macOS (Intune-managed) Steps to activate SCA in your Entra Tenant

This guide is intended for Microsoft Intune administrators preparing SCA for macOS.

SCA Desktop uses Microsoft Entra ID for authentication and Microsoft Intune for centralized application deployment and configuration. This guide covers the signed Apple silicon (ARM64) PKG.

Latest releases of SCA Desktop can be downloaded from SCA Desktop Releases.

Preconditions

Prepare the following before starting the rollout:

Requirement	What to prepare
Microsoft Entra ID	A tenant in which Secure Contacts App is registered and tenant-wide consent is granted. Step 1 explains how to verify or complete this.
Microsoft Intune	An active Intune subscription and a Mac already enrolled and managed by Intune. Confirm that the device appears in the admin center and checks in successfully.
Supported Mac	An Apple silicon (ARM64) test Mac running macOS 15 or newer. Apply any higher minimum required by the selected SCA release.
Test user	An Entra user with the required Microsoft services, a valid SCA license, and access to the contact sources you intend to test. SCA reads contacts in the signed-in user's context.
Pilot assignment	An Entra security group containing the compatible macOS test devices. Use this device group for both the application and preference profile in this guide.
Deployment files	The official signed ARM64 PKG and the production macOS preference-file template. The deployment and configuration steps explain where to obtain each file.
Administrator workstation	Access to a Mac for inspecting the package and verifying installed application metadata and managed preferences.

Administrator access

Arrange Enterprise Application consent with your Entra administrator. The existing SCA Enterprise Application documentation describes this using a Global Administrator account.

For Intune, use your approved RBAC assignments. Application Manager supports app administration, while Policy and Profile Manager supports configuration profiles. An approved custom role can also provide the required permissions. Ensure the role assignment covers the relevant scope groups and scope tags.

The administrator must be able to create and assign the app and profile, read device installation results, and inspect the pilot device. Triggering a remote device synchronization requires the corresponding remote-task permission; local Company Portal synchronization can be used during the pilot.

Azure DevOps access and a separate automation App Registration are needed only for the optional update step.

The application and its managed configuration are separate Intune objects. Deploy the PKG in Step 2, create the preference profile in Step 3, and verify both in Step 4. A successful package upload does not mean the configuration has reached the Mac.

Steps to activate SCA

Step

Step 1 -macOS- Register Enterprise App

Description

Register or verify SCA in your tenant and grant consent.

Open

Step

Step 2 -macOS- Deploy SCA with Intune

Description

Upload the signed PKG, configure detection, and assign the app to pilot Macs.

Open

Step 2 -macOS- Deploy SCA with Intune

Step

Step 3 -macOS- Add App Configuration Policy

Description

Deploy the SCA license and feature settings through a macOS preference file.

Open

Step 3 -macOS- Add App Configuration Policy

Step

Step 4 -macOS- Onboard and verify your Test device

Description

Verify installation, effective configuration, sign-in, and contact synchronization.

Open

Step 4 -macOS- Onboard and verify your test device

Step

Optional Step -macOS- Automatic Desktop Update using Azure DevOps pipeline

Description

Configure certificate authentication, preview versions, and publish approved updates.

Open

optional Step - Automatic Desktop Update - using Azure DevOps pipeline

See Editions for license editions and SCA Configuration - SecContacts.Licenses for licensing information.

For further questions, see our Frequently Asked Questions (FAQ). Contact and trial-license options are available under Links.