> For the complete documentation index, see [llms.txt](https://docs.secure-contacts.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.secure-contacts.com/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant.md).

# macOS (Intune-managed) Steps to activate SCA in your Entra Tenant

This guide is intended for Microsoft Intune administrators preparing SCA for macOS.

SCA Desktop uses Microsoft Entra ID for authentication and Microsoft Intune for centralized application deployment and configuration. This guide covers the signed **Apple silicon (ARM64) PKG**.

Latest releases of SCA Desktop can be downloaded from [SCA Desktop Releases](https://github.com/Provectus-Software-GmbH/SCA_Desktop_Releases/releases/latest).

## Preconditions

Prepare the following before starting the rollout:

<table><thead><tr><th width="280">Requirement</th><th>What to prepare</th></tr></thead><tbody><tr><td>Microsoft Entra ID</td><td>A tenant in which Secure Contacts App is registered and tenant-wide consent is granted. Step 1 explains how to verify or complete this.</td></tr><tr><td>Microsoft Intune</td><td>An active Intune subscription and a Mac already enrolled and managed by Intune. Confirm that the device appears in the admin center and checks in successfully.</td></tr><tr><td>Supported Mac</td><td>An Apple silicon (ARM64) test Mac running macOS 15 or newer. Apply any higher minimum required by the selected SCA release.</td></tr><tr><td>Test user</td><td>An Entra user with the required Microsoft services, a valid SCA license, and access to the contact sources you intend to test. SCA reads contacts in the signed-in user's context.</td></tr><tr><td>Pilot assignment</td><td>An Entra security group containing the compatible macOS test devices. Use this device group for both the application and preference profile in this guide.</td></tr><tr><td>Deployment files</td><td>The official signed ARM64 PKG and the production macOS preference-file template. The deployment and configuration steps explain where to obtain each file.</td></tr><tr><td>Administrator workstation</td><td>Access to a Mac for inspecting the package and verifying installed application metadata and managed preferences.</td></tr></tbody></table>

### Administrator access

Arrange Enterprise Application consent with your Entra administrator. The existing SCA Enterprise Application documentation describes this using a Global Administrator account.

For Intune, use your approved RBAC assignments. **Application Manager** supports app administration, while **Policy and Profile Manager** supports configuration profiles. An approved custom role can also provide the required permissions. Ensure the role assignment covers the relevant scope groups and scope tags.

The administrator must be able to create and assign the app and profile, read device installation results, and inspect the pilot device. Triggering a remote device synchronization requires the corresponding remote-task permission; local Company Portal synchronization can be used during the pilot.

Azure DevOps access and a separate automation App Registration are needed only for the optional update step.

{% hint style="info" %}
The application and its managed configuration are separate Intune objects. Deploy the PKG in Step 2, create the preference profile in Step 3, and verify both in Step 4. A successful package upload does not mean the configuration has reached the Mac.
{% endhint %}

## Steps to activate SCA

<table data-view="cards"><thead><tr><th>Step</th><th>Description</th><th data-card-target data-type="content-ref">Open</th></tr></thead><tbody><tr><td>Step 1 -macOS- Register Enterprise App</td><td>Register or verify SCA in your tenant and grant consent.</td><td><a href="broken://pages/35c743dc2d7bd86b2deae0f99d7db81b0a4b2fcc">Broken link</a></td></tr><tr><td>Step 2 -macOS- Deploy SCA with Intune</td><td>Upload the signed PKG, configure detection, and assign the app to pilot Macs.</td><td><a href="/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant/step-2-macos-deploy-sca-with-intune.md">Step 2 -macOS- Deploy SCA with Intune</a></td></tr><tr><td>Step 3 -macOS- Add App Configuration Policy</td><td>Deploy the SCA license and feature settings through a macOS preference file.</td><td><a href="/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant/step-3-macos-add-app-configuration-policy.md">Step 3 -macOS- Add App Configuration Policy</a></td></tr><tr><td>Step 4 -macOS- Onboard and verify your Test device</td><td>Verify installation, effective configuration, sign-in, and contact synchronization.</td><td><a href="/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant/step-4-macos-onboard-and-verify-your-test-device.md">Step 4 -macOS- Onboard and verify your test device</a></td></tr><tr><td>Optional Step -macOS- Automatic Desktop Update using Azure DevOps pipeline</td><td>Configure certificate authentication, preview versions, and publish approved updates.</td><td><a href="/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant/optional-step-automatic-desktop-update-using-azure-devops-pipeline.md">optional Step - Automatic Desktop Update - using Azure DevOps pipeline</a></td></tr></tbody></table>

{% hint style="info" %}
See [Editions](https://docs.secure-contacts.com/introduction/editions) for license editions and [SCA Configuration - SecContacts.Licenses](https://docs.secure-contacts.com/documentation/app-configuration-policy-name-values-for-sca/sca-configuration-seccontacts.licenses) for licensing information.
{% endhint %}

{% hint style="success" %}
For further questions, see our [Frequently Asked Questions (FAQ)](https://docs.secure-contacts.com/additional-information/frequently-asked-questions-faq). Contact and trial-license options are available under [Links](https://docs.secure-contacts.com/additional-information/links).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.secure-contacts.com/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.