A Mac in a Windows company network: sign-in, network drives, printers and management

More and more people get a Mac at work, while IT thinks in domains, Group Policy and BitLocker. In this part of the series Mac and the rest of the world we look at how a Mac fits into a Windows-oriented network: signing in with your company account, network drives, printers, VPN, Wi-Fi with certificates, security and management. At the end you’ll find a translation table from Windows to Mac, a decision guide and a step-by-step plan.

Signing in with your company account: Platform SSO

On Windows you sign in with your company account because the PC is joined to Entra ID or the domain. On the Mac the equivalent is called Platform SSO. It’s an Apple framework, and Microsoft plugs into it with the Enterprise SSO extension in the Company Portal app. The Mac gets registered in Microsoft Entra ID and receives a Primary Refresh Token, just like a Windows PC. After that, Outlook, Teams, OneDrive and Entra ID websites stop asking for your password all the time.

When you set it up, you choose one of three methods:

• Secure Enclave: a key locked inside the Mac’s security chip. Microsoft recommends this method and compares it to Windows Hello for Business. It’s passwordless, phishing resistant, and the key can also act as a passkey in the browser. Your local Mac password does stay, because FileVault needs it to unlock the disk after a restart. After that, Touch ID takes over.
• Password: your Entra ID password is synced with your local account. One password for everything, which users like, but it isn’t passwordless.
• Smart card: sign in with a smart card or a compatible hardware key such as a YubiKey with a PIN. macOS 14 and later.

What you need: an MDM such as Microsoft Intune (other MDMs that support Platform SSO work too), the Company Portal app on the Mac and a configuration profile with the Platform SSO settings. For a serious rollout, plan on at least macOS 14. With Automated Device Enrollment through Apple Business, registration can now happen during Setup Assistant, so a new Mac is ready the moment the user reaches the desktop. Smart card doesn’t work in that phase yet.

How to connect Apple Business, Entra ID and Intune is covered in Apple Business, Entra ID and Intune for small businesses.

The old Active Directory binding

For years you joined a Mac to the domain through Directory Utility. Technically that still works, but I no longer recommend it, and almost every admin and vendor says the same. The reasons:

• You end up with so-called mobile accounts. Change your password while you’re away from the office and the domain password, your local password and the FileVault password easily drift apart.
• The Mac needs to see a domain controller. At home or on the road without VPN, that breaks.
• Binding has no MFA and doesn’t work with Entra ID or Conditional Access.
• Security updates on the Windows Server side have broken binding before, for example after the Kerberos changes around CVE-2021-42287.

Apple’s own deployment documentation says you don’t need to bind for Kerberos access and recommends local accounts.

Kerberos for your on-premises servers

Many Windows companies still run an on-premises Active Directory with file servers and internal web apps that use Kerberos. That’s what Apple’s Kerberos SSO extension is for. It gets a Kerberos ticket from your domain without the Mac being bound. Shares in Finder and intranet pages in Safari then open without a password prompt. It can also sync your local password with your AD password.

In a hybrid setup it goes one step further. Through Platform SSO, Entra ID can issue both a ticket for your on-premises AD and a cloud ticket, and these are handed to the macOS Kerberos stack. This requires Microsoft Entra Kerberos (Cloud Kerberos trust). If you already run Windows Hello for Business with Cloud Kerberos trust, that part is probably done. You need at least macOS 14.6 and a recent Company Portal.

Network drives

A mapped drive with a drive letter doesn’t exist on the Mac. You connect through Finder > Go > Connect to Server with an address like smb://fileserver.company.local/department. With Kerberos working, there’s no password prompt. To mount the share automatically at every login, add it as a login item, or have your admin set it up with a script through Intune. Intune has no built-in drive mapping setting like Group Policy does, so it stays a bit of custom work.

Honest advice: if your organisation is moving to Microsoft 365 anyway, SharePoint and OneDrive are often nicer on a Mac than an SMB share over VPN. More about SMB, speed and common problems in NAS and network drives on the Mac. How Outlook, Teams and OneDrive behave on the Mac is covered in Outlook, Teams and Microsoft 365 on the Mac.

All the details, from the right nsmb.conf to signing, encryption and the usual problems, are in Windows Server network shares on the Mac.

Printers

A Windows print server usually shares printers over SMB with Windows drivers. A Mac can print to those over SMB, but then you need a Mac driver from the manufacturer. It’s often simpler to print directly to the printer over IPP or AirPrint, if your security policy allows it.

Microsoft Universal Print works on the Mac too. You install the Universal Print app from the Mac App Store (macOS 14.6.1 or later), sign in with your Entra ID account and pick your printers. No extra licence is needed. Two caveats: for now users still have to pick the printers themselves, MDM can only push the app. And by default macOS asks for admin rights to add a printer; you can relax that with a profile. Not every printer is fully supported; Microsoft keeps a list.

