Deploy plist preferences

Write a preference file for a Microsoft app and ship it with Jamf Pro or Intune.

Microsoft's Mac apps read their settings from property list files. Put the right key in the right plist and the app follows it. Deliver that plist through your MDM as a managed preference and it applies to every Mac you scope, and users cannot change it. This guide uses Outlook as the example.

Example app OutlookDomain com.microsoft.OutlookKey PlayMyEmailsEnabled

Create the file

A plist is XML. Open any plain text editor, such as Visual Studio Code or TextEdit in plain text mode, and add the declaration, a root plist element, and a dict holding your keys.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PlayMyEmailsEnabled</key>
    <false/>
</dict>
</plist>

This turns off the Play My Emails feature in Outlook. Save it as com.microsoft.Outlook.plist. The file name is the app's preference domain, and each app or suite has its own. Add as many keys as you need to the same dict.

Where plist files live

macOS reads preferences from three places. Which one you use decides who the setting applies to and whether users can override it.

User~/Library/Preferences/
One local account only. The app writes here when the user changes a setting.

Computer/Library/Preferences/
Every account on the Mac. Set by scripts or by hand. User preferences take priority over it.

Managed/Library/Managed Preferences/
Written by your MDM. Applies to every account and overrides both of the others. This is where a deployed plist ends up.

Deploy with Jamf Pro

1. Create a configuration profileGo to Configuration Profiles, New, and add the Application & Custom Settings payload. Upload the plist, or paste its XML, with com.microsoft.Outlook as the preference domain.

2. Scope itAssign the profile to the Smart Groups or Static Groups that should receive it.

3. SaveDevices pick it up on their next MDM check-in. Check the profile's status tab to watch it land.

Deploy with Intune

Intune gives you three ways in. Pick the one that fits. Whichever you choose, go to Devices, macOS, Configuration profiles, Create profile in the Intune admin center.

Settings catalog RecommendedNo plist needed. Choose Settings catalog, search for the setting, and tick it. Nearly every Microsoft app key is in there.

Preference fileFor keys the catalog does not have yet. Choose Templates, Preference file, enter the domain, and upload a stripped plist. See the example below. Intune wraps it into a mobileconfig for you.

Custom profileWrap the plist into a mobileconfig yourself with ProfileCreator or iMazing, then choose Templates, Custom, and upload it. Most control, most work.

A preference file is the plist with its wrapper removed. Keep only what sits inside the dict, and save it as .xml.

<key>PlayMyEmailsEnabled</key>
<false/>
<key>DefaultEmailAddressOrDomain</key>
<string>example.com</string>

Not sure whether a key is in the settings catalog? The DeviceConfig repo lists every key it supports, for Mac and iOS. If you use the settings catalog and a preference file together, do not set the same key in both. Keys must be unique across the profiles that reach a device. After any of the three options, assign the profile to your user or device groups and save. Devices apply it on their next sync.

Test and validate

1. Look for the fileOn a scoped Mac, confirm the plist landed in /Library/Managed Preferences/. If it is not there, the profile has not arrived yet.

2. Read it backAsk the preferences system what value the app will actually see. The command below should print 0.

3. Check the consoleJamf Pro shows status per device on the profile. Intune has device status under the profile's monitoring reports.

ls "/Library/Managed Preferences/"
defaults read com.microsoft.Outlook PlayMyEmailsEnabled

Before rolling out widely, scope to a small test group and open the app. A wrong key name fails silently, so the only real test is seeing the setting change. Double check the bundle identifier too. Outlook is com.microsoft.Outlook, with a capital O.

Troubleshooting

Profile never arrivesCheck the device is in scope and has checked in. Force a sync from the console, or run sudo jamf policy on Jamf, and watch the profile list in System Settings.

Setting does not changeRun the defaults read check. If the value is right but the app ignores it, the key name or type is wrong. Compare against Microsoft's reference for that app.

Works for some users onlyManaged preferences win over user preferences, so if a user's copy still differs the profile is not applying to that account. Check scope and whether the profile is user or device level.

Further reading

Mac Admins preferences listCommunity spreadsheet of every known Office for Mac preference key. Start here.

Deploy preferences for OfficeMicrosoft's overview of plist-based preferences for the Mac apps.

Set preferences per appHow to target Word, Excel, PowerPoint and the rest individually.

Outlook preferencesEvery key Outlook for Mac reads, including the one used in this guide.

Office suite preferencesKeys shared across the whole suite, such as sign-in and privacy.

Property List Programming GuideApple's reference for the plist format itself, types and all.

Want to see a finished profile before writing your own? The breakdown page walks through a real MOFA mobileconfig key by key.

Profile breakdownPreconfigured profiles

RelatedHow To SHA256How To SHA1Feedback