Enroll a Personal Mac in Intune (BYOD with Company Portal)

This is Alex’s Mac: Alex’s photos, music and messages. Nobody at work paid for it. But on Monday, Alex needs work email, Teams and company files on it. So how do you let a personal Mac into your company without taking it over? This guide does it for real in an Intune lab tenant.

BYOD on a Mac: two ideas first

Ownership decides the route. A company Mac bought through Apple Business enrolls itself the first time it’s switched on (Automated Device Enrollment). A personal Mac is already set up and was never bought by the company, so it enrolls through the Company Portal app. Intune calls this device enrollment. There’s no separate User Enrollment for Macs like there is on iPhone.

The management profile is the link. At the end of enrollment, Intune hands the Mac a small profile that it uses to send settings, check compliance and deliver apps. Apple never lets it install silently: the user approves it in System Settings with the Mac’s password. That’s why every Mac enrollment in Intune is user-approved.

On macOS 11 and later, Intune turns on supervision for these Macs too. A personal Mac showing as supervised is expected, and it’s still marked as personal.

Four checks before you enroll

All four are in the Intune admin center.

1. Apple MDM push certificate. Devices > macOS > Enrollment > Apple MDM Push Certificate. Status should be Active. It lasts one year, so watch the days to expiration, and renew it with the same company Apple account that created it.
2. License. Alex needs at least an Intune Plan 1 license. Open the user, then Licenses, and check the plan’s service list includes Intune. See Microsoft Learn for which plans include it.
3. Device platform restrictions. In the lab there’s only the default policy. In its properties, macOS is allowed and Personally owned is allowed. If personal Macs were blocked here, enrollment would stop at the start. Intune treats every Mac as personal unless its serial number is registered as a corporate identifier or it came through Automated Device Enrollment.
4. Device limit. It caps how many devices one person can enroll, from 1 to 15 (5 in this lab). If Alex already has five devices, the Mac would be number six and the enrollment bounces. Microsoft Entra has its own device limit, which can cap it lower.

Two optional extras

Neither is required to enroll a Mac. They’re here to show how Intune evaluates a personal Mac.

A compliance policy. macOS > Compliance holds a policy called macOS BYOD, Disk Encryption with one rule under System Security: require encryption of data storage on the device (FileVault on a Mac). If it fails, the device is marked noncompliant immediately. It’s assigned to All Users in the lab; in production you’d test on a pilot group first.

A compliance policy only reports. It doesn’t switch FileVault on and it doesn’t block anything by itself. Blocking is Conditional Access’s job, in Microsoft Entra: Outlook can ask “is this device compliant?” before letting Alex in.

An enrollment notification. A management profile on a personal Mac makes people nervous, so send an email when enrollment starts. macOS > Enrollment > Enrollment notifications > Create: name it, switch on the email, add a subject and message (a push to Company Portal is also an option). The header can show your logo and the footer your company name, help desk contact and device details, taken from the tenant’s Customization settings. Device details are off by default because they can slow the email down. Assign it and create.

What can IT see on a personal Mac?

Microsoft publishes the list. IT can see the owner, the device name, model and manufacturer, the serial number and the macOS version. On a personal device, the app inventory covers only managed apps, the work apps delivered through Company Portal.

IT can’t see browsing history, email and messages, contacts, calendar, passwords, photos or what’s inside documents. The location of a personal Mac stays private too. Company Portal shows this list before anything is installed.

Enrolling the Mac

1. On the Mac, System Settings > General > Device Management shows no profiles. Check the macOS version: Intune supports the three most recent releases (macOS 15 and later when this was recorded).
2. Company Portal isn’t in the App Store. Microsoft’s Enroll your Mac page links to the installer. Download and run the package.
3. Open Company Portal and sign in with the work account (password, then the authenticator code).
4. On Set up access, select Begin. Read the privacy screen: what the organization can’t do on one side, what it can on the other.
5. Select Download profile. The profile waits in System Settings > Device Management. Open it, review it, install it and enter the Mac’s password.
6. The management profile is installed, with two Intune MDM agent profiles next to it.
7. Back in Company Portal, the last step checks device settings. With the compliance policy above, one action item appears: turn on device encryption. How to resolve this opens Apple’s FileVault guide, and Retry runs the check again.

Confirming in Intune

• In Company Portal, the Mac has its own page: not compliant (that one item), ownership Personal. The user can check status, rename the device or remove it, which takes the Mac out of Intune.
• In the admin center, refresh macOS devices: the Mac is managed by Intune, ownership Personal, noncompliant, with the signed-in account as primary user. Match the serial number with About This Mac, because device names aren’t always clear.
• A Supervised badge appears, which is expected for user-approved Macs on macOS 11 and later.
• The notification email arrives with the time, macOS version, serial number and device name.

That’s the whole journey: a personal Mac, enrolled through Company Portal, with the user approving each step and Intune listing it as Personal. Does your company let people use their own Macs for work? Tell me in the comments.