My blog has become the gold standard of evaluating Workspace ONE and Intune. My most famous article which has had north of 5K views in the last year took an unbiased look at these two great platforms. Today, we will look at MacOS, which has been a request by a number of people since my Windows two-part article came out. We will look at Enrollment, Device Profiles, Compliance, Application Management, and Security.
Round 1: MacOS Device Enrollment
MacOS Device Enrollment isn’t very complicated. We expect that every platform can do DEP, do DEP well, and the enrollment experience is top notch. One of the things that we are doing this time around is a few match-off videos where we show the setup experience or user experience for both platforms to prove how good or bad it is. Let’s start things off with the DEP Battle Royale!
Intune vs. Workspace ONE DEP Capabilities
Microsoft’s implementation of DEP is really basic. We’re going to watch the video below to show how the two of them face off. The basic truth is that Intune is just hitting the bare minimum. It’s basically the setup assistant toggles, department number, and department. Workspace ONE hits that note, but them elevates it at least 3 or 4 levels.
As you saw in the video, the implementation of the great new Custom Enrollment along with the automated standard user account and managed admin account with a rotating password is absolutely phenomenal. It would be great to see Microsoft invest some more time on the DEP supportability because it’s a huge foundation.
Intune Enrollment with MacOS
Moving onto the enrollment itself, lets take a look at what the Intune Enrollment experience looks like below. First, we’ll watch and then we’ll discuss!
As you saw, the entire user experience is really great on MacOS, but the main issue that I saw is one that I have written about in the past. Intune can be a little bit disjointed, which you saw was the case. After enrollment or after deploying an application, it can sometimes take up to one hour to see apps. Otherwise I think the experience overall was very nice.
Intune Enrollment Score: 6
Workspace ONE Enrollment with MacOS
VMware has investing some significant effort into the user experience for their enrollments and you can tell. With their unified catalog built into the Intelligent Hub, which has many potential capabilities like People Search, Mobile Flows, etc. You can see from the demo below what that user onboarding experience is coupled with their great investment in DEP makes a substantial offering.
As you saw, it’s a crisp and smooth experience when enrolling with Workspace ONE. They definitely earned their score. Personally, I think they could take a few cues from Microsoft with their consumer-centric and simplistic enrollment.
Workspace ONE Enrollment Score: 9
Round 2: MacOS Device Profiles
This section took an exhaustive amount of time. The 30+ device profiles that exist on MacOS are certainly complicated as MacOS management is not for the weak of heart. I assure you that it will be surprising to see where this landed…
Workspace ONE vs. Intune Device Profiles
The best way to look at this will be with some table magic as it’s remarkably confusing.
| WS1 Device Profiles | Intune Match | Notes |
| Passcode | Device Restrictions | |
| Network | Intune supports outer identity. WS1 adds these: TLS minimum and maximum versions, allow direct connections if PAC is down, WiFi captive portal | |
| VPN | VPN | Intune lets you block users from disabling On-Demand or Per-App VPN. WS1 supports integrating VPN with system extensions via Provider Designated Requirement, ability to exclude or include all traffic. |
| SCEP | SCEP | |
| Dock | NONE | |
| Credentials | PKCS Certificate | Intune doesn’t support Identity Preference. |
| Restrictions | Device Restrictions | WS1 doesn’t let you block iTunes File Sharing, Lookups, or iCloud Photo Library but Intune does. Intune doesnt support the following: restricting systems preference items, game center, deprecated TLS, App Store, whitelisting/blacklisting folders, restricting widgets, restricting sharing services except AirDrop, restricting media, locking desktop picture, blocking iCloud data overall, blocking iCloud passwords for local accounts, blocking Find my iCloud, blocking AirPrint. |
| Software Update (Update Policy) | NONE | |
| Parental Controls | Mostly NONE | Disabling dictation is in here, but otherwise not supported by Intune |
| Directory | NONE | |
| Security & Privacy | Device Restrictions/Endpoint Protection | Intune doesnt support “Require password after sleep begins” or “Send Diagnog to Apple” |
| KEXT | Extensions | |
| Privacy Prefs | Device Restrictions | |
| Encryption | Endpoint Protection | Intune ONLY supports Personal Key and nothing else. |
| Login Items | Device Features | WS1 separates out network mounts as its not obvious Intune can use this for network shares **Test this** |
| Login Windows | Device Features | Intune only supports windows layout, power button settings, apple menu disablement. (Disable shutdown, restart, power off, log out, lock screen while logged in.) WS1 supports several other options, reference tab for login windows |
| Energy Saver | NONE | |
| Time Machine | NONE | |
| Finder | NONE | |
| Accessibility | NONE | |
| Printing | NONE | |
| Proxies | NONE | |
| Smart Card | NONE | |
| Mobility | NONE | |
| Associated Domains | Device Features | Intune lets you enable direct downloads instead of going through a CDN |
| Managed Domains | Device Restrictions | |
| SSO Extension | Device Features | Intune gives you Azure AD SSO Extension (Intune exclusive), Intune also lets you deploy custom domain realm mappings (Map a host that doesn’t match the realm name) |
| Skip Setup Assistant | NONE | |
| Content Filter | NONE | |
| System Extensions | Extensions | |
| Airplay Mirroring | NONE | |
| AirPrint | Device Features | Intune lets you customize Port and TLS, which is a bug because those are iOS only features |
| xSAN | NONE | |
| Firewall | Endpoint Protection | Intune will let you whitelist or blacklist apps on the Firewall which WS1 doesn’t. WS1 instead will automatically allow all signed apps to receive incoming connections. WS1 also supports stealth mode to block stuff like Ping. |
| Firmware Password | NONE | |
| Custom Attributes | Custom Attributes |
The good news is that Intune has a few features that Workspace ONE is missing:
| Content Caching | Device Features | Intune supports content caching, which lets you cache icloud data and other apple content e.g. software updates/apps, *WS1 will let you disable it* |
| Apple Classroom | Device Restrictions | Intune supports customization of Apple Classroom experience features |
| Preference File | Preference File | Intune lets you import plists directly to applications |
Workspace ONE Profiles Score: 8.5
Intune Profiles Score: 5
Round 3: MacOS Compliance Profiles
MacOS compliance is crucial as the OS continues to evolve. It’s crucial to make sure that we are monitoring for gaps and moving swiftly. Luckily, both VMware and Microsoft do a nice job handling them.
