Custom compliance settings for macOS in Intune: the script, the rules, and the type mismatch that wastes your afternoon

Intune macOS custom compliance arrived in service release 2607, which finally puts the Mac estate level with Windows and Linux. If you have been approximating Mac compliance with the built-in settings and quietly accepting the gaps, that workaround is over. The Windows equivalent, and the sync mechanics behind both, are in forcing an Intune sync.

What Intune macOS custom compliance actually is

A shell script that emits JSON, plus a JSON rules file that says what the values should be. Intune runs the script, reads the output, compares it against the rules, and surfaces the result alongside the built-in compliance settings in the normal reporting. The pattern is identical to Windows with PowerShell and to Linux, so if you have written one before there is nothing new to learn. Microsoft covers the shared pattern in Use custom compliance settings in Microsoft Intune.

The point is that it evaluates things the built-in settings never covered. Configuration profiles you care about, a specific agent being present and running, a setting your security team asked for that Microsoft has not shipped a toggle for. Compliance state only matters once it reaches Entra, which is where Conditional Access policy design picks it up, and device based Conditional Access needs at least Entra ID P1.

The script

One rule: it must write a single flat JSON object to standard output and nothing else. That constraint is stated in the discovery script reference and it is absolute. Any stray echo, warning or debug line and the whole evaluation fails rather than returning a wrong answer, which is at least an honest failure mode.

1#!/bin/bash
2# Intune custom compliance for macOS.
3# Emits ONE flat JSON object on stdout. Nothing else, ever.
4
5# FileVault
6if fdesetup status | grep -q “FileVault is On”; then
7    filevault=”true”
8else
9    filevault=”false”
10fi
11
12# Firewall: 0 = off, 1 = on for specific services, 2 = on for essential services
13fw=$(/usr/libexec/PlistBuddy -c “Print :globalstate”
14     /Library/Preferences/com.apple.alf.plist 2>/dev/null)
15[ -z “$fw” ] && fw=0
16
17# System Integrity Protection
18if csrutil status | grep -q “enabled”; then
19    sip=”true”
20else
21    sip=”false”
22fi
23
24# Minor version of the running OS, useful for gating on patch level
25osver=$(sw_vers -productVersion)
26
27# Single line, no trailing output.
28echo “{“FileVault”:”$filevault”,”Firewall”:$fw,”SIP”:”$sip”,”OSVersion”:”$osver”}”

The rules file

Each rule names a key from the script output, an operator, a data type and the expected value. The remediation strings are what the user sees in Company Portal, so write them as instructions rather than as a description of the failure. If a device never reports a result at all, work the Intune device not syncing diagnosis order first.

1{
2  “Rules”: [
3    {
4      “SettingName”: “FileVault”,
5      “Operator”: “IsEquals”,
6      “DataType”: “String”,
7      “Operand”: “true”,
8      “MoreInfoUrl”: “https://support.apple.com/guide/mac-help/mh11785”,
9      “RemediationStrings”: [
10        {
11          “Language”: “en_US”,
12          “Title”: “Turn on FileVault disk encryption”,
13          “Description”: “Open System Settings, then Privacy and Security, then FileVault, and select Turn On.”
14        }
15      ]
16    },
17    {
18      “SettingName”: “Firewall”,
19      “Operator”: “IsGreaterThan”,
20      “DataType”: “Int64”,
21      “Operand”: 0,
22      “MoreInfoUrl”: “https://support.apple.com/guide/mac-help/mh34041”,
23      “RemediationStrings”: [
24        {
25          “Language”: “en_US”,
26          “Title”: “Turn on the firewall”,
27          “Description”: “Open System Settings, then Network, then Firewall, and switch it on.”
28        }
29      ]
30    },
31    {
32      “SettingName”: “SIP”,
33      “Operator”: “IsEquals”,
34      “DataType”: “String”,
35      “Operand”: “true”,
36      “MoreInfoUrl”: “”,
37      “RemediationStrings”: [
38        {
39          “Language”: “en_US”,
40          “Title”: “System Integrity Protection is disabled”,
41          “Description”: “Contact IT. Re-enabling SIP requires starting up in Recovery.”
42        }
43      ]
44    }
45  ]
46}

Rolling it out without locking anyone out

1. Set the non-compliance action to nothing at first. Compliance policies are reporting only until Conditional Access consumes them, and you want the reporting before the enforcement.
2. Run against a pilot group and read the results, not the intent. Custom compliance surfaces real estate variety very quickly, which is the point.
3. Only then wire it to Conditional Access. A custom rule with a bug plus a block policy is how you lock a fleet of Macs out of the tenant at 09:00.

What I would do

Start with three rules, not thirty. FileVault, firewall, and whichever single thing your security team asks about most often. Three rules that everyone trusts beats a comprehensive policy nobody believes.

And keep the script boring. Every conditional you add is another way for it to emit something that is not valid JSON, and the failure mode for that is a device that reports non-compliant for reasons nobody can see.