Again, we utilize the previously installed Intune Management Extension, but this time for deploying Win32 apps ( documentation ).

I appreciate the freedom of choice in terms of location, time and device.

We want to avoid getting into micro-management but, being an IT company, we also need to provide the necessary security where needed.

Enable Microsoft Scripting Runtime Excel Code Is Disabled

In this blog post, I will cover how we ensure that the execution of VBA code is disabled on (mostly) self-managed devices.

This configuration had to be centrally managed, of course, for an array of endpoints running both Windows and macOS.

Intune can be used to manage both Windows and macOS, and it does not require traditional Active Directory domain joins.

However, you can find a complete list of prerequisites here.

To avoid having to constantly monitor and edit the memberships of such a group, we make use of dynamic groups.

In our case, it was necessary to automatically have all Windows 10 devices in one group.

To manage these, you first need an MDM push certificate issued by Apple.

Push certificates can be requested at the Apple Push Certificates Portal.

It is worth checking the list of available settings regularly as Microsoft is constantly adding new ones.

Profiles are basically just XML files that can be created manually with the information provided by Apple and Microsoft.

It is much more comfortable, though, to make use of the ProfileCreator project and follow the instructions in their wiki.

Then create a custom device configuration profile for macOS and upload the config.

So we have all of our Windows and macOS devices secured and are done here, right Well, not quite.

This means that the settings will only be enforced if the logon is actually performed by an AAD user.

Please make sure that your devices are AAD joined, just registering them is not sufficient.

The Intune Management Extension is, amongst other things, responsible for executing our script.

The results for each user and script are available in the registry HKLMSOFTWAREMicrosoftIntuneManagementExtensionPoliciesUSERGUIDSCRIPTGUID.

So make sure not to store any sensitive information within your scripts.

There is no way to modify this besides restarting the service.

It will be executed once an hour, when a user logs on, or when the workstation is unlocked.

The script itself is pushed to the device using another technique.

Enable Microsoft Scripting Runtime Excel For Mac