Architecture — macOS ABM to Intune

Status boundary

This project uses three explicit implementation states:

REAL CONFIGURATION — actually configured or directly validated in the real Microsoft Intune tenant.
SIMULATED / DOCUMENTED — accurately designed and documented, but not executed because the required Apple infrastructure or managed macOS endpoint is unavailable.
NOT VALIDATED — a Microsoft-side policy may exist, but endpoint behavior was not tested on an enrolled Mac.

Intended enterprise flow

Authorized reseller / Apple procurement
        │
        ▼
Apple Business Manager
        │
        │ device assignment to MDM server
        ▼
Microsoft Intune MDM server
        │
        │ Enrollment Program Token
        ▼
Automated Device Enrollment
        │
        ▼
macOS Setup Assistant
        │
        ▼
Microsoft Entra authentication
        │
        ▼
Microsoft Intune enrollment
        │
        ├───────────────┬────────────────┬────────────────┐
        ▼               ▼                ▼                ▼
Configuration       Applications      Compliance       Security
profiles                                                controls
        │               │                │                │
        ├─ Platform SSO │                │                ├─ FileVault
        ├─ Wi-Fi / PKI  │                │                └─ Firewall
        └─ restrictions │                │
        └───────────────┴────────────────┴────────────────┘
                                │
                                ▼
                    Inventory + lifecycle
                                │
                  ┌─────────────┼─────────────┐
                  ▼             ▼             ▼
                Retire         Wipe       Reassignment

Apple service boundary

Apple Push Notification service — REAL CONFIGURATION

A real Apple MDM Push certificate was created in Apple's Push Certificates Portal using the Intune-generated CSR and uploaded back to the Intune tenant.

Validated state:

Vendor: Microsoft Corporation.
APNs certificate created successfully.
Intune upload completed successfully.
Certificate expiration: 2027-09-26.

The Apple account used to own the certificate is intentionally excluded from public evidence.

Apple Business Manager — SIMULATED / DOCUMENTED

No Apple Business Manager organization is available in the lab. Therefore, the following are not represented as implemented:

organization verification;
reseller/device assignment;
MDM server creation in ABM;
ABM server token issuance;
Enrollment Program Token import;
ADE device sync;
ADE profile assignment;
Setup Assistant ADE behavior.

Microsoft service boundary

Microsoft Intune — REAL CONFIGURATION

The real tenant was used to create or inspect:

Apple enrollment administration;
macOS compliance policy;
macOS FileVault Settings Catalog profile;
macOS enrollment restrictions;
Platform SSO settings;
enterprise Wi-Fi settings;
SCEP certificate settings;
macOS application types;
macOS inventory;
macOS bulk device lifecycle actions.

Microsoft Entra ID

Microsoft Entra is the intended identity provider for Company Portal enrollment and Platform SSO. Endpoint Platform SSO registration is NOT VALIDATED because there is no enrolled macOS endpoint.

Real vs. simulated matrix

Component	Classification	Evidence / boundary
Intune tenant access	REAL CONFIGURATION	Real portal configuration captured
APNs certificate	REAL CONFIGURATION — COMPLETE	Created in Apple portal; uploaded to Intune
ABM organization	SIMULATED / DOCUMENTED	No ABM organization available
Enrollment Program Token	SIMULATED / DOCUMENTED	Intune creation workflow inspected only
ADE	SIMULATED / DOCUMENTED	Requires ABM + eligible device
macOS compliance policy	REAL CONFIGURATION — COMPLETE	Policy created in Intune
Compliance enforcement	NOT VALIDATED	No enrolled macOS endpoint
FileVault policy	REAL CONFIGURATION — COMPLETE	Settings Catalog profile created
FileVault encryption on endpoint	NOT VALIDATED	No enrolled macOS endpoint
Recovery-key escrow	NOT VALIDATED	No enrolled macOS endpoint
Platform SSO capability	REAL CONFIGURATION — VALIDATED	Settings exposed in Intune
Platform SSO endpoint registration	SIMULATED / DOCUMENTED	No managed Mac
Enterprise Wi-Fi capability	REAL CONFIGURATION — VALIDATED	Enterprise profile surface inspected
WPA2-Enterprise + EAP-TLS	SIMULATED / DOCUMENTED DESIGN	No RADIUS/PKI deployment
SCEP certificate capability	REAL CONFIGURATION — VALIDATED	SCEP profile surface inspected
Certificate issuance	SIMULATED / DOCUMENTED	No live enterprise PKI/SCEP service
macOS application deployment capability	REAL CONFIGURATION — VALIDATED	Supported app types inspected
Application installation	NOT VALIDATED	No managed Mac
macOS inventory	REAL CONFIGURATION — VALIDATED	Inventory page available; 0 Macs enrolled
Retire / Wipe / Delete / Restart / Rename / Sync	REAL CONFIGURATION — VALIDATED CAPABILITY	Actions exposed; none executed
Device reassignment	SIMULATED / DOCUMENTED	No enrolled Mac
Lost/stolen workflow	SIMULATED / DOCUMENTED	Operational procedure only

Enterprise Wi-Fi design

The intended secure WLAN model is:

macOS device
   │
   ├─ trusted root certificate
   ├─ SCEP/PKCS device certificate
   │
   ▼
WPA2-Enterprise / EAP-TLS
   │
   ▼
RADIUS / network policy service
   │
   ▼
Enterprise wireless network

The Intune tenant exposed WPA-Enterprise, WPA2-Enterprise, EAP-FAST, EAP-SIM, EAP-TLS, EAP-TTLS, LEAP, and PEAP. EAP-TLS is the documented design because it supports certificate-based device authentication without depending on user passwords for Wi-Fi access.

Security design principles

Require FileVault encryption.
Prevent users from disabling FileVault after policy enforcement.
Escrow the personal recovery key to the management service when a managed Mac exists.
Require System Integrity Protection.
Require password-protected unlock.
Enable firewall and Stealth Mode.
Preserve Gatekeeper restrictions.
Prefer certificate-based enterprise Wi-Fi.
Keep APNs renewal ownership documented.
Separate destructive lifecycle operations from routine sync/restart actions.
Never publish recovery keys, token contents, credentials, or certificate private material.