Repo sync for protected branch

intune/device-security/compliance/create-custom-json.md

@@ -24,6 +24,7 @@ Include the JSON file in a compliance policy when you configure a policy to asse
 > - Linux:
 >   - Ubuntu Desktop, version 24.04 LTS or 26.04 LTS
 >   - RedHat Enterprise Linux 9 or 10
+>   - macOS
 > - Windows
 
 :::column-end:::

intune/device-security/compliance/create-custom-script.md

@@ -1,6 +1,6 @@
 ---
 title: Create discovery scripts for custom compliance policy in Microsoft Intune
-description: Create scripts for Linux or Windows devices to discover the settings you define as custom compliance settings for Microsoft Intune.
+description: Create scripts for Linux, macOS, or Windows devices to discover the settings you define as custom compliance settings for Microsoft Intune.
 ms.date: 09/04/2025
 ms.topic: concept-article
 ms.reviewer: ilwu
@@ -12,6 +12,7 @@ Before you can use [custom settings for compliance](./custom-settings.md) with M
 
 - Windows devices use a PowerShell script.
 - Linux devices can run scripts in any language as long as the corresponding interpreter is installed and configured on the device.
+- macOS devices use a Bash shell script.
 
 The discovery script deploys to devices as part of your custom compliance policies. When compliance runs on a device, the script discovers the settings defined in the JSON file you provide when creating the compliance policy.
 
@@ -40,6 +41,7 @@ To successfully return compliance data to Intune, your scripts must stay within
 - Output generated by each script can be no larger than 1 MB.
 - Scripts must have a limited run time:
   - On Linux, scripts must take five minutes or less to run.
+  - On macOS, scripts must take 10 minutes or less to run.
   - On Windows, scripts must take 10 minutes or less to run.
 
 ## Sample discovery script for Windows
@@ -80,23 +82,50 @@ To use Python, specify the interpreter path. For example, add the following line
 
 For more information, see the [Intune Linux Custom Compliance Samples](https://github.com/microsoft/shell-intune-samples/tree/master/Linux) guide.
 
+## Sample discovery script for macOS
+
+Discovery scripts for macOS use Bash and must include a valid shebang line (for example, `#!/bin/bash`). Scripts must be UTF-8 encoded without BOM, and must return exit code 0 for success and a non-zero exit code for failure.
+
+The following example returns the version of the Microsoft Intune Agent app installed on the device:
+
+```bash
+# Fixed variables
+attribute="CFBundleShortVersionString"
+InfoPlistPath="/Library/Intune/Microsoft Intune Agent.app/Contents/Info.plist"
+
+# Read the version string from the app's Info.plist and return it
+if [[ -f "$InfoPlistPath" ]]; then
+    ver=$(plutil -p "$InfoPlistPath" | grep "$attribute" | awk -F'"' '{ print $4 }')
+    echo $ver
+else
+    echo "not installed"
+fi
+```
+
 ## Add a discovery script to Intune
 
 Before deploying your script in production, test it in an isolated environment to ensure the syntax you use behaves as expected.
 
+
+1. Sign into [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Endpoint security** > **Device compliance** > **Scripts** > **Add** > *(choose your platform)*.
+2. On **Basics**, provide a **Name**.
+3. On **Settings**, add your script to **Detection script**. Review your script carefully. Intune doesn’t validate the script for syntax or programmatic errors.
+4. ***For macOS*** - On **Settings**, configure the following behavior for the Bash script:
+
+   - **Run this script using the logged on credentials** – Set this value to **Yes** to run the script in the context of the logged-on user.
+   - **Enforce script signature check** – Set this value to **Yes** to require a valid signature on the script.
+   - **Hide script notifications on devices** – Set this value to **Yes** to hide notifications from the script on the device.
+
+   ***For Windows only*** - On **Settings**, configure the following behavior for the PowerShell script:
+
 > [!NOTE]
 > The script upload workflow doesn't support scope tags. You must be assigned the default scope tag to create, edit, or view custom compliance discovery scripts.
 
-1. Sign in to the [Microsoft Intune admin center] and go to **Endpoint security** > **Device compliance** > **Scripts** > **Add**. Then choose your platform.  
-1. On **Basics**, enter a descriptive **Name** for the script.
-1. On **Settings**, add your script to **Detection script**. Review your script carefully. Intune doesn't validate the script for syntax or programming errors.
-1. *For Windows only* - On **Settings**, configure the following behavior for the PowerShell script:
-
    - **Run this script using the logged on credentials** – By default, the script runs in the System context on the device. Set this value to **Yes** to have it run in the context of the logged-on user. If the user isn't logged in, the script defaults back to the System context.
    - **Enforce script signature check** – For more information, see [about_Signing](/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.1&preserve-view=true) in the PowerShell documentation.
    - **Run script in 64 bit PowerShell Host** – By default, the script runs using the 32-bit PowerShell host. Set this value to **Yes** to force the script to run using the 64-bit host instead.
 
