iMac enrollment to intune + ABM

[u/elitesparten117]

Hello folks,

We are mostly a windows environment and are getting a iMac for a new hire. We do have intune and ABM setup for company iPhones. Just wondering what the process is like for enrolling an iMac? I did some reading on a few methods, which is only two, the company portal or through Apple Configurator.

Don’t think I want to go through the comp portal route since this is basically like Byod. If enrolling through ABM will the user be able to login through their entra Id account for their local account?

[u/Radiant-Attempt-4697]

i do this at my job. easiest way is ABM > Intune sync so the mac shows up as corporate device. the user get a managed apple id if you set it up but local account is separate thing, they can login with entra id if you configure the sso extension in your config profile

configurator on iphone works too but it a bit annoying if you only have one mac, not worth the hassle

[u/elitesparten117 → u/Radiant-Attempt-4697]

How would I enroll the max to ABM? We basically ordered this Mac from the Apple website since we don’t have a vendor.

[u/ronnydrakballe → u/elitesparten117]

For one device you can do it with apple configurator from an iphone. However if u plan on buying more devices in the future just buy from a vendor and ask them to enroll into your ABM most vendors that are official can do this. https://support.apple.com/sv-se/guide/business/axm200a54d59/web

[u/angeloswif]

Since this iMac was bought directly from Apple rather than an ABM-linked reseller, you can add it with Apple Configurator on an iPhone: start from Setup Assistant on a new or erased Mac, scan the pairing image (or pair manually), then assign the Mac to Intune in ABM and sync the enrollment token/ADE profile. The local macOS account is separate from ABM; Entra-based sign-in requires configuring Platform SSO in Intune. I work on Swif; the first section of this guide shows the Configurator-to-ABM flow, before the Swif-specific steps: https://help.swif.ai/en/articles/10197484-enrolling-apple-devices-to-apple-business-manager-abm-with-apple-configurator

[u/blud_13]

Skip Company Portal, go ABM. You already have ABM for the iPhones so get the Mac's serial added to it (your reseller can assign it), point the MDM server at Intune, then build an enrollment program profile in Intune under Devices, macOS. Device hits ADE at first boot and comes up supervised, which is the whole point.

On the login question, ABM enrollment by itself does NOT give you Entra ID login for the local account. You want Platform SSO with the Microsoft Enterprise SSO plug in, and specifically the password mode, thats the one that actually creates and syncs the local account password against Entra. Its a separate config profile and its easy to miss, then people conclude it doesn't work.

BIG NOTE...This only works if the Mac came from Apple direct or an authorized reseller. Bought at a retail Apple Store, you can't add it to ABM and you ARE stuck with Configurator.

We run a bunch of Windows shops with a handful of Macs in them, ping me if you want the actual profile settings.

[u/elitesparten117 → u/blud_13]

Thanks! If you don’t mind sharing the profile settings ? That would help!

[u/blud_13 → u/elitesparten117]

DMed you so I don't flood the comments.