Lead MacOS Intune MDM/MAM Engineer

Job Title: Lead macOS Intune MDM/MAM Engineer Location: Denver, CO (Hybrid) Visa: USC & Green Card Interview: Zoom Position Overview We are seeking a highly skilled Lead macOS Intune MDM/MAM Engineer to lead enterprise management of macOS devices using Microsoft Intune (Endpoint Manager). This role focuses on securing, deploying, and managing Apple devices using Apple Business Manager (ABM), Automated Device Enrollment (ADE), Microsoft Entra ID (Azure AD), Platform SSO, FileVault, Secure Enclave, Microsoft Defender for Endpoint, and Conditional Access. The ideal candidate has extensive experience with enterprise macOS management, identity integration, endpoint security, Zero Trust architecture, passwordless authentication, and BYOD management within the Microsoft ecosystem. Key Responsibilities macOS Device Management • Design, deploy, and manage enterprise macOS devices using Microsoft Intune MDM. • Create and maintain configuration profiles, compliance policies, endpoint security policies, and device restrictions. • Manage the complete macOS device lifecycle from provisioning through retirement. Apple Business Manager & ADE • Integrate Apple Business Manager (ABM) with Microsoft Intune. • Configure Automated Device Enrollment (ADE/DEP) for zero-touch deployment. • Manage enrollment profiles, enrollment tokens, and Apple Volume Purchase Program (VPP). Mobile Application Management • Deploy App Store and enterprise applications through Intune. • Configure Mobile Application Management (MAM) policies. • Implement app protection policies for corporate and BYOD macOS devices. Identity & Authentication • Configure Microsoft Entra ID Platform SSO. • Implement passwordless authentication using Secure Enclave, Touch ID, passkeys, and FIDO2. • Deploy Microsoft Enterprise SSO Plug-in and Apple Extensible SSO. • Integrate macOS authentication with Microsoft Entra ID. Endpoint Security • Configure FileVault full-disk encryption and recovery key escrow. • Implement SecureToken and Secure Enclave security features. • Deploy Microsoft Defender for Endpoint for macOS. • Configure Conditional Access, compliance policies, MFA, and Zero Trust security controls. BYOD Management • Develop secure BYOD strategies using Intune MAM. • Configure app protection policies and Conditional Access. • Ensure corporate data remains protected on personal macOS devices. Identity & Security • Implement Azure AD Identity Protection and Smart Lockout policies. • Protect against password spray and identity-based attacks. • Collaborate with IAM and Security teams on authentication and compliance initiatives. Troubleshooting • Resolve complex Intune enrollment, ADE, FileVault, SecureToken, Platform SSO, and authentication issues. • Perform root-cause analysis for device and identity problems. • Optimize Intune policies and user experience. Documentation & Leadership • Develop technical documentation, SOPs, runbooks, and deployment guides. • Mentor junior engineers and support teams. • Evaluate new Microsoft and Apple technologies for continuous improvement. Required Qualifications • Bachelor's degree in Computer Science, Information Technology, or related field. • 5+ years of enterprise macOS administration. • 3+ years of Microsoft Intune administration focused on macOS. • Strong expertise in: • Microsoft Intune (Endpoint Manager) • Apple Business Manager (ABM) • Automated Device Enrollment (ADE/DEP) • Microsoft Entra ID (Azure AD) • Platform SSO • Microsoft Enterprise SSO Plug-in • FileVault • SecureToken • Secure Enclave • Passkeys & FIDO2 Authentication • Microsoft Defender for Endpoint • Conditional Access • MFA • Apple MDM configuration profiles • Compliance and Endpoint Security policies • Strong understanding of SAML, OAuth, OIDC, Kerberos, and identity management. • Experience with Bash, PowerShell, Python, or Microsoft Graph API automation. • Excellent troubleshooting, documentation, leadership, and communication skills. Preferred Qualifications • Microsoft 365 Certified: Modern Desktop Administrator Associate • Microsoft Certified: Identity and Access Administrator • Microsoft Enterprise Administrator Expert • Apple Certified Support Professional (ACSP) • Experience with Microsoft Sentinel, Azure AD Identity Protection, CIS Benchmarks, NIST, and Zero Trust security. • Experience managing iOS/iPadOS devices with Intune. • Cross-platform endpoint management (Windows/macOS). Key Skills • Microsoft Intune (MDM/MAM) • macOS Administration • Apple Business Manager (ABM) • Automated Device Enrollment (ADE) • Microsoft Entra ID (Azure AD) • Platform SSO • FileVault • SecureToken • Secure Enclave • Microsoft Defender for Endpoint • Conditional Access • MFA • BYOD Management • Zero Trust • Endpoint Security • Apple MDM • VPP • Microsoft Graph API • PowerShell • Bash • Python • Identity & Access Management • SAML • OAuth • OIDC • Kerberos • Endpoint Compliance • Enterprise Mobility • Technical Leadership • Documentation • Troubleshooting