-1. Complete the script creation process. The script appears in the **Scripts** pane and is available to select when configuring compliance policies.
+5. Complete the script creation process. The script appears in the **Scripts** pane and is available to select when configuring compliance policies.
 
 ## Next steps
 

intune/device-security/compliance/create-policy.md

@@ -125,6 +125,7 @@ For more information about using custom compliance settings, including supported
    > - Linux
    >   - Ubuntu Desktop, version 24.04 LTS or 26.04 LTS
    >   - RedHat Enterprise Linux 9 or 10
+   > - macOS  
    > - Windows 
    > Before you can add custom settings to a policy, upload a detection script to Intune, and have a JSON file that defines the settings you want to use for compliance. For more information, see [Custom compliance settings](./custom-settings.md).
 
@@ -135,12 +136,12 @@ For more information about using custom compliance settings, including supported
    1. For *Select your discovery script*, select **Click to select**, and then enter the name of a script that you previously added to the Microsoft Intune admin center. This script must be uploaded before you begin to create the policy. Choose **Select** to continue to the next step.
    1. For *Upload and validate the JSON file with your custom compliance settings*, select the folder icon, and then find and add the JSON file for Windows that you want to use with this policy. For assistance with the JSON, see [Create a JSON for custom compliance settings](./create-custom-json.md).
 
-   **For Linux**:
+   **For Linux and macOS**:
    1. On the *Compliance settings* page, select **Add settings** to open the **Settings picker**.
    1. Select **Custom Compliance**. Then close the settings picker.
    1. Switch **Require Custom Compliance** to **True**.
-   1. For **Select your discovery script**, select **Select a script**. Then select a script that you previously added to the Microsoft Intune admin center. This script must be uploaded before you begin to create the policy.
-   1. For **Select your rules file**, select the folder icon and then locate and add the JSON file for Linux that you want to use with this policy. For assistance with the JSON, see [Create a JSON for custom compliance settings](./create-custom-json.md).
+   1. For **Select your discovery script**, select **Select a script**. Then select a script that’s been previously added to the Microsoft Intune admin center. This script must be uploaded before you begin to create the policy.
+   1. For **Select your rules file**, select the folder icon and then locate and add the JSON file that you want to use with this policy. For assistance with the JSON, see [Create a JSON for custom compliance settings](./create-custom-json.md).
 
    Wait while Intune validates the JSON. Problems that need to be fixed appear onscreen. After validation of the JSON contents, the rules from the JSON appear in table format.
 

intune/device-security/compliance/custom-settings.md

@@ -1,28 +1,20 @@
 ---
-title: Use custom compliance settings for Linux and Windows devices in Microsoft Intune
-description: Manage custom compliance settings for Linux and Windows devices by using JSON files and discovery scripts in Intune.
+title: Use custom compliance settings in Microsoft Intune
+description: Manage custom compliance settings on managed devices by using JSON files and discovery scripts in Microsoft Intune.
 ms.date: 05/15/2024
 ms.topic: concept-article
 ms.reviewer: ilwu
 ---
 
-# Use custom compliance policies and settings for Linux and Windows devices with Microsoft Intune
+# Custom compliance settings in Microsoft Intune
 
-To expand on Intune’s built-in device compliance options, use policies for custom compliance settings for managed Linux and Windows devices. Custom settings give you the flexibility to base compliance on the settings that are available on a device without waiting for Intune to add these settings to the built-in policy templates.
-
-This feature applies to:
-
-- Windows (excluding Windows Home)
-- Linux
-  - Ubuntu Desktop, version 24.04 LTS or 26.04 LTS
-  - RedHat Enterprise Linux 9
-  - RedHat Enterprise Linux 10
+To expand on Intune’s built-in device compliance options, you can use policies for custom compliance settings on managed devices. Custom settings provide flexibility to base compliance on the settings that are available on a device without having to wait for Intune to add these settings to the built-in policy templates.  
 
 Before you can add custom settings to a policy, you must prepare a JSON file and a discovery script for use with each supported platform. Both the script and JSON become part of the compliance policy. Each compliance policy supports a single script, and each script can discover multiple settings:
 
 - The JSON file defines the custom settings and the values that you consider to be compliant. You can also configure messages for users to tell them how to restore compliance for each setting. Add your JSON file when you create a compliance policy, just after you select a discovery script for that policy.
 
-- Discovery scripts are specific to the different platforms and are delivered to devices as part of the compliance policy. When a device evaluates its policy, the script detects (discovers) the settings from the JSON file, and then reports the results to Intune. Windows devices use a PowerShell script and Linux devices use a POSIX-compliant shell script.
+- Discovery scripts are specific to the different platforms and are delivered to devices as part of the compliance policy. When a device evaluates its policy, the script detects (discovers) the settings from the JSON file, and then reports the results to Intune. Windows devices use a PowerShell script. Linux and macOS devices use a POSIX-compliant shell script.
 
