How to AD Bind Mac Devices easily with Intune

Hi there! Today let’s talk about how you can AD Bind Mac devices easily with Microsoft Intune a.k.a Microsoft Endpoint Manager.

Table of Contents

Prologue

The fun part of working on projects is the opportunity to face new challenges which makes us go back to our lab.

Recently while working on one such project which involves Mac management using Intune natively (no JAMF), I came across a similar situation.

Client Requirement – End-user to be able to sign-in to company-provided Mac devices using their corporate credentials.

Now JAMF solves this with JAMF Connect which allows provisioning a Mac device with a cloud identity and you can also configure if the account provisioned should have local admin rights or not. (Similar to Windows Autopilot experience)

Then there is JumpCloud, an open cloud directory platform with unified endpoint management capabilities, which has its own way of provisioning a Mac with JumpCloud managed identity.

Lastly, there is Apple Business Manager with Federated Authentication support which allows end-users to sign-in to ADE (a.k.a DEP) provisioned Mac devices using their Azure AD credentials.

What if you are not using either of the three as mentioned above?

The only option then that you are left with is to bind those Mac devices to Active Directory to let end-users sign-in using their corporate AD credentials.

But there is still one more problem left…

Microsoft Intune does not have any native configuration to bind Mac devices to Active Directory.

However, it is not entirely impossible! So let’s get started.

What is Directory Binding in Mac?

For a simpler understanding, AD Binding a Mac is essentially the same as what Domain Join is for Windows.

The immediate benefits to this are:

Users can use their AD account to sign-in to their Mac devices
Users can use the same AD credentials to authenticate and gain authorization to secure resources
Users are subjected to the organization’s domain password policies

Why and When to bind Mac devices to Active Directory?

Let’s start with an analogy to Windows 10 in enterprise landscape as a reference.

Windows 10 has the ability to join to

Active Directory (for enterprise with on-premise infrastructure), or
Azure Active Directory (for cloud-only setups), or even do a
Hybrid Azure AD Join during initial setup.

Windows 10 provisioning for enterprise use-case using Windows Autopilot lets you further decide if the end-user account to be provisioned on the device should be a standard user or have local admin rights.

This ensures a single identity, that is either created in

on-premise active directory,
on-premise active directory and synced to Azure AD, or
cloud only created in Azure AD

is used for both accessing the device as well as corporate applications, thereby eliminating the need for multiple accounts – a local account on the device to sign-in to the device itself and then using the corporate identity to access corporate resources.

This benefits the end-user with a streamlined device login experience with a single set of credentials that conforms to the organization restriction policy and can also be easily managed.

However, unlike Windows 10, a Mac device cannot be cloud joined to Azure Active Directory.

Without the involvement of any other tools (ref: JAMF with JAMF Connect or Apple Business Manager with Federated Auth and ADE provisioning), by default, you cannot use a corporate cloud identity to provision a Mac device.

Thus without a streamlined device provisioning process in place that supports the idea of a single identity, the general provisioning of Mac involves the creation of a local administrator account for the user setting up the device for the first time (similar to Windows 10).

The local account is the one that the end-user uses to sign-in to the Mac device and then follow the company instruction to bring the device into a managed state, post which, the SSO solution as implemented takes care of the user accessing corporate resources on the device.

Here you can cearly see the involvement of the two seperate accounts

an unmanaged local account (that’s also a local admin) on the Mac used to sign-in to the device itself, and
a managed corporate account that is used to access corporate resources.

The above scenario is quite similar to what we have in Windows 10 in the form of Azure AD Registration [for BYOD], where the end-user signing-in to the Windows 10 device can be a local account or an online personal Microsoft account (local admin) and then the user adds a work account to get access to corporate resources on the device.

Though you do have SSO solutions available for different IDPs that can be implemented to allow end-users to have access to corporate resources from a managed Mac without requiring any additional work by the end-user (the recommended way!), it still does not addresses the actual point – having a single identity.

This is when you decide whether you would want AD Bind your Mac devices or not.

Disclaimer: AD Binding a Mac should be the last resort that you would take to achieve the idea of having a single identity to use Mac devices in the corporate landscape due to the complexities involved and the additional overhead it demands from the IT Support Team in terms of troubleshooting and fixes.

If you decide to go ahead, then read below to know how you can AD Bind Mac devices easily with Microsoft Intune.

But before we get to that, you need to know…

What are the ways to bind a Mac to Active Directory?

As a Mac administrator, you can manually AD Bind a Mac using the Directory Utility Tool (GUI) and steps for the same are already explained by Prajwal Desai in his blog post.

Bind Mac device to Active Directory using built-in Directory Utility tool (GUI)

Or, you can use the Terminal if you prefer command line. [Ref: dsconfigad].

Sample Command Format:

dsconfigad -f -a <Computer Name> -u <Service Account> -p <Password> -domain <FQDN> -ou <OU to which this Mac will be added> -preferred <FQDN of preferred DC> -mobile enable

Bind Mac device to Active Directory using Terminal (CLI)

However, both of the above methods as shown are manual which makes it difficult to scale Mac provisioning. However, the use of a Configuration Profile with MDM Directory payload helps to automate AD Binding Macs.

The Configuration Profile can be deployed manually to configure a single Mac or can be distributed via an MDM solution like Microsoft Intune to automate AD Binding of multiple managed Mac computers at once.

The Configuration Profile (.mobileconfig) can be created using Profile Manager which is part of the MacOS Server (paid app!) available in the Apple Store.

If you are intending to leverage complete Mac management using Microsoft Intune, you can use the Profile Manager to easily create Configuration Profiles (.mobileconfig) referencing the different MDM Payload settings available and then repurpose those configurations profiles to be distributed by Microsoft Intune as custom config profiles.

This can prove to be a great workaround to overcome the limitations in terms of features and manageability when it comes to Mac management with Intune.

This is exactly what this blog post will show you today.

Don’t worry. To save you from the cost of purchasing the MacOS Server for maybe a one-time use for testing purposes, this blog post includes a sample XML profile which you can use for free!

How you can AD Bind Mac devices easily with Microsoft Intune

Let’s start by checking the pre-requisites to AD Bind Mac with Intune.

Pre-requisites to AD Bind Mac with Intune

An Organizational Unit (OU) in your AD to store Mac computer objects.
Service account in AD which has rights to create, rename computer objects in specified OU.
Connectivity to Domain Controller from the Mac device(s).
Microsoft Endpoint Manager tenant with
- MDM authority set to Microsoft Intune, and
- Apple enrollment enabled and in Active state.
Enrolled Mac device.