Bind (Join) macOS to Active Directory domain with Intune

Platforms

macOS

Products

IntuneActive Directory

Result

The Mac joins the Active Directory domain and domain users can sign in, also offline with mobile accounts

Overview

Bind Macs to an on-premises Active Directory domain with a configuration profile from Intune, and let domain users sign in with cached mobile accounts.

Mac administrators can bind a Mac to an Active Directory domain manually with Directory Utility, or with the dsconfigad command in Terminal or a script.

You can also use a configuration profile with the Active Directory (Directory Service) payload and distribute it with an MDM service such as Microsoft Intune. One profile can bind a single Mac or automate the binding of hundreds of computers.

In 2021 I created the profile in Profile Manager, part of the macOS Server app, and edited it in an XML editor. In this post I bind a Mac to Active Directory with that profile deployed from Intune.

Prerequisites

Before you start, check that you have the following.

For a test you can use a virtual Mac. The Active Directory payload in Profile Manager in 2021:

Configuration

Prepare the profile first, then deploy it from Intune.

Prepare the configuration profile

Here is my configuration profile (.mobileconfig) with the Active Directory payload (com.apple.DirectoryService.managed). The settings are described in Directory Service payload settings:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>ADAllowMultiDomainAuth</key>
			<true/>
			<key>ADAllowMultiDomainAuthFlag</key>
			<true/>
			<key>ADCreateMobileAccountAtLogin</key>
			<true/>
			<key>ADCreateMobileAccountAtLoginFlag</key>
			<true/>
			<key>ADDefaultUserShell</key>
			<string>/bin/bash</string>
			<key>ADDefaultUserShellFlag</key>
			<true/>
			<key>ADDomainAdminGroupList</key>
			<array>
				<string>hmaslowski\Domain Admins</string>
				<string>hmaslowski\Enterprise Admins</string>
			</array>
			<key>ADDomainAdminGroupListFlag</key>
			<true/>
			<key>ADForceHomeLocal</key>
			<true/>
			<key>ADForceHomeLocalFlag</key>
			<true/>
			<key>ADMapGGIDAttributeFlag</key>
			<false/>
			<key>ADMapGIDAttributeFlag</key>
			<false/>
			<key>ADMapUIDAttributeFlag</key>
			<false/>
			<key>ADMountStyle</key>
			<string>smb</string>
			<key>ADNamespace</key>
			<string>domain</string>
			<key>ADNamespaceFlag</key>
			<true/>
			<key>ADOrganizationalUnit</key>
			<string>CN=Computers,DC=hmaslowski,DC=com</string>
			<key>ADPacketEncrypt</key>
			<string>allow</string>
			<key>ADPacketEncryptFlag</key>
			<true/>
			<key>ADPacketSign</key>
			<string>allow</string>
			<key>ADPacketSignFlag</key>
			<true/>
			<key>ADPreferredDCServerFlag</key>
			<false/>
			<key>ADRestrictDDNSFlag</key>
			<false/>
			<key>ADTrustChangePassIntervalDays</key>
			<integer>14</integer>
			<key>ADTrustChangePassIntervalDaysFlag</key>
			<true/>
			<key>ADUseWindowsUNCPath</key>
			<true/>
			<key>ADUseWindowsUNCPathFlag</key>
			<true/>
			<key>ADWarnUserBeforeCreatingMA</key>
			<false/>
			<key>ADWarnUserBeforeCreatingMAFlag</key>
			<true/>
			<key>ClientID</key>
			<string>%ComputerName%</string>
			<key>HostName</key>
			<string>hmaslowski.com/</string>
			<key>Password</key>
			<string>YOUR-BIND-PASSWORD</string>
			<key>PayloadDisplayName</key>
			<string>Directory (hmaslowski.com/)</string>
			<key>PayloadIdentifier</key>
			<string>com.apple.mdm.macbook.local.1b227119-5121-4a29-8110-b7e611de19df.alacarte.directory.3F4A08E0-39C5-46F2-B1FF-1AF5830BBCD7</string>
			<key>PayloadType</key>
			<string>com.apple.DirectoryService.managed</string>
			<key>PayloadUUID</key>
			<string>3F4A08E0-39C5-46F2-B1FF-1AF5830BBCD7</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>UserName</key>
			<string>YOUR-BIND-ACCOUNT</string>
		</dict>
	</array>
	<key>PayloadDisplayName</key>
	<string>ActiveDirectory</string>
	<key>PayloadIdentifier</key>
	<string>com.apple.mdm.macbook.local.1b227119-5121-4a29-8110-b7e611de19df.alacarte</string>
	<key>PayloadRemovalDisallowed</key>
	<false/>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>1b227119-5121-4a29-8110-b7e611de19df</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

Use it as a baseline and replace these keys to match your environment:

• ADDomainAdminGroupList
• ADOrganizationalUnit
• HostName
• UserName
• Password
• PayloadDisplayName
• PayloadIdentifier

Note: the bind account and its password are stored in plain text in the profile. Use a dedicated account that can only join computers to the domain. Microsoft also advises against custom profiles for sensitive information (see custom settings for Apple devices).

Deploy the profile with Intune

In the Intune admin center, go to Devices > macOS > Configuration > Create > New policy and select Templates > Custom (see custom settings for Apple devices):

Enter these settings:

• Custom configuration profile name, for example ActiveDirectory
• Deployment channel: Device channel (the payload is system-wide)
• Configuration profile file: your .mobileconfig or .xml file

Assign it to Macs that can reach the Active Directory domain. If the domain isn't reachable, the profile installation fails.

For troubleshooting, use the Console app, the macOS log viewer (like Event Viewer on Windows). Show errors and faults and filter by process, for example opendirectoryd, the directory service process:

Note: select Start streaming before the profile installs, whether you install it manually for a test or through Intune.

Result

Finally, check the binding on a Mac and sign in as a domain user.

I tested on macOS 11.1 (Big Sur) managed by Intune.

The ActiveDirectory profile (Directory payload) installed on the device. Like every profile, it's listed under System Preferences > Profiles (on macOS 13 and later, System Settings > General > Device Management):

In System Preferences > Users & Groups > Login Options, the Network Account Server shows the domain (HMASLOWSKI):

The computer object (macbook) in the local Active Directory:

Domain users can now sign in to the Mac, for example testuser@hmaslowski.com:

Note: my testuser account is a mobile account. Mobile accounts cache the credentials, so users can sign in with their Active Directory credentials even when the Mac can't reach a domain controller.

You turn this on (true) or off (false) with these keys in the profile:

<key>ADCreateMobileAccountAtLogin</key>
<true/>
<key>ADCreateMobileAccountAtLoginFlag</key>
<true/>

For more information, see Set up mobile user accounts and Integrate Mac computers with Active Directory.