Workspace ONE vs. Intune Device Compliance
The compliance table can be seen below. For the most part, I wouldn’t expect with Gatekeeper that application compliance will matter all that much, but it would be nice to see Microsoft let you blacklist models and based on device last seen:
| Device Compliance | Intune Comparable | Notes |
| System Integrity Protection | Exists in Intune | |
| Application Compliance | NO | Let’s you flag devices as compromised that have or do NOT have an application or application version. |
| Disk Encryption | Exists in Intune | |
| Device Model | NO | Blacklist certain Mac models |
| OS Version | Exists in Intune | |
| Device Last Seen | NO |
Workspace ONE Compliance Score: 9
Intune Compliance Score: 7.5
Round 4: MacOS Application Management
When it comes to application management, we focus on two things: packaging and deploying applications. We will take a look at how both applications are packaged and deployed. Let’s dig in!
Workspace ONE vs. Intune Application Packaging
One of the things that Microsoft is very fond of doing in Intune is having a special hocus pocus way of packaging apps that is tedious and painful. MacOS is no different. VMware is no prince either as they have their own packaging tool as well. Check out the video to see a side-by-side comparison of the two products.
As you saw, the big issue is that Intune will only let you packaging .PKG files, but despite that they have some very cool capabilities with their tool like setting customized bundle identifiers and versions, which I love. Sure you could use code like this below, but you shouldn’t have to:
sudo productbuild --component /Applications/Application.app ~/Downloads/Application.pkgOverall, the Munki codebase that VMware has adapted for application management is a very strong decision that has worked out well as you can see with the VMware Admin Assistant. Either way, they both work pretty well, but VMware’s tool is obviously a bit easier to use for the lay person.
Workspace ONE Application Deployment
Workspace ONE application deployment is very strong. It certainly takes some getting used to, but once you get the basics down you can deploy apps very easily. Check the walkthrough below and then we’ll discuss:
As you can see, Workspace ONE does a nice job when it comes to application deployment. Sometimes you may need to use their product provisioning technology for certain tools, which lets you deploy apps with config files, scripts, etc to create a structured deployment and setup for an application. I usually leverage product provisioning, which is the ability to deploy files, scripts, applications, etc and create a harmonious collaboration. This is only temporary until Freestyle Orchestrator releases, so i won’t waste more time on it.
Intune ONE Application Deployment
Intune application deployment is very problematic unfortunately. Simplistically, MacOS application deployments that do NOT support pre-install scripts or post-install scripts are NO BUENO for MacOS. I was remarkably disappointed to see that they can deploy apps, but that’s really about it. Check out the video so you can see the experience:
Another issue that I ran into is that there is no version control. One of my favorite things about Workspace ONE’s application management for all platforms is the ability to add versions to applications and have true application version control. They do support the ability to deploy scripts, but it only supports shell scripts. My apologies to all of the python users out there. I think it’s worth mentioning since as you can see below, they support the ability to deploy scripts with frequency, which is an area that VMware could do better with.
Workspace ONE Application Management Score: 9
Intune Application Management Score: 5
Round 5: MacOS Security
When I focus on MacOS Security, I look at Endpoint Detection and Response, encryption, compliance, firewall, and gatekeeper.
We covered most of these in other sections. I look at Carbon Black and Microsoft Defender for Endpoint as essentially a wash. Intune and Workspace ONE are relatively close on MacOS security. VMware wins on encryption and compliance and Microsoft wins at the firewall level.
I’m not going too deep on this, but simply they are tied. The great news is that MacOS provides a number of frameworks that empower vendors to deliver secure solutions on MacOS through gatekeeper, system extensions, and much more.
Workspace ONE Security Score: 8
Intune Security Score: 8
The Final Tally
Let’s add things up and see where we land:
| VMware Workspace ONE | Microsoft Intune | |
| Enrollment | 9 | 6 |
| Profiles | 8.5 | 5 |
| Compliance | 9 | 7.5 |
| Application Management | 9 | 5 |
| Security | 8 | 8 |
| Total Score | 43.5 | 31.5 |
Honestly, I was way too easy on Microsoft considering the significant gaps all over their MacOS offering with Intune. I can see why many people at Microsoft recommend using JAMF and doing the Intune integration. Part of me is sorry that I even committed my time and effort to doing all of the research on the platform, but it’s necessary to keep a good eye on the where UEM platforms are at so we can challenge our vendors to deliver a superior product.
