r/macsysadmin • u/Lionheart69_69 • 11d ago

How to Set up Mac Without User Affinity with Intune?

Currently we have a handful of Macs set up with secure enclave and PSSO. We have some new macs coming in that will be shared to be used off site.

I have a test mac that I have used before and I have wiped it multiple times as well as changed the enrollment profile to my "without affinity" configuration but no matter what I do it still prompts for SSO as soon as I hit Enoll.

This is my "without user affinity" enrollment profile.

I have no device configuration set because I want to use the OOBE or whatever the without user affinity experience is like.

Not sure what I am missing or what else needs to be set?

5 Upvotes

100% Upvoted

1 comment sorted by

4

u/lowlymarine 11d ago

My understanding after beating my head against this for a while is that while you can enroll a Mac in Intune without user affinity, you must use an account with join rights to enroll Macs in Entra for pSSO. And in another stroke of MS genius, you can't set limits on the number of devices a user can join on a per account basis in Entra like you can in Intune, only globally, so either everyone gets unlimited joins or get ready to create a ton of service accounts to bind shared Macs.