Don’t consider this in any way finished, I had a spare couple of hours after the Formula 1 and have been meaning to check this out for a while! Jotting notes for a future, polished post. This was mainly for Nathan McNulty, who I’m sure will do much better with this information than I have here. Plus I finally had an excuse to look.

What’s App Settings?

This is one of Apple’s new pieces of funcitonality in macOS 27. If you’ve been poking around Intune or looked at any comments for it, it looks remarkably similar to NorthPoleSec’s Santa. Anyone managing allowed apps on macOS are likely already looking at this.

App Settings seems to be very similar base functionality, baked right into macOS itself. Fancy.

Is it Santa-like?

Yes.

As a man who has not managed Santa in multi-thousand Mac user organisations, I have not really looked at some of the wider functionality in Santa’s Workshop around managing it at scale. I would primarily build mobileconfig files myself on a case-by-case basis where I support smaller Mac user bases.

The core functionality of allowlisting a Team ID, CD Hash, Signing ID’s… very much the same.

Santa is a very mature product though, and you may be considering migrating from Santa to a native option instead to lower your dependencies on third-parties. Currently, that doesn’t seem to be a bad move. If you use the larger suite of NorthPoleSec functionality though, maybe hold fire. I’m sure someone, somewhere is vibe-coding the dashboard of your dreams.

Where does Intune come into this?

Intune supports this functionality on macOS 27 immediately - I’ve noticed some gotcha’s though from my testing.

  • Make sure to allow Microsoft’s TeamID (UBF8T346G9). You can scope this to particular apps too through SigningID.
  • Allow Apple’s non-TeamID TeamID (*APPLE*). By design, Apple have made this so it can’t brick the OS. It can, however, still make it a royal pain to use.
  • I would expect deny to win over allow, but I didn’t get time to test.
  • It doesn’t seem to have an Audit mode.
  • AllowedBinaries is for macOS, AllowedApps is for all other Apple platforms. All of them. Except watchOS. Exciting.
  • When blocking some apps, they don’t seem to always notify the end user they were blocked by the organisation.
  • I haven’t tested the ‘Always Allow Managed Apps’ setting. My assumption is this would allow VPP provided apps, but at this stage I honestly don’t know.

Final thoughts

I’ll be moving to App Settings over time. There’s no immediate rush for me to push users from Santa to it unless they’re doing a fresh implementation, but Santa is still a more fully featured product with its Workshop suite. Their web interface also can appear less daunting than having to dig for TeamIDs. Personally, I like a challenge. Don’t need no GUI.