   You must upload the scripts to the Microsoft Intune admin center before you create a compliance policy. Select the script when you’re configuring a policy to support custom settings.
 
@@ -38,6 +30,7 @@ After you deploy custom compliance settings and devices report back, you can vie
 :::column span="3":::
 
 > - Windows (excluding Windows Home)
+> - macOS  
 > - Linux
 >   - Ubuntu Desktop, version 24.04 LTS or 26.04 LTS
 >   - RedHat Enterprise Linux 9
@@ -50,25 +43,7 @@ After you deploy custom compliance settings and devices report back, you can vie
 :::column span="1":::
 [!INCLUDE [cloud](../../includes/requirements/cloud.md)]
 
-:::column-end:::
-:::column span="3":::
-
-> - Microsoft Entra joined devices, including Microsoft Entra hybrid joined devices.
->
->   Microsoft Entra hybrid joined devices are devices that are joined to Microsoft Entra ID and also joined to on-premises Active Directory. For more information, see [Plan your Microsoft Entra hybrid join implementation](/entra/identity/devices/hybrid-join-plan).  
->
-> - Microsoft Entra registered/Workplace joined (WPJ)
->
->   For information about devices registered in Microsoft Entra ID, see [Workplace Join as a seamless second factor authentication](/windows-server/identity/ad-fs/operations/join-to-workplace-from-any-device-for-sso-and-seamless-second-factor-authentication-across-company-applications#workplace-join-as-a-seamless-second-factor-authentication). Typically these devices are bring-your-own-devices (BYOD) that have a work or school account added via **Settings** > **Accounts** > **Access work or school**.  
->
->   On WPJ devices, device context PowerShell scripts work, but user context PowerShell scripts are ignored.
-
-:::column-end:::
-:::row-end:::
-
-You also need to create a:  
-
-- **Discovery script** - A PowerShell script for Windows or a POSIX-compliant shell script for Linux that you create. The script runs on a device to discover the custom settings defined in your JSON file. The script returns the configuration value of those settings to Intune. You need to upload your script to the Microsoft Intune admin center before you create a compliance policy and then select the script you want to use when creating a policy.
+- **Discovery script** - A PowerShell for Windows or a POSIX-compliant shell script for Linux or macOS that you create. The script runs on a device to discover the custom settings defined in your JSON file. The script returns the configuration value of those settings to Intune. You need to upload your script to the Microsoft Intune admin center before you create a compliance policy and then select the script you want to use when creating a policy.
 
   To create a custom compliance script, see [Custom compliance discovery scripts for Microsoft Intune](./create-custom-script.md).
 
@@ -96,7 +71,7 @@ When ready, use the normal procedure to [create a compliance policy](./create-po
 
 Use the following methods to view details about a device’s compliance status.
 
-- For both Linux and Windows devices, you can view per-setting device compliance details for custom compliance settings in the Microsoft Intune admin center.
+- For Linux, macOS, and Windows devices, you can view per-setting device compliance details for custom compliance settings in the Microsoft Intune admin center.
 
   In the admin center, go to **Reports** > **Device compliance**, and then select the **Reports** tab. Select the tile for **Noncompliant devices and settings**, and then use the drop-down menus to configure the report. Be sure to select a platform for the OS, and then select **Generate** report.
 
@@ -143,7 +118,9 @@ It can take up to eight hours before a noncompliant status shows as compliant af
 
 - On Linux, a user can open the *Microsoft Intune app* and select **Refresh** on either the device details page or the compliance issues page to start a new check-in with Intune.
 
-### Why aren't more operators and operands supported?
+- On macOS, a user can open the Company Portal app, select **Devices**, select their device, and then select **Check Status**.
+
+### Why aren’t more operators and operands supported?
 
 Contact your account manager to request the addition of specific operators and operands. They can then be considered for a future update.
 

intune/device-security/compliance/overview.md

@@ -92,8 +92,11 @@ The following topics link to dedicated articles for different aspects of device
 - [**Custom compliance settings**](./custom-settings.md) - By using custom compliance settings, you can expand on Intune's built-in device compliance options. Custom settings provide flexibility to base compliance on the settings that are available on a device without having to wait for Intune to add those settings.
 
   You can use custom compliance settings with the following platforms:
-  - Linux – Ubuntu Desktop, version 24.04 LTS or 26.04 LTS; RedHat Enterprise Linux 9 or 10
-  - Windows
+  - Linux 
+    - Ubuntu Desktop, version 24.04 LTS or 26.04 LTS
+    - RedHat Enterprise Linux 9 or 10  
+  - macOS
+  - Windows  
 
 ## Monitor compliance status