Platform / macOS management
Manage your Macs in the Intune you already run
Intune already handles macOS enrollment, configuration profiles and FileVault. Devicie adds the content and the upkeep: maintained security settings, a self-updating application catalog, update rings and control over who is a local admin. It all lands in your Intune tenant, managed by the same team and policies as your Windows devices, without a second platform to buy and run for Apple.
- Approved group
- Approved local admins (Entra ID)
- Check
- Every hour
- Not in the group
- Returned to standard user
- Support account
- Hidden admin, password rotated
- Password stored
- Your Azure Key Vault
Developer Macs
Developers keep their tools. IT keeps control of admin rights.
On a Mac, the first account set up is an admin. Developers usually keep those rights, install their own tools, and IT often has no record of what is installed or whether it is current.
Devicie puts admin rights behind a Microsoft Entra group your IT team owns. Every hour, each Mac checks its admins: people in the group are made admins, and anyone else is returned to a standard user. A separate support account, with a password that rotates and is stored in your own Azure Key Vault, gives IT a way in on every Mac.
Developers install approved applications from Company Portal without needing admin rights. Applications that release often can be set to update with no delay, so nobody waits on a ring.
- Approved group
- Approved local admins (Entra ID)
- Check
- Every hour
- Not in the group
- Returned to standard user
- Support account
- Hidden admin, password rotated
- Password stored
- Your Azure Key Vault
Security configuration
macOS security configuration, applied before first use
FileVault on at setup
FileVault turns on during setup, with the recovery key held in Intune.
CIS Level 1 and Level 2
Security settings for macOS 15, 26 and 27, applied by configuration profile and script, with each control checked on each Mac.
Microsoft Office settings
Security settings for Microsoft Office on Mac.
Apple Intelligence controls
A profile and a script together control Apple Intelligence on managed Macs.
Corporate device names
Each Mac gets a corporate name during setup.
Sign-in completed
Users finish signing in with their Microsoft account before they start work.
- Delay after release
- 7 days
- Pilot ring
- 1 day
- Deferrals per user
- 3
- Fast-moving apps
- No delay
- App open at update time
- User is asked first
Applications
Applications that stay current on your schedule
A catalog of 117 macOS applications, each installed from the vendor's latest release and checked against the vendor's Apple developer ID before it installs.
Updates follow your rings. You set how long to wait after a new version is released and how many times a user can put an update off. By default that is seven days after release, one day for the pilot group, and up to three deferrals. A closed application updates in the background; an open one asks the user first.
Applications that need camera, screen recording or full-disk access ship with the permission settings they need, so screen sharing works and security agents run without the user being asked.
Operating system updates
macOS updates in rings
Four update rings with delays and deadlines are ready to assign. Pre-pilot and pilot Macs get a new macOS update after one day, production after ten. Users see Apple's own update prompts.
- Pre-pilot
- 1 day
- Pilot
- 1 day
- Production
- 10 days
- Prompts
- Apple's own
Migration
Move Macs from Jamf without wiping them
Macs managed in Jamf move to Intune in stages, a pilot group first, without wiping the device. The Devicie Enrollment Utility unenrolls each Mac from Jamf, enrolls it in Intune and walks the user through each step. Jamf keeps managing the Macs that have not moved yet.
Macs on macOS 26 or later that are in Apple Business Manager can use Apple's own migration flow.
- Order
- Pilot group, then batches
- Device wipe
- None
- Leaves Jamf
- Unenrolled by the utility
- Joins Intune
- Enrolled by the utility
- The user
- Guided through each step
- Macs not yet moved
- Still managed in Jamf
Questions we get asked
Is Devicie the right fit for our Macs?
Devicie is built for organizations that run Windows and Intune and have Macs alongside them, from a few dozen to a large share of the fleet. If your business runs almost entirely on Macs, or depends on Apple-only features such as rule-based dynamic device groups, a dedicated Apple platform may suit you better, and we will tell you that in the first conversation.
Do our Macs need to be rebuilt to move from Jamf?
No. The Enrollment Utility moves each Mac from Jamf to Intune without a wipe. Migration from other Mac management platforms is not supported yet.
How quickly does a change to approved admins take effect?
Each Mac checks its admins every hour, so a change can take up to an hour to reach a Mac.
Do we need Apple Business Manager?
No. Macs bought outside Apple Business Manager can be enrolled with Company Portal. Macs in Apple Business Manager can also be set up with no hands on, with FileVault on from the start.
See your Macs managed in Intune
Walk through approved admins, the macOS catalog and update rings on a Devicie tenant.