VPN

Windows Always On VPN doesn’t exist on the Mac. The well-known vendors do have Mac clients: Palo Alto GlobalProtect, FortiClient, Cisco Secure Client (formerly AnyConnect) and WireGuard from the Mac App Store. Your admin installs and configures the client through MDM. macOS also supports per-app VPN: only certain apps or domains go through the tunnel. That only works if the VPN client supports it, so check with your vendor.

Wi-Fi with certificates (802.1X)

On Windows you usually roll out company Wi-Fi through Group Policy and a certificate from your own CA. On the Mac you do the same with configuration profiles: a trusted root certificate, a SCEP or PKCS certificate profile and a Wi-Fi profile with EAP-TLS. Intune Cloud PKI or your existing AD CS with the Intune Certificate Connector can issue the certificates. Use the device channel for device certificates, otherwise the Mac only connects after someone logs in.

Security and compliance

Microsoft Defender for Endpoint runs on the Mac and supports the three most recent macOS versions, currently macOS 27 Golden Gate, 26 Tahoe and 15 Sequoia. Push the system extensions and Full Disk Access through MDM in advance.

The equivalent of BitLocker is FileVault. Intune can enforce FileVault and escrow, rotate and show the recovery key to admins for devices marked as corporate. For personal devices the admin can’t see the key.

For Conditional Access, the Mac has to be enrolled in Intune and registered in Entra ID. A compliance policy then checks things like macOS version, FileVault, firewall and System Integrity Protection. If the Mac isn’t compliant, Entra ID blocks access to Microsoft 365.

Group Policy becomes configuration profiles

What is Group Policy or an Intune policy on Windows is a configuration profile on the Mac. In Intune you build those in the settings catalog. There’s also Declarative Device Management, where the Mac applies settings itself and reports its status back. For macOS updates that’s the recommended route.

Local admin rights

Intune has its own version of LAPS for the Mac. When a Mac enrolls through Automated Device Enrollment, Intune creates a local admin account with a random 15-character password. By default that password rotates every six months, and admins with the right role can view it or rotate it manually. It only works for new enrollments after a factory reset, so existing Macs have to be set up again. The user gets a standard account.

Remote support

Microsoft Remote Help works on the Mac, with full control through the Mac app or view only through the web version. Set up the Accessibility and Screen Recording permissions through MDM in advance. Alternatives are TeamViewer or the built-in Screen Sharing in macOS.

Translation table: Windows to Mac

Which approach fits you?

• You’re fully cloud with Entra ID and Intune. Go for Platform SSO with Secure Enclave, FileVault through Intune, a compliance policy and Conditional Access. Files in SharePoint and OneDrive. This is the easiest situation.
• Hybrid: Entra ID plus on-premises file servers. Platform SSO plus Kerberos SSO through Entra Kerberos. Look at which shares you can move to the cloud over time.
• On-premises AD only, no Entra ID. Use local accounts with Apple’s Kerberos SSO extension and an MDM of your choice. Don’t bind.
• A few Macs without MDM. Then you miss almost everything in this article. Start with Apple Business and an MDM, even for five Macs.

Step-by-step plan

1. Set up Apple Business and connect it to Entra ID and your MDM.
2. Assign the Macs to your MDM so they enroll automatically at first startup.
3. In the enrollment profile, configure the local admin account with LAPS and a standard account for the user.
4. Deploy Company Portal and a Platform SSO profile, preferably with Secure Enclave.
5. Add Kerberos SSO if you still have on-premises servers.
6. Turn on FileVault with recovery key escrow.
7. Distribute certificates and profiles for Wi-Fi and VPN, plus the VPN client itself.
8. Install Defender for Endpoint with its profiles.
9. Handle printers through Universal Print or directly over IPP, and mount network drives where needed.
10. Create a compliance policy and start Conditional Access in report-only mode.
11. Test everything with a few pilot users, including a password change and a restart at home.

And with Apple?

In 2026 a Mac fits fine into a Windows network, as long as you don’t treat it like a Windows PC. Platform SSO, Kerberos SSO and Declarative Device Management are Apple’s own technologies, and Microsoft builds on them. With Apple Business and Automated Device Enrollment you get the Mac under management just as tightly as a PC with Autopilot. The weak spots are old habits: drive letters, print server drivers and bound Macs. Clean those up and users notice little difference from colleagues on Windows.

This whitepaper describes the situation in October 2026 with macOS Golden Gate (macOS 27), Apple Business and the current versions of Microsoft Intune, Entra ID and Defender. Microsoft regularly changes its macOS support. Always check the current documentation from Microsoft and Apple before making major changes.

Need help setting this up for your organisation? Email frank@analystict.nl.

This article is part of the Mac and the rest of the world series, where you’ll find every part in one place.