Config Profiles: Android, iOS & macOS
Intune doesn't just manage Windows. Learn to create configuration profiles for Android, iOS/iPadOS, and macOS — each with its own capabilities and quirks.
Multi-platform management
Imagine you’re a chef cooking for guests with different dietary needs.
One table wants steak, another is vegetarian, the third is gluten-free. You need different recipes for each — but you’re still the same chef, in the same kitchen, using the same ordering system. That’s Intune managing different platforms: same admin center, same assignment logic, but each platform has its own menu of available settings.
Riko at Pixel and Co manages Macs, iPhones, and Android phones — all from the same Intune console. But what you CAN configure varies by platform.
iOS/iPadOS configuration
What you can configure
| Category | Settings Available |
|---|---|
| Device restrictions | Block camera, block screenshots, block app installs, require password |
| Wi-Fi | Configure Wi-Fi networks, certificates, EAP settings |
| VPN | Per-app VPN, always-on VPN, IKEv2 profiles |
| Configure native Mail app with Exchange settings | |
| Certificates | SCEP, PKCS, trusted root certificates |
| Kiosk mode (Supervised) | Lock device to a single app or set of apps |
| Home screen layout | Arrange app icons and folders (Supervised only) |
| AirPrint | Pre-configure printer destinations |
Supervised vs unsupervised
A critical concept for iOS management:
| Feature | Unsupervised | Supervised |
|---|---|---|
| Setup method | User installs Company Portal | ADE via Apple Business Manager |
| Management level | Basic restrictions + app management | Full control — kiosk mode, web filter, silent app install |
| Block app removal | No | Yes |
| Single app mode | No | Yes |
| Web content filter | No | Yes |
| Silent app install | No | Yes |
Key exam concept: Many exam questions hinge on whether a device is supervised. If the question requires deep control (blocking apps, kiosk mode, content filtering), the answer requires supervised mode through ADE.
Exam tip: supervised = ADE
If an exam question asks how to get a supervised iOS device, the answer is Apple Automated Device Enrollment (ADE) through Apple Business Manager. You cannot retroactively make an unsupervised device supervised without wiping it and re-enrolling through ADE.
Riko at Pixel and Co has a mix: corporate iPads enrolled via ADE (supervised) and designers’ personal iPhones enrolled via Company Portal (unsupervised). She can lock iPads to a single design app but can’t do the same on personal iPhones.
Android configuration
Android profiles depend on the enrollment type (from Module 4):
| Feature | Fully Managed | Dedicated | Corp Work Profile | Personal Work Profile |
|---|---|---|---|---|
| Device restrictions | Full device | Full device | Work profile + device | Work profile only |
| Wi-Fi configuration | Yes (device-wide) | Yes (device-wide) | Yes (device-wide) | Work profile only |
| App management | All apps | Allowed apps only | Work profile apps | Work profile apps |
| Camera control | Can disable device-wide | Can disable device-wide | Can disable in work profile | Work profile camera only |
| Factory reset protection | Yes | Yes | Yes | No |
| Managed Google Play | Required | Required | Required | Required |
Key Android settings
| Setting | What It Does |
|---|---|
| Managed Google Play | The enterprise app store — only approved apps appear |
| Work profile password | Separate password for the work profile container |
| Copy/paste between profiles | Block or allow data sharing between work and personal |
| Screen capture | Block screenshots in the work profile |
| Bluetooth sharing | Block sending files via Bluetooth from work profile |
macOS configuration
macOS management in Intune mirrors iOS in many ways (both use Apple MDM) but has unique features:
| Category | Settings Available |
|---|---|
| Device restrictions | Disable AirDrop, iCloud, external storage, password requirements |
| Wi-Fi / VPN | Network configuration, IKEv2, certificate-based auth |
| FileVault | Enable full-disk encryption (macOS equivalent of BitLocker) |
| System extensions | Approve kernel extensions and system extensions |
| Privacy preferences | Control app access to camera, microphone, files |
| Custom profiles | Upload .mobileconfig XML for settings not in the UI |
| Shell scripts | Deploy and run shell scripts on managed Macs |
Deep dive: FileVault via Intune
FileVault is macOS’s full-disk encryption, similar to BitLocker on Windows. Intune can:
- Enable FileVault on enrollment or after
- Escrow the recovery key to Entra ID (viewable in Intune admin center)
- Rotate the recovery key periodically
- Require FileVault as a compliance condition
Riko enables FileVault on all corporate Macs at Pixel and Co. If a designer forgets their password, the recovery key is stored in Intune — no need to call Apple.
Specialty devices need their own targets
A meeting-room system, a HoloLens headset, and a warehouse scanner should not all inherit the policy intended for a user’s laptop. Start with the device platform and enrollment type, then select supported settings and a dedicated assignment group.
| Device | Configuration approach | Avoid |
|---|---|---|
| Microsoft Teams Rooms | Follow the Teams Rooms deployment guidance, including its Intune configuration, supported policies, and room/resource-account requirements; distinguish Windows and Android devices | Assigning every desktop restriction to a room system without checking compatibility |
| HoloLens 2 | Use supported Windows Holographic for Business management settings, such as Wi-Fi, VPN, device restrictions, or a supported kiosk configuration | Assuming every Windows desktop CSP is supported on HoloLens |
| Zebra Android Enterprise | Deploy the compatible Zebra OEMConfig app and create an OEMConfig configuration profile using its manufacturer-provided settings | Applying an iOS profile or assuming all OEMConfig app versions support identical settings |
For Zebra, approve the appropriate OEMConfig app in Managed Google Play, assign it as Required to the intended devices, configure the OEM settings in the profile, and assign the profile to those devices. Review the app/schema and Android-version requirements. Test the settings on one scanner before targeting the warehouse group; do not configure conflicting values in overlapping profiles.
Worked diagnosis: Ordinary Android restrictions apply to a scanner, but its manufacturer-specific scanning setting does not. Check the Zebra OEMConfig app deployment, compatible schema, profile assignment, and per-setting results. Replacing the device’s enrollment type at random is not the first troubleshooting step.
Sources: Teams Rooms deployment, Windows Holographic with Intune, and Zebra OEMConfig profiles.
Platform comparison at a glance
| Capability | Windows | iOS/iPadOS | Android | macOS |
|---|---|---|---|---|
| Settings Catalog | Yes (5000+) | Yes (growing) | Limited | Yes (growing) |
| ADMX import | Yes | No | No | No |
| Kiosk/single-app mode | Yes | Yes (supervised) | Yes (dedicated) | No |
| Full-disk encryption | BitLocker | Built-in (always on) | Device encryption | FileVault |
| Shell/PowerShell scripts | Yes | No | No | Yes (shell scripts) |
| Custom config profiles | OMA-URI | .mobileconfig | OEMConfig | .mobileconfig |
🎬 Video walkthrough
Flashcards
Knowledge Check
Riko needs to lock a corporate iPad to a single design review app so it can be used as a kiosk in the Pixel & Co lobby. The iPad was enrolled by a designer using Company Portal. Can Riko enable single-app mode?
A designer at Pixel & Co has a personal Android phone with a work profile. They complain that they can't copy text from their personal WhatsApp into the work Outlook app. Why?
Next up: Control Admin Rights with EPM — giving users just-in-time admin rights without permanent local admin access.