News
Help, there’s a Mac on my network (1): the boss has a MacBook
Episode 1 of the series Help, there’s a Mac on my network.
What happened
Monday morning, quarter past eight. Ruud had just settled in behind his screen with his mug (“Have you tried turning it off and on again?”) when Marieke walked in. Under her arm: a white box. On her face: the look of someone who has just been to a conference.
“Ruud, I bought a MacBook Air. Everyone had one. I’ve got a good feeling about it. Can it go on the network today? And Outlook? And Teams?”
Ruud put down his coffee. Twenty years of Windows. He had survived NT4, Vista, and the day someone rebooted the print server in the middle of a payroll run. He could handle this.
Ten minutes later he was staring at a screen with no Start button. “Where’s the right mouse button?” He clicked again. Nothing interesting happened. He closed a window with the red dot in the top left and watched, puzzled, as Safari just kept running, with a little dot under its icon at the bottom of the screen. “In Windows that was just under the X…”
Sam wandered past with a sandwich and glanced over his shoulder. “Can I just…?” Two fingers on the trackpad, tap. A menu. “There. And Command is your Ctrl, mostly.”
Marieke beamed. “See? It’s easy.”
“Have you set it up already?” Ruud asked carefully.
“Yes, last night at home. With my own Apple account. My photos are already on it.”
Ruud looked at Sam. Sam looked at Ruud. There was a silence of the kind you only hear when someone says they “tweaked something in the firewall, just quickly”.
What’s really going on
Two things are happening here. The first is unfamiliarity, and that’s gone after an afternoon. A Mac isn’t harder than Windows, just different. The menu bar always sits at the top of the screen and belongs to whichever app is active, not to the window. The Dock at the bottom is your taskbar and quick launch in one. Finder is your File Explorer. System Settings is Control Panel and Settings rolled into one place. And Command+Space opens Spotlight, which finds apps, files and settings without you needing to know where they live. The idea that an app keeps running when you close its last window takes a moment, but it makes sense: you closed a document, not the program. To actually quit, press Command+Q.
The second thing is the real problem. This MacBook belongs to the company, but it has been set up as a personal device. No management, no FileVault key in your management console, no compliance, no way to wipe it remotely when it gets left on a train. In Windows terms: someone took a laptop out of the box, created a local account and is now asking if you can “just pop it into the domain”. You can, but you want to do it properly.
On the Mac the proper route is called Automated Device Enrollment (ADE). If the Mac was bought through a reseller linked to your Apple Business account, it shows up there automatically. You assign it to Intune, and the moment someone switches it on, Setup Assistant (the first-boot setup screens) walks straight into your enrollment. Think Autopilot: out of the box, sign in, done, and managed.
Then there’s the account question. A Managed Apple Account belongs to the organisation. It’s created in Apple Business and can be federated with Microsoft Entra ID, so people sign in with their work credentials. A personal Apple Account is Marieke’s own, with her photos and her iCloud. Keep those two apart. Work data doesn’t belong in a personal iCloud, and holiday photos don’t belong in your management console.
How to fix it
First the basics: how to drive it
| In Windows | On the Mac |
|---|---|
| Right mouse button | Tap the trackpad with two fingers, or Control+click |
| Ctrl+C, Ctrl+V, Ctrl+Z | Command+C, Command+V, Command+Z |
| X in the top right closes the program | Red dot in the top left closes the window, Command+Q quits the app |
| Taskbar and Start menu | Dock at the bottom, menu bar at the top |
| File Explorer | Finder |
| Settings and Control Panel | System Settings |
| Windows key and type | Command+Space (Spotlight) |
| Alt+Tab | Command+Tab |
| Ctrl+Alt+Del, Task Manager | Command+Option+Esc (Force Quit), or Activity Monitor |
Then the real work: enrollment
- Find out where the Mac was bought. Through an Apple Authorised Reseller, or from Apple directly in the company’s name, with your Apple Business customer number attached? Then check Apple Business for the serial number. If it’s there, assign it to your Intune MDM server and make sure an ADE enrollment profile is ready in Intune.
- Not bought through a linked reseller? Then you can still add it to Apple Business with Apple Configurator for iPhone. Apple’s requirements: a Mac with Apple silicon or a T2 chip, macOS 12.0.1 or later, iOS 16 or later on the iPhone, and a Mac that is still sitting in Setup Assistant. You stop at the Select Your Country or Region screen, scan the animation on the Mac with the iPhone (or pair manually with a six-digit code), and the Mac appears in Apple Business. Apple then gives a 30-day provisional period during which the user can remove the Mac from management themselves. Assign it to Intune first, and only then continue with setup.
- But Marieke already set it up. Exactly. For ADE and Configurator the Mac has to go back to Setup Assistant, so it needs wiping first. Have her make sure her photos are safely in iCloud, then go to System Settings > General > Transfer or Reset > Erase All Content and Settings. That’s a quarter of an hour, not an afternoon of reinstalling.
- Wiping really can’t happen today? Then there’s the no-wipe route: user-initiated enrollment through Intune Company Portal. Marieke installs the package, signs in with her work account, installs the management profile and approves it in System Settings. Be aware: Microsoft doesn’t recommend this for organisation-owned devices, and the device is marked as personal by default. You can add the serial number as a corporate identifier, but you lose supervision and the profile isn’t locked down as firmly. Treat it as a temporary plaster and schedule the proper re-enrollment.
- Sort out the accounts. Work runs through her Microsoft 365 account and, where Apple services are needed, a Managed Apple Account. She can keep her personal Apple Account for the App Store and her own things, but agree that work files live in OneDrive or SharePoint, not in iCloud Drive.
Day one checklist
- Serial number checked in Apple Business, assigned to Intune.
- Enrollment done, device visible as corporate in Intune.
- FileVault on, recovery key escrowed in Intune.
- Company Wi-Fi delivered as an Intune profile, not as a password on a sticky note.
- Microsoft 365 apps, Teams and Company Portal deployed, user signed in.
- User is a standard user, or you made a conscious choice to give admin rights.
- Updates handled by an Intune policy, so the boss isn’t three versions behind.
- Five minutes of explanation: right-click, Command+Q, Spotlight. Saves you five phone calls.
Ruud’s lesson
A Mac is like a new colleague: after one afternoon you know where the coffee is, but you don’t let them into the building without a pass. Learn the buttons in an hour, and give the enrollment a proper day. That’s not distrust. That’s management.
Further reading: Apple Business, Entra ID and Intune for small businesses, Outlook, Teams and Microsoft 365 on the Mac and Switch to Mac.
This is episode 1 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.