Admin By Request for Mac deployment with Intune

Updated October 2026

Admin By Request for Mac is now version 5.x. It officially supports macOS 14, 15 and 26 and adds a system extension. Intune supports macOS 15 and later (macOS 13 and 14 can still enroll).
Before you deploy the package, deploy Admin By Request's EPM configuration profile as a custom profile. It approves the system extension and background items and grants Full Disk Access (Team ID AU2ALARPUP).
The Free Plan now includes 25 endpoint privilege management seats and 25 Secure Remote Access seats. The .pkg from the Admin By Request portal is already signed, so Intune deploys it as a macOS LOB app as is, without the App Wrapping Tool.

Screenshots are from July 2022 and show version 3.2 and the old Microsoft Endpoint Manager admin center. Source: Admin By Request Mac Client: Install / Uninstall

Platforms: macOS
Products: IntuneAdmin By Request
Result: Users on managed Macs become standard users and request audited, time-limited admin sessions

Overview

Remove local admin rights on Intune-managed Macs without blocking users: deploy the signed Admin By Request package and its configuration profile with Intune, so users request temporary admin sessions instead.

Admin By Request is a Privileged Access Management (PAM) solution for Windows, Mac and Linux devices. Admin By Request 3.2 for Mac brings many features and behaviours known from the Windows client:

Application Blocklisting (previously Blacklisting) is back in Admin By Request 3.2, now with the option to block apps by vendor in your User Portal.
The Break Glass / LAPS replacement feature covers situations such as someone without sign-in credentials needing to service the endpoint. It provisions a temporary local administrator account that must be used within an hour. When it expires, the account is forcibly signed out and removed.
For the current Mac features, see the Admin By Request Mac Client documentation.

Microsoft Intune can natively deploy signed packages (.pkg), including the Admin By Request for Mac client. Once installed, the client can revoke local administrator rights from the user account that was used to enroll the device. Deploying Admin By Request to Intune-managed Macs is as easy as it should be: Intune hosts the app package, so no remote servers, install scripts or third-party software management tools are needed.

Prerequisites

Before you start, check that you have the following.

What you need

checked 10/2026

Area	What you need	Docs
Licence	Microsoft Intune Plan 1	Licensing
Licence	An Admin By Request paid plan, or the Free Plan with 25 endpoint seats	Free Plan
Admin role	Application Manager and Policy and Profile Manager in Intune, to add the app and the custom profile	Roles
Admin role	Admin access to your Admin By Request portal, to download the package and change Mac settings	Portal
Intune	Apple MDM push certificate in Intune and Macs enrolled in Intune	APNs
Intune	Admin By Request connected to Microsoft Entra ID and Intune optional, see my post integrate Admin By Request with Microsoft Entra ID & Intune
Devices	macOS 14, 15 or 26 (officially supported by Admin By Request 5.x)Intune supports macOS 15 and later; macOS 13 and 14 can still enroll.	ABR Intune

Configuration

With the prerequisites in place, prepare the package and Mac settings in Admin By Request, then deploy the profile and the app with Intune.

Step	Console	What you set
3.1	Admin By Request	Mac settings and the signed package
3.2	Intune	Custom profile: system extension, background items, Full Disk Access
3.3	Intune	macOS LOB app with the right bundle ID

Prepare Admin By Request

Admin By Request portal

A signed package (in 2022, Admin By Request 3.2.0.pkg), ready for mass deployment, is available under Download in your Admin By Request tenant (adminbyrequest.com):

Admin By Request for Mac deployment with Intune - screenshot 1

Configure Mac Settings and Mac Sub Settings to suit your needs:

Admin By Request for Mac deployment with Intune - screenshot 2

Revoke admin rights from the user when the ABR client is installed on a Mac:

Admin By Request for Mac deployment with Intune - screenshot 3

Deploy the Admin By Request configuration profile

Intune admin center

Update (October 2026): Admin By Request 5.x needs an approved system extension, background items and Full Disk Access. Download Admin By Request – EPM.mobileconfig from the Admin By Request MDM installation guide and upload it in Intune as a custom profile for macOS (Templates > Custom). Assign it before the app. If you use Secure Remote Access, also deploy Admin By Request – SRA.mobileconfig. If you deployed the old FDA and System Extension profiles, remove them first.

The key values in the profile:

Team ID: AU2ALARPUP
System extension: com.fasttracksoftware.adminbyrequest.extension

Add the app to Intune

Intune admin center

See How to add macOS line-of-business (LOB) apps to Microsoft Intune.

Important: For correct install reporting in Intune, remove any additional App bundle IDs and leave only com.fasttracksoftware.adminbyrequest.

Admin By Request for Mac deployment with Intune - screenshot 4

You can find the values for App bundle ID (CFBundleIdentifier) and App version (CFBundleShortVersionString) in the installed ABR client, in /Applications/Admin By Request.app/Contents/Info.plist:

defaults read "/Applications/Admin By Request.app/Contents/Info.plist" CFBundleIdentifier
defaults read "/Applications/Admin By Request.app/Contents/Info.plist" CFBundleShortVersionString

Example output (version 3.2.0 in 2022):

com.fasttracksoftware.adminbyrequest
3.2.0

Admin By Request 3.2 installed and reported successfully in 2022:

Admin By Request for Mac deployment with Intune - screenshot 6

User Experience

Finally, sign in on a Mac and request admin rights.

This one-minute video shows admin rights being revoked from a local administrator on an Intune-managed Mac with macOS 12. After the Admin By Request 3.2 for Mac client is installed, the user requests a temporary 15-minute admin session to finish their work on the device.