By: Iris Yuning Ye, Product Manager | Microsoft Intune

Organizations that manage Mac devices need a reliable way to evaluate their security posture against a recognized baseline. Microsoft Intune custom compliance provides the device compliance evaluation policy, and the National Institute of Standards and Technology’s (NIST) macOS Security Compliance Project (mSCP) provides macOS security rules and checks mapped to compliance requirements.

Earlier this year we released Intune custom compliance for macOS devices. The feature uses a discovery script and JSON file to define compliance settings. With the mSCP command-line tool, you can select and tailor a security baseline, generate a macOS discovery script, and pair the discovered identifiers with an Intune rules JSON file. Intune then evaluates each device against the chosen baseline and uses the result in compliance reporting and Conditional Access decisions.

In this blog, we’re introducing a JSON conversion script (mscp_to_intune_json_conversion.sh). The script converts the mSCP’s generated vendor manifest into the JSON format required for Intune custom compliance.

Figure 1:

Prerequisite

Before you begin, set up the mSCP locally by following the NIST guidance: Getting started with the macOS Security Compliance Project.

Create a security baseline

Next, we’ll establish and configure the security baseline on the device.

1. Select your security baseline: Choose a security baseline your organization intends to evaluate devices against by looking through frameworks supported by mSCP (for the example in this blog we’ll use CIS Level 1)
2. Configure your baseline: When creating the baseline for the first time, you'll follow a guided process to specify the name of the custom baseline, your name and organization, choose what specific rules to include or exclude.

Once the customization process is completed, a new baseline file containing all the rules you specified is generated under the custom/baselines/ directory as a YAML file.

./mscp.py baseline –k cis_lvl1 –t

Figure 2: Sample results after running the baseline keyword and tailoring command.

Figure 3: Sample of tailoring each security baseline rule to your organization's need.

Once the baseline YAML file is generated, run the command below to generate mSCP documents. These files will be saved into a build/[your specified project name] directory.

./mscp.py guidance –s –M [yaml file location]

The yaml file location should be the relative location on top of your mSCP folder.

Figure 4: Command line shows mSCP document generation complete.

Once the JSON Vendor Manifest and compliance script are successfully generated, we highly recommend running a test check to verify that all rules and values are defined as expected.

The key is to locate where you build folder is and where the .sh file was saved in:

sudo ./[base folder]/cis_lvl1_macos_27.0/cis_lvl1_macos_27.0_compliance.sh --check

Figure 5: Run check to confirm security baseline rule was set as expected.

Create mobileconfig file

Create a mobileconfig file by creating a plain text file, then copy and paste the example in GitHub into it.

Figure 6: Sample mobileconfig file.

Configure the .mobileconfig profile

1. Update the PayloadType key to match the audit file name. This ensures the compliance script uses the correct managed arguments when running.
   Example: In our demo, the value is updated to:
   

   org.intune_compliance_lv1_macOS_26.0.audit

2. Customize the following keys based on your organization's requirements and preferences:
   • PayloadDescription
   • PayloadOrganization
   • PayloadDisplayName

Test the .mobileconfig profile

To verify the configuration, install the .mobileconfig profile locally on a test MacOS device.

1. Open System Settings > General > Device Management.
2. Select the + button to add a configuration profile.
3. Navigate to the saved .mobileconfig file, select it, and click Open.
4. Follow the prompts to Continue and Install the profile.

Validating the Results:
Once the profile is installed, run the generated compliance script. If the script runs successfully and outputs JSON, the managed arguments are correctly set. Run the generated compliance script with no arguments specified to make sure it uses the managed arguments from the installed mobileconfig file.

sudo ./[base folder]/cis_lvl1_macos_27.0/cis_lvl1_macos_27.0_compliance.sh

Figure 7: Sample result from running the script locally.

Once testing is complete, remove the test profile for your local Mac. It’s critical to ensure all testing profiles are removed from target devices before deploying from Intune to avoid conflicts.

You can deploy the custom mobileconfig profile for the managed arguments using Intune to the desired set of macOS devices.

Use JSON conversion script

Next, use the mscp_to_intune_json_conversion.sh script from GitHub to convert the mSCP JSON Vendor Manifest file into the specific JSON format required for Intune’s custom compliance policy. The command line is comprised of three parts:

1. Locate where you saved the conversion script.
2. Specify the JSON file from security baseline you intend to convert from.
3. Specify the name of the custom compliance JSON file you intend to convert to.

~/ mscp_to_intune_json_conversion.sh [base folder]/cis_lvl1_macos_27.0/cis_lvl1_macos_27.0_compliance.json > intune_custom_compliance.json

Figure 8: Using JSON conversion script to convert mSCP generated rule file into Intune custom compliance policy compatible JSON file.

You can now upload the compliance script built by the mSCP that can be found in the build directory as your Discovery Script within Intune’s custom compliance policy.  You can also upload the converted JSON file as the JSON for custom settings.

Devices with the mobileconfig profile installed will run the compliance script using the managed arguments and output the JSON required for the custom discovery script.

Keep in mind

• Start with a small pilot group and a focused baseline of your choice.
• Validate every identifier, returned data type, and expected value before broad deployment.
• Deploy mobileconfig file and make sure the file is already successfully deployed on target devices before custom compliance policy.
• Review the per-setting results in the Intune admin center > Reports > Device compliance -> Noncompliant devices and settings.
• Make sure the JSON file generated is aligned with other discovery scripts’ output to avoid misalignment errors.
• The recommended first step is to pilot one baseline on a small Mac device group, document the source version and rule mapping, and expand only after the discovery script output and Intune results have been validated.

Conclusion

The steps and scripts provided simplifies the flow to connect the mSCP with Intune’s custom compliance feature. By leveraging mSCP, organizations can efficiently translate recognized macOS security guidance into actionable, measurable compliance signals. While Intune provides the mechanism to capture identifiers and current device values, the rules JSON define the precise evaluation criteria. Together, these tools create a transparent, automated path from a high-level security baseline to detailed, device-level compliance reporting.

Disclaimer

Collaboration on this post does not imply NIST endorsement of the products or services offered by Microsoft. Any mention of specific tools or software is for informational purposes and does not constitute a recommendation by NIST.