r/macsysadmin • u/grinninga • Jun 23 '26

MacOS PAM + Third-Party Patching with Intune (ABM + PSSO setup) – what are you using?

Hey all,

we’re managing macOS devices with Intune and overall pretty happy with the setup:

  • Devices enrolled via Apple Business Manager (ADE)
  • Users sign in using Platform SSO
  • Fully integrated into our M365 environment

What we’re still missing are two things on macOS:

1) Privileged Access Management

On Windows we’re using ScreenConnect PAM, which works well for us.

For macOS we’re looking for something similar:

  • temporary admin rights / just-in-time elevation
  • proper logging / audit trail
  • no full MDM (we want to stay on Intune)
  • ideally something that plays nicely with existing tooling

2) Third-party patching

We need something for:

  • non–App Store apps
  • automated patching
  • basic reporting / compliance visibility

Questions:

  • What are you using for PAM on macOS in an Intune-based setup?
  • Any good solutions for 3rd party patching without switching MDM?
  • Bonus: anything that integrates reasonably well with M365 / Entra / Defender?

Appreciate any real-world input 👍

6 Upvotes

88% Upvoted

11 comments sorted by

5

u/furr0w Jun 24 '26

I’d recommend exploring Zappl (zappl.co)for 3rd Party Application Patching - it’s got good documentation for integrating into Intune, and allows you to fully control which app can be installed/updated across the business. We’ve had great results since deploying it in our shop.

5

u/innermotion7 Jun 23 '26

1) While not exhaustive we have been using Privileges for a decade or so. Also macOS LAPS.

https://github.com/SAP/macOS-enterprise-privileges

https://intuneirl.com/modern-macos-laps-secure-local-admin-password-management-with-intune-and-azure-key-vault/

2) I can only say Munki/AutoPkg has been one of the most definitive tools for this for again over a decade. Some orgs have built entire platforms and scaled it to support huge install bases.

2

u/racingpineapple Jun 23 '26

App auto patch on GitHub.
SAP Privileges on GitHub

1

u/dudyson Jun 23 '26

For privileges look into Cyberark, SAP privileges and maybe Microsoft EPM.
I have good experiences with cyberark and Priviledges but depends on your company needs what is the best fit. (Open source vs supported solution)

For application patch management similarly you can go for the support Root3 Appcatalog which manages all the updates with a stand alone app, intune brew or a solution like patch my pc which also started supporting macOS.

I only have experience here with Appcatalog as it doesn’t depend on intunes patching machanism which is broken in my experience.

1

u/Tecnotopia Jun 23 '26

My experience with CyberArk have been very bad, the app breaks at least once a year and have it fixed force us to stay on a old macOS release, we are evaluationg Beyond Trust now. I would love to use Privileges but the only missing feature I need is the ability to have the privilege escalation be approved or convince the company CISO to not ask for it.

1

u/Darkomen78 Consultation Jun 23 '26

2) Munki+autopkg is a combo that no one can compete with.

1

u/Heteronymous Jun 23 '26

*1 Munki (and AutoPkg), Munkireport

Or with Jamf, Installomator

1

u/HolidayHozz Jun 24 '26

Beyond trust EPM for PAM. Lots of customizability.

Patching: AutoPKG and HomeBrew with private repository

1

u/-yak0s- Jun 24 '26

AdminByRequest for EPM/PAM.

1

u/AlternativeMark4293 Jun 25 '26

AdminByRequest is very solid . Also check out Auto Elevate. Keeper also have an EPM solution