> For the complete documentation index, see [llms.txt](https://docs.secure-contacts.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.secure-contacts.com/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant/step-3-macos-add-app-configuration-policy.md).

# Step 3 -macOS- Add App Configuration Policy

You need a valid license to onboard SCA with your organization's required features.

The license and settings are delivered through an Intune **Preference file** configuration profile. SCA reads the resulting device-level managed preferences.

{% hint style="success" %}
See [SCA Configuration - SecContacts.Licenses](https://docs.secure-contacts.com/documentation/app-configuration-policy-name-values-for-sca/sca-configuration-seccontacts.licenses) to request a trial license.
{% endhint %}

{% stepper %}
{% step %}

### Download the configuration files

* Open the repository from the release link. <br>
* Select the repository name to return to its main page, then choose **Code → Download ZIP**.<br>
* Extract the source archive and open:

```
config/MacOS/plist/de.provectus.SecureContactsDesktop.plist
```

{% hint style="info" %}
Use this blank production template. The adjacent `.plist.demo` file is a reference for value formats, not a deployment-ready configuration.
{% endhint %}

{% endstep %}

{% step %}

### Enter the license

* Open the production template in a plain-text editor and locate `SecContacts.Licenses`.<br>
* Replace its empty string with your license array:

```xml
<key>SecContacts.Licenses</key>
<string>[{"name":"YOUR_LICENSE_NAME","key":"YOUR_LICENSE_KEY"}]</string>
```

* Replace both placeholders with the issued license name and key. Do not add a duplicate `SecContacts.Licenses` entry if the template already contains it.

{% endstep %}

{% step %}

### Configure features and contact sources

* Use [App Configuration Policy - Name/Values for SCA](https://docs.secure-contacts.com/documentation/app-configuration-policy-name-values-for-sca) as the reference for key meanings and supported values.<br>
* Start with [SecContacts.Defaults](https://docs.secure-contacts.com/documentation/app-configuration-policy-name-values-for-sca/sca-configuration-seccontacts.defaults) and your license. Add only the data-source settings required for this pilot.<br>

The production macOS template exposes these top-level values:

| Configuration key                   | Format when populated                                                 |
| ----------------------------------- | --------------------------------------------------------------------- |
| `SecContacts.Defaults`              | JSON array of objects with `name` and `value`.                        |
| `SecContacts.Licenses`              | JSON array of objects with `name` and `key`.                          |
| `SecContacts.AADGroups`             | JSON array of objects with `name` and `value`.                        |
| `SecContacts.AADCache`              | JSON array of objects with `name` and `value`.                        |
| `SecContacts.ServiceUrls`           | JSON array of objects with `name` and `value`.                        |
| `SecContacts.AzureBlobStorage`      | JSON array of objects with `name` and `value`.                        |
| `SecContacts.SharedMailboxContacts` | JSON array of objects with `name` and `value`.                        |
| `SecContacts.CustomDatasourceNames` | JSON array of objects with `defaultid`, `customid`, and `customname`. |
| `SecContacts.InternalLinks`         | Internal-links string in the documented application format.           |

{% hint style="warning" %}
These values are serialized into plist `<string>` elements. The field names above describe the format; the linked configuration documentation defines the actual names and values to use.
{% endhint %}

{% hint style="info" %}
Keep unused optional template keys empty. Do not copy demonstration contact sources into the production profile.
{% endhint %}
{% endstep %}

{% step %}

### Check the preference-file format

The Intune **Preference file** template expects a fragment containing key/value pairs.<br>

Check all of the following before uploading:

* No XML declaration or outer `<plist>` / `<dict>` wrapper.
* Each `<key>` has its matching value element.
* Embedded JSON uses normal quotation marks, valid arrays, and the required property names.
* Each top-level SCA key appears only once.
* XML-sensitive characters in string content are escaped, for example `&` as `&amp;`.
* All license placeholders are replaced and unused optional values remain empty.<br>

{% hint style="warning" %}
Intune does not check whether SCA can interpret your values. A profile can be delivered successfully while its JSON or license information is incorrect. Verify the effective settings and app behavior in Step 4.
{% endhint %}
{% endstep %}

{% step %}

### Create the Configuration Profile

* Open **Devices → Manage devices → Configuration → Create → New policy** in the Intune admin center.<br>
* Select:

| Setting       | Value           |
| ------------- | --------------- |
| Platform      | macOS           |
| Profile type  | Templates       |
| Template name | Preference file |

\
\- Select **Create**. \
\
\- Enter **Secure Contacts App Configuration - macOS** as the name and add a description.<br>
{% endstep %}

{% step %}

### Configuration settings

* Set **Preference domain name** to:

```
de.provectus.SecureContactsDesktop
```

* Select your completed production `.plist` file under **Property list file**. <br>
* Review the keys shown after import.

{% hint style="info" %}
To correct the values, edit the local working copy and reupload it before completing the profile.
{% endhint %}

{% endstep %}

{% step %}

### Finalize profile configuration

* Apply your scope tags and assign the profile to your macOS test device group<br>
* Review the assignments and exclusions. <br>
* Confirm another profile is not deliberately supplying conflicting values for the same SCA preference domain.<br>
* Complete **Review + create**. <br>
  {% endstep %}

{% step %}

### Verify delivery on the pilot

* Synchronize the test Mac and inspect the profile's device status in Intune.<br>
* On the Mac, verify the managed preference file:

```bash
defaults read "/Library/Managed Preferences/de.provectus.SecureContactsDesktop.plist"
```

{% hint style="warning" %}
The expected result is the SCA keys with the values you configured. If the file is missing, check enrollment, assignment scope, check-in, and the preference domain. If a key is incorrect, compare the deployed profile with the working copy.
{% endhint %}
{% endstep %}
{% endstepper %}

## Update an existing configuration

For later changes, edit the controlled preference-file copy, reupload it to the existing profile, and validate the revised values on a pilot Mac. \
\
Record the previous configuration so the change can be reviewed or reversed.

{% hint style="success" %}
The managed configuration is assigned. Continue with device verification to confirm that installation, licensing, and contact access work together.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.secure-contacts.com/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant/step-3-macos-add-app-configuration-policy.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.