macOS Direct Enrollment in Microsoft Intune: Shared Devices, ACME and ADE

Estimated reading and study time: 20–30 minutes. Allow time to review 16 slides, inspect the evidence and absorb the concepts. This estimate excludes reproducing the procedures and waiting for installation, synchronization or policy delivery.

This conceptual guide explains macOS Direct Enrollment in Microsoft Intune for shared corporate devices without user affinity. It introduces the enrollment prerequisites, management profile workflow, ACME certificates, application limitations, supervision and the comparison with Automated Device Enrollment. Use it to decide what this enrollment method is intended to accomplish before following a lab.

The slides explain concepts and prerequisites; they do not document a completed deployment. Enrollment, user registration, application compatibility and encryption require their own checks in the environment being assessed. Review the current vendor requirements alongside the documentation reviewed for this November 2026 guide.

Related learning: See the concepts applied in LAB-MAC-01: Direct Enrollment, device rename and policy validation. For the additional identity layer, continue with LAB-MAC-02: Platform SSO and Kerberos, which separates registration, browser access and AD file-share access.

Official documentation: Read Microsoft’s Direct Enrollment guidance for the supported workflow and ACME prerequisites, and Apple’s Platform Deployment guide for enrollment, supervision and management background. For the identity extension, consult Microsoft’s Platform SSO configuration guide. A conceptual guide to enrolling shared corporate Macs in Microsoft Intune without user affinity. The slides cover prerequisites, profile creation and installation, ACME certificates, application limitations, macOS supervision and the differences from Automated Device Enrollment. Based on Microsoft Intune and Apple documentation reviewed in November 2026.