macOS Setup Assistant with Modern Authentication in Intune

Platforms

macOS

Products

IntuneCompany PortalApple Business

Result

New Macs enroll with user affinity after an MFA sign-in in Setup Assistant, and finish Entra registration in Company Portal

Overview

Let users with MFA sign in during Setup Assistant on new Macs that enroll in Intune through Automated Device Enrollment.

Apple's Setup Assistant supports modern authentication in Microsoft Intune for macOS 10.15 and later and iOS/iPadOS 13 and later. Users who have multifactor authentication (MFA) can now sign in on the first Setup Assistant screens, which Intune customizes as part of Automated Device Enrollment (ADE) for new Apple devices.

In this post I set up Setup Assistant with modern authentication for Macs that enroll in Intune through ADE.

Prerequisites

Before you start, check that you have the following.

My earlier posts about ADE: Apple's Automated Device Enrollment and corporate macOS ADE. One ADE token can be shared by all Apple device types.

Configuration

With the prerequisites in place, set up the enrollment profile, then deploy Company Portal.

Create or edit an ADE profile for macOS

You can add Setup Assistant with modern authentication to a new or existing ADE enrollment profile that enrolls devices with user affinity. I edited a profile I created earlier (see my posts in the prerequisites):

• User affinity: Enroll with User Affinity
• Authentication method: Setup Assistant with modern authentication

Set the other Setup Assistant screens as you need. I left only Location Services and Apple ID (now Apple Account) shown, so users can sign in with a Managed Apple Account:

Make this profile your default macOS profile, or assign it to specific devices.

Update (October 2026): Microsoft now recommends Setup Assistant with modern authentication for all ADE enrollments with user affinity, and the legacy Setup Assistant is no longer recommended. Create new profiles under Devices > Device onboarding > Enrollment > macOS > Enrollment program tokens > (your token) > Enrollment policies. They also have Await final configuration (Yes by default), which keeps the user in Setup Assistant until your critical policies are installed, see Set up automated device enrollment for macOS.

Deploy Company Portal for macOS

Macs enrolled this way need Company Portal installed as a required app. After Setup Assistant, the user signs in to Company Portal to finish the Microsoft Entra registration and get the benefits of user affinity: available apps, compliance, and access to resources protected by Conditional Access.

There are several ways to deploy Company Portal for macOS (see Add the macOS Company Portal app). I used a shell script:

Microsoft's sample script is on GitHub. Assign it to all corporate Macs with these settings:

• Run script as signed-in user: No (system context)
• Max number of times to retry if script fails: 3

Update (October 2026): you can also add the Company Portal PKG as an app. On macOS 26 and later you can turn on Platform SSO during enrollment: then Company Portal 5.2604.0 or later must be a required LOB app, and users are signed in to Microsoft Entra apps when they reach the desktop, see Configure Platform SSO during automated device enrollment.

User Experience

Finally, walk through Setup Assistant on a new Mac.

I tested on a virtual Mac with macOS 11.2.3 Big Sur enrolled through ADE.

The user selects the country or region:

Then the keyboard and language settings:

The Remote Management screen from Apple's Automated Device Enrollment:

The user signs in with a Microsoft Entra ID account that has MFA. Without modern authentication, setup would stop here:

Password screen:

The user approves the sign-in in the authenticator app, or uses another supported method:

Now the Setup Assistant screens appear. In my profile the Apple ID screen (now Apple Account) was turned on. Turn this screen off if users won't use personal or Managed Apple Accounts:

Setup Assistant tells the user that this account belongs to an organization:

The user enters the Microsoft Entra ID password, because federated authentication is set up in Apple Business:

iCloud terms and conditions:

The user creates a computer account (a local administrator). If needed, you can remove admin rights from this account later with a shell script, such as Microsoft's Manage Accounts sample:

Setting up the account:

Enable Location Services:

This was the last screen in my profile, and the user lands on the desktop. The management profile is installed, and the Mac is supervised and managed by the organization:

Company Portal, installed by the shell script, asks the user to sign in again with Microsoft Entra ID:

The Company Portal sign-in screen:

Because I turned on the Apple Account screen in Setup Assistant, here is what users see with a Managed Apple Account.

In User Enrollment (BYOD), a Managed Apple Account is required and works alongside the user's personal Apple Account. In Automated Device Enrollment, signing in with an Apple Account (managed or personal) is optional. Managed Apple Accounts are created and owned by the organization, and services such as payment and shipping aren't available (screenshot below), so users can't get apps from the App Store, paid or free:

In the App Store the Get button is greyed out. Instead, you assign apps to the Macs as Required or Available in Intune:

For more details, see Intro to Managed Apple Accounts and Service access with Managed Apple Accounts in the Apple Business guide.