Enroll Virtual macOS (BYOD) for Testing with Intune

Platforms

macOS

Products

IntuneCompany PortalVMware Fusion

Result

A macOS VM enrolls in Intune as a personal (BYOD) MacBook Pro, ready for testing policies and apps

Overview

Test macOS enrollment without a spare Mac: give a VMware Fusion VM a model identifier and serial number, then enroll it as a personal device with the Company Portal.

Personal Macs, also known as bring your own device (BYOD), have been supported in Microsoft Intune since 2015. A user who is an administrator on their Mac can enroll it in your organization, as long as no other MDM service manages it.

Intune can also manage macOS virtual machines (VMs), but only for testing, not for production use (see Enroll virtual macOS machines for testing).

A virtual Mac enrolls the same way as a physical one. The user either signs in to the Company Portal website (portal.manage.microsoft.com) or downloads the Company Portal app (aka.ms/EnrollMyMac).

In this post I enroll a macOS VM in VMware Fusion as a personal (BYOD) device in Intune.

If you are looking for company-owned Macs instead, see my post on Automated Device Enrollment (ADE) for macOS.

Prerequisites

Before you start, check that you have the following.

In 2020 I created a macOS Big Sur ISO with this third-party guide. These are the Terminal commands I used to turn the Big Sur installer into an ISO file. Today, download the installer from Apple, as linked in the table, and use the name of your macOS version:

sudo hdiutil create -o /tmp/BigSur -size 16384m -volname BigSur -layout SPUD -fs HFS+J
sudo hdiutil attach /tmp/BigSur.dmg -noverify -mountpoint /Volumes/BigSur
sudo /Applications/Install\ macOS\ Big\ Sur.app/Contents/Resources/createinstallmedia --volume /Volumes/BigSur --nointeraction
hdiutil eject -force /Volumes/Install\ macOS\ Big\ Sur
hdiutil convert /tmp/BigSur.dmg -format UDTO -o ~/Desktop/BigSur
mv -v ~/Desktop/BigSur.cdr ~/Desktop/BigSur.iso
sudo rm -fv /tmp/BigSur.dmg

Configuration

Pick a model identifier and serial number, then add them to the VM configuration.

I host my macOS 11 VM in VMware Fusion 12 on a physical MacBook Pro (2018, Intel).

Find a model identifier and serial number

Intune needs the hardware model and serial number of the VM to recognize it as a device. Without them, enrollment fails.

In 2020 I took the serial number of a real MacBook and changed its last digit, so the VM got a valid-looking serial that doesn't clash with the physical Mac.

Update (October 2026): Microsoft now says you can enter any string of letters and numbers as the serial number. For the model, use the model of the Mac that runs the VM.

To find the model identifier on a physical Mac, open the Apple menu > About This Mac > System Report:

Note: for more ways to find these values, see Find the model and serial number of your Mac.

• Serial number (12 characters) looks like X02XXXX5XXX8. I changed the last digit from 8 to 9, so the VM got X02XXXX5XXX9.
• Model identifier is MacBookPro15,2.

Add them to the .vmx file of the VM

In VMware Fusion, you set the model identifier and serial number in the .vmx file of the VM (see Editing the .vmx file for VMware Fusion virtual machines).

Shut down the macOS VM. In 2020 I found the VM bundle (.vmwarevm), right-clicked it and selected Show Package Contents to see the .vmx file:

Update (October 2026): Broadcom now describes a quicker way. In the Virtual Machine Library, hold the Option key, right-click the VM and select Open Config File in Editor.

Note: if the VM is encrypted, you must enter its password first, otherwise the .vmx file isn't readable.

You can edit the .vmx file in TextEdit, but first turn off Smart quotes and dashes in rich text documents only under Preferences (or switch to Plain text). Smart quotes stop the VM from booting.

Add the model identifier and serial number at the end of the .vmx file, as in my example:

hw.model = "MacBookPro15,2"
serialNumber = "X02XXXX5XXX9"

If the VM doesn't boot after the change, add these lines as well:

serialNumber.reflectHost = "FALSE"
hw.model.reflectHost = "FALSE"
smbios.reflectHost = "FALSE"

User Experience

Finally, enroll the VM with the Company Portal app.

Users enroll their personal Macs in one of two ways:

• Company Portal website at portal.manage.microsoft.com
• Company Portal app from aka.ms/EnrollMyMac

I chose the Company Portal app and opened aka.ms/EnrollMyMac in Safari on the VM:

The Company Portal installer (.pkg) downloads to the Downloads folder. Microsoft also lists a direct link to the Company Portal installer.

The user opens it, selects Continue and agrees to the software licence agreement:

When the installation is finished, select Close:

To start the enrollment, open the Company Portal app and select Sign in:

Sign in with the user's Microsoft Entra ID credentials:

Select Begin to start the device enrollment:

Because this is a personal device, the user sees a Privacy information screen about what the organization can see and manage on the device:

The user installs the management profile manually in System Preferences > Profiles. Today it's System Settings > General > Device Management, and Microsoft treats every Mac enrollment as user-approved (see Set up enrollment for macOS devices):

You're all set!

Ownership: Personal

The apps available to this user in the Company Portal:

The VM shows up in the Intune admin center as a MacBook Pro, as expected:

• Ownership: Personal
• Device model: MacBook Pro
• Serial number: X02XXXX5XXX9