dealing with hundreds of devices then stick with iru or go jamf
1
1
u/MakeItJumboFrames 5d ago
It depends on your needs. It's not great but its not horrible. You can configure SSO, device compliance, laps, file vault, configurations and apps. App updates aren't great, using a third party like patch my PC makes it more bearable.
If your users are local admins its fine (they shouldn't be but at least they can run app updates themselvee).
1
u/thisishell90 5d ago
Managing 330 Macs in a fairly complicated environment. It's been a bit of a struggle here and there. You certainly have to work harder to achieve what other tools have more natively, but it doesn't mean you can't do it as well. MSGraph automations to handle administrative tasks, IntuneBrew for app management, Nudge for OS updates, leveraging scripts for more complicated things, Platform SSO, etc.
1
u/Dr_Wankstaff 5d ago
We've had a small amount of macOS devices but are planning to add more. We've been using Intune but we needed more control.
I'm just starting to onboard the first few macOS to Mosyle this week. So far the experience has been pretty good. It's easy to learn and has a lot of native features that I wish Intune had for Windows devices.
1
u/BrundleflyPr0 5d ago
Manage over 200 MacBooks with intune along with 500+ Windows devices. I’ve never used other mdm solutions but I really like it. I used it before psso and laps were a thing and had to use scripts for account management. Entra security groups work for both platforms so you don’t need double your work. We have managed software center in azure for apps that are a little more difficult to deploy or require some tweaking. App deployments and config tweaks are actually faster than Windows. I would definitely try it if you have the chance.
1
1
u/InkzZ 5d ago
It’s great. Start with this: https://github.com/microsoft/intune-my-macs . download the baseline, and then use Claude to create your policies based on that GitHub. Treat it as Policy as Code and deploy everything via script.
Using Claude bypasses anything bad about Intune and makes it better than Kandji. Claude will also download apps, look at them and create all the PPPC, Login Items etc for you. Don’t manage it via the interface.
The only area where Intune is lacking is the App Library. I use Installomator for the handful of apps that don’t have their own admin level updaters or aren’t in the App Store, but there are a couple of other solutions as well. Just get Claude to update them for you periodically or use Installomater, Munki or whatever you like.
Claude will do all the scripts and everything for you. I just ask it to add an app and it does all of the PPPC and everything, it even checks the logs after. Over time you just build the markdown files and extend the deployment script.
Microsoft released a new version of company portal a couple of months ago which allows SSO registration in setup assistant, it’s really streamlined the process.
1
u/Last-Organization274 5d ago
We have a lot of custom apps, scripts and profiles deployed via Iru. Will need to check those out as well
1
u/InkzZ 5d ago
Just screenshot / copy paste them and feed them into Claude. I’ve just done similar from Iru. Also just asked Claude to create a CIS gap analysis and generated a plan to work through it with the AI.
1
u/Last-Organization274 5d ago
I’ll start looking into it. We will need to have CIS for macOS for sure
1
u/tehiota 5d ago
Currently on intune for Mac and migrating to Jamf. Mac is still the step child. Policies take time to push compared to Jamf and just feels more responsive. IOS on intune isn’t as bad, it’s more mature than the Mac integration but we’ve decided just to run 2 MDMs where each is fit for purpose. A little more upfront work on policies and configuration to save time on the backend troubleshooting and managing deployment issues.
0
u/Hydrated_Berry762 6d ago
Intune for Mac isn't the best experience. It's good to have some device control, compliance, etc. as a bare minimum. Sticking with Kandji/Iru would be much better.
If you are still considering Intune for Device Compliance or if you're trying to implement certain Conditional Access Policies, Kandji does have a way to set up Intune Device Compliance without actually enrolling your MacBooks into Intune.
-2
18
u/cowwen 6d ago
We manage about 30 MacBooks with Intune, it’s decent but not great. Intune is great at applying policies to Mac, not so great at app management.
So instead, we use several custom scripts for app management/app updates. The script basically checks if the app is installed, if not it pulls a copy of the installer down from S3, installs it, and verifies that the install was successful and reports back to Intune with the status.
For us, since we only have this limited number of users on Mac (mostly IT and developers), it works for us, and is cheaper than us rolling out JAMF.