MacOS DEP enrolment with Intune – Part 2 (the Out of Box Experience)

To follow on from the last post available here I’m going to focus on the end user experience of when the user receives there new Mac, in this case a MacBook Air 13 Inch which has been procured from the Apple ecommerce.apple.com site, which is different to Business.apple.com, and deploy.apple.com this will be something I blog about in the future.

So why is the Out of Box Experience something that is important to talk about, well the simple answer is that it is a different type of enrolment then what we have with MacOS devices which only have the Company Portal installed.

When enrolling a MacOS into Intune using DEP, the device will be adding into Azure AD as an “Azure AD Registered” device, this allows for the device to tagged as compliant or not for things like Conditional Access and alike.

The next thing to be aware of is that currently the MacOS DEP screen does not support an AAD account which has MFA setup, it will just return unknown user account or unknown password. You might think that with Azure AD MFA there is the ability to use App Password’s for just this case, well that doesn’t work either. So if you want to use MacOS DEP you will need to have Azure AD MFA not enabled on the account.

For those of you who don’t have a DEP enrolled MacOS I’ve used the VM created in the last blog post to capture a video of the process, on the Intune side all that is being applied is a simple “User Affinity” policy, with all of the default pages still shown (you can pick and chose which screens you see), in addition to this I have locked the policy from being removed for what it is worth.

Note there is no Audio on the video

In the video you will note I have connected it to my AppleID, but you can skip that step if you don’t want to install applications from the Apple Store, it can also be suppressed by the admin in Intune as a simple process to block staff from having there AppleID assigned to the Mac.

Good Luck

Steve.