Step 3 -macOS- Add App Configuration Policy

You need a valid license to onboard SCA with your organization's required features.

The license and settings are delivered through an Intune Preference file configuration profile. SCA reads the resulting device-level managed preferences.

See SCA Configuration - SecContacts.Licenses to request a trial license.

1

Download the configuration files

• Open the repository from the release link.

• Select the repository name to return to its main page, then choose Code → Download ZIP.

• Extract the source archive and open:

config/MacOS/plist/de.provectus.SecureContactsDesktop.plist

Use this blank production template. The adjacent .plist.demo file is a reference for value formats, not a deployment-ready configuration.

2

Enter the license

• Open the production template in a plain-text editor and locate SecContacts.Licenses.

• Replace its empty string with your license array:

<key>SecContacts.Licenses</key>
<string>[{"name":"YOUR_LICENSE_NAME","key":"YOUR_LICENSE_KEY"}]</string>

• Replace both placeholders with the issued license name and key. Do not add a duplicate SecContacts.Licenses entry if the template already contains it.

3

Configure features and contact sources

• Use App Configuration Policy - Name/Values for SCA as the reference for key meanings and supported values.

• Start with SecContacts.Defaults and your license. Add only the data-source settings required for this pilot.

The production macOS template exposes these top-level values:

Configuration key	Format when populated
SecContacts.Defaults	JSON array of objects with name and value.
SecContacts.Licenses	JSON array of objects with name and key.
SecContacts.AADGroups	JSON array of objects with name and value.
SecContacts.AADCache	JSON array of objects with name and value.
SecContacts.ServiceUrls	JSON array of objects with name and value.
SecContacts.AzureBlobStorage	JSON array of objects with name and value.
SecContacts.SharedMailboxContacts	JSON array of objects with name and value.
SecContacts.CustomDatasourceNames	JSON array of objects with defaultid, customid, and customname.
SecContacts.InternalLinks	Internal-links string in the documented application format.

These values are serialized into plist <string> elements. The field names above describe the format; the linked configuration documentation defines the actual names and values to use.

Keep unused optional template keys empty. Do not copy demonstration contact sources into the production profile.

4

Check the preference-file format

The Intune Preference file template expects a fragment containing key/value pairs.

Check all of the following before uploading:

• No XML declaration or outer <plist> / <dict> wrapper.

• Each <key> has its matching value element.

• Embedded JSON uses normal quotation marks, valid arrays, and the required property names.

• Each top-level SCA key appears only once.

• XML-sensitive characters in string content are escaped, for example & as &.

• All license placeholders are replaced and unused optional values remain empty.

Intune does not check whether SCA can interpret your values. A profile can be delivered successfully while its JSON or license information is incorrect. Verify the effective settings and app behavior in Step 4.

5

Create the Configuration Profile

• Open Devices → Manage devices → Configuration → Create → New policy in the Intune admin center.

• Select:

Setting	Value
Platform	macOS
Profile type	Templates
Template name	Preference file

- Select Create. - Enter Secure Contacts App Configuration - macOS as the name and add a description.

6

Configuration settings

• Set Preference domain name to:

de.provectus.SecureContactsDesktop

• Select your completed production .plist file under Property list file.

• Review the keys shown after import.

To correct the values, edit the local working copy and reupload it before completing the profile.

7

Finalize profile configuration

• Apply your scope tags and assign the profile to your macOS test device group

• Review the assignments and exclusions.

• Confirm another profile is not deliberately supplying conflicting values for the same SCA preference domain.

• Complete Review + create.

8

Verify delivery on the pilot

• Synchronize the test Mac and inspect the profile's device status in Intune.

• On the Mac, verify the managed preference file:

defaults read "/Library/Managed Preferences/de.provectus.SecureContactsDesktop.plist"

The expected result is the SCA keys with the values you configured. If the file is missing, check enrollment, assignment scope, check-in, and the preference domain. If a key is incorrect, compare the deployed profile with the working copy.

Update an existing configuration

For later changes, edit the controlled preference-file copy, reupload it to the existing profile, and validate the revised values on a pilot Mac. Record the previous configuration so the change can be reviewed or reversed.

The managed configuration is assigned. Continue with device verification to confirm that installation, licensing, and contact access work together.