Skip to main content

180: App management

Implementation Effort: High
User Impact: Medium

Overview​

App management for macOS in Intune should focus on packaging, assignment, dependency handling, update planning, and access to required business applications on managed Macs. Common app types include macOS package apps, Microsoft apps, line-of-business apps, web links, and Company Portal-delivered experiences.

In a Zero Trust endpoint strategy, app management supports the principle that only approved software should be delivered to trusted devices and that access to business apps should be paired with device identity, compliance, and least-privilege controls.

Implementation Guidance​

Plan the app portfolio​

  • Inventory required macOS apps and classify them as core productivity apps, security agents, browser components, developer tools, or department-specific software.
  • Decide which apps are required, available for self-service, or intentionally blocked from unmanaged distribution paths.
  • Confirm packaging and update ownership for each app so critical software does not rely on manual user installs.

Deploy through Intune​

  • Use the supported macOS app type in Intune for each package, and test installation, uninstall, and upgrade behavior on pilot devices before broad targeting.
  • Sequence security agents, identity components, and user-facing apps in a way that supports the desired day-one device experience.
  • Use device or user group assignment intentionally and document why an app is required versus optional.

Operate the app lifecycle​

  • Monitor install status, failed deployments, and version drift so high-value applications remain current.
  • Do not assume mobile-style Intune app protection policies apply to native macOS apps; instead, rely on device management, app configuration where supported, and identity or access controls.
  • Review whether unsupported or side-loaded apps need separate control through application allow or block strategies.

Reference​