Help, there’s a Mac on my network (7): where’s the image?

Episode 7 of the series Help, there’s a Mac on my network.

What happened

On Monday morning Marieke walked into the IT room with a big smile and a printed quote. “Good news! The work planners are getting Macs too. Five of them. They saw mine and now they all want one.” She put the printout on Ruud’s keyboard, right across the space bar, and was gone before he could say a word.

Ruud took a sip from his mug and thought about it. Five machines. He’d done this a hundred times. You build one perfect machine, you capture an image and you push it to the rest. That’s how he had rolled out laptops for twenty years, first with Ghost, then MDT, later SCCM. He grabbed a notepad and wrote at the top: “Golden image Mac”.

Two hours later the page still said only that. He had searched for a Mac version of sysprep. He had searched for a way to network boot a Mac. He had found a forum thread from 2014 where someone was very excited about a tool that had stopped working years ago. “In Windows that was just under Deployment Services,” he muttered.

Sam came in with two coffees and looked over his shoulder. “Golden image? For the Macs?”

“Yes. Build one good one, copy it, done.”

“Can I just?” Sam put the coffee down. “We don’t do that anymore. You actually can’t anymore. But the good news is, you don’t even have to take those five Macs out of the box.”

Ruud looked at the quote, then at Sam. “I’m listening.”

What’s really going on

Imaging used to be completely normal on the Mac, with tools like DeployStudio. But on Macs with Apple silicon the whole idea simply doesn’t work anymore. There are three reasons.

The system is sealed. Since macOS Big Sur the operating system lives on a Signed System Volume. That volume is cryptographically signed by Apple, and the Mac checks at startup that nothing has been changed. Baking your own macOS with preinstalled software is off the table.

Every Mac has its own keys. The Secure Enclave in the chip creates unique keys for each Mac. Internal storage is always encrypted with them, even without FileVault. A disk copied from one Mac means nothing to another one.

A Mac has to check in with Apple. After a reinstall, a Mac with Apple silicon is activated through Apple’s servers. That’s also where Activation Lock and organisation ownership are checked. A copied disk doesn’t skip that step.

So what replaces it? Something you already know as a Windows admin: Autopilot. Apple calls it Automated Device Enrollment, or ADE. The Mac comes out of the box factory fresh, gets online, Apple sees the serial number and says: “You belong to Bolderman, go report to their Intune.” Intune then handles the settings, the apps and the account. You don’t build an image anymore, you write a recipe. The Mac does the cooking.

How to fix it

1. Let the Macs land in Apple Business automatically

Buy the Macs from Apple or an Apple Authorized Reseller and give them your Apple Business organisation ID. The reseller then links the serial numbers to your organisation. The Macs show up in Apple Business under Devices on their own. There you assign them to your Intune server, or set a default so all new Macs go to Intune.

2. Create an enrollment profile in Intune

In the Intune admin center go to Devices, Device onboarding, Enrollment, Apple tab. Create an ADE profile for macOS there. Microsoft recommends:

• User affinity: enroll with user affinity.
• Authentication: Setup Assistant with modern authentication. The user signs in with their Microsoft 365 account during setup.
• Await final configuration: Yes. The Mac stays on a waiting screen until the important policies have arrived. Microsoft’s documentation says most devices in their testing were through in about fifteen minutes.
• Locked enrollment: Yes, so users can’t remove management themselves.

In the same profile you choose which Setup Assistant screens the user sees. Siri, Screen Time and Apple Pay can all be hidden. If you want people already signed in to Entra ID when they hit the desktop, Platform SSO can register during setup. That needs the Company Portal sent along as an app. Test that bit carefully.

3. Apps through Intune, not through an image

Everything you used to bake into your image now lives in Intune:

• Microsoft 365 apps: Intune has a ready-made app type for Office on macOS.
• PKG and DMG files: upload your own installers, just like a Win32 app.
• App Store apps: buy them through Apps and Books in Apple Business, even the free ones. Link that to Intune with a content token and assign the licences to devices. No personal Apple Account needed.

4. What about Blueprints?

Since this spring Apple Business also has Blueprints: a bundle of apps and configurations you assign to users, groups or devices. They belong to the built-in device management in Apple Business itself. If your company uses Intune, like Bolderman, do it all in Intune. Two captains on one ship never ends well.

5. Resetting a Mac: Erase All Content and Settings

When someone leaves, nothing needs reinstalling. Choose Wipe in Intune, or on the Mac itself go to System Settings, General, Transfer or Reset, Erase All Content and Settings. Because everything is already encrypted, the Mac simply throws away the keys. A few minutes later it’s factory fresh and checks straight back in with Intune.

6. Macs you bought somewhere else

Someone picked up a Mac at the local electronics store? With the Apple Configurator app on an iPhone you can still add it to Apple Business. Turn the Mac on and leave it at the country or region screen. Then scan the pattern on the screen with the iPhone. The Mac needs Apple silicon or a T2 chip, and it has to be erased. Note: for the first 30 days after enrollment the user can still release the device.

7. Keep Activation Lock under control

Activation Lock is the theft protection that ties a Mac to an Apple Account. A pain when a former colleague left their personal account on a company Mac. If the Mac is in Apple Business you turn Activation Lock off there, even if the user switched it on. One more reason to run every Mac through Apple Business.

On Friday five boxes were waiting at reception. Karin asked if Ruud wanted to unpack them first. “No need,” said Ruud, with the face of a man who had always done it this way. “Just hand them out.” By half past ten five work planners were in Teams. Sam watched from the doorway and said nothing. That was his moment, and he knew it.

Ruud’s lesson

For twenty years I was proud of my perfect image. Turns out the best image is the one you never have to build. You describe what a Mac should look like and the Mac sorts out the rest. I kept the notepad that says “Golden image Mac”. As a reminder. Next to my Windows 2000 certificate.

Read more: Apple Business, Entra ID and Intune for small businesses and Mac in a Windows network.

This is episode 7 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.