HomeServicesManaged IT ServicesAI DeploymentInsightsAnswersAboutFree Consultation
Intune & macOS Security

Apply a macOS Security Baseline with Intune and mSCP

Published Oct 28, 20266 min read
By Accred Consulting Microsoft 365 Practice | Company facts

Intune’s built-in macOS compliance settings cover common checks, but teams may need to evaluate controls from a recognized security baseline. Microsoft’s October 28 guide shows how to connect the NIST macOS Security Compliance Project (mSCP) to Intune custom compliance, so tailored macOS rules can produce device compliance signals for reporting and Conditional Access.

Rollout order matters: deploy and confirm the managed .mobileconfig profile before assigning the custom compliance policy. The mSCP discovery script uses settings from that profile; if the policy arrives first, its evaluation may fail.

What mSCP adds to Intune

mSCP helps administrators select and tailor macOS security rules from supported frameworks, then generates a compliance script and vendor manifest. Intune provides the evaluation and reporting mechanism: a discovery script returns device values, and a JSON file defines the settings and values Intune treats as compliant. Microsoft’s walkthrough adds a conversion script to transform the mSCP manifest into Intune’s custom compliance JSON format.

This is a way to translate a chosen baseline into measurable device checks. It does not mean every mSCP control becomes an Intune setting automatically, nor does a successful report certify a Mac against a framework. Your team still owns the selected rules, expected values, exceptions, and response to noncompliance.

Use a controlled pilot

  1. Choose and tailor a baseline. Start with the framework and rules that fit your organization. Exclude controls you cannot safely enforce, and record the baseline version and rationale.
  2. Generate and test locally. Follow the mSCP guidance to generate its compliance script and vendor manifest. Run the script’s check mode on a test Mac and review the selected rule values.
  3. Prepare the managed profile. Set the profile’s managed arguments to the generated audit file, then validate it on a test Mac. Remove temporary local test profiles before deployment to avoid conflicts.
  4. Deploy the profile first. Assign the .mobileconfig through Intune to a small pilot group and confirm it has installed on those devices.
  5. Configure custom compliance. Convert the vendor manifest to Intune JSON, upload the generated discovery script, and use the JSON in a macOS compliance policy. Check each identifier, data type, and expected value against the script output.
  6. Review results before enforcing access. Check per-setting results in Intune’s device compliance reports. Resolve missing values or mismatches with the pilot before using the policy result in Conditional Access.

Operational checks before wider deployment

  • Keep one discovery script and its JSON mapping together for each policy; Intune custom compliance policies support one discovery script, which can return multiple values.
  • Test the exact script and profile version you intend to deploy. Intune does not validate a discovery script’s syntax or logic when it is uploaded.
  • Align the JSON rule definitions with the script’s output. A name, type, or expected-value mismatch can prevent useful compliance evaluation.
  • Expand by device group only after the pilot reports stable per-setting results and the service desk has a remediation path for users whose Macs become noncompliant.

For administrators with managed Macs, the practical opportunity is to make a selected baseline visible in Intune’s compliance workflow. A small pilot, explicit rule ownership, and the correct profile-first sequence keep that additional visibility from turning into a preventable access interruption.

Microsoft sources

Need help applying an endpoint baseline? Accred’s Intune consulting team can help plan the pilot, compliance policies, and staged rollout.