How to Deploy Microsoft Scout via Intune: Complete Admin Guide

Microsoft Scout only works after an IT admin enables it at the tenant level. Individual users cannot install the app and sign in on their own, even if they meet every personal prerequisite. This guide walks Intune administrators through the full deployment process, from importing the Windows policy template to configuring macOS devices and troubleshooting common rollout issues.

Before you follow this guide, confirm your organization has already completed Frontier enrollment at the Microsoft 365 admin center level. That is a separate, earlier gate. This guide only covers the device-level Intune deployment that comes after Frontier access is turned on for your tenant.

Microsoft Scout Intune Deployment Steps

You will import the Microsoft Scout ADMX/ADML template into Intune, create a Windows configuration policy that turns on Frontier access, then build a matching macOS configuration profile so both platforms receive the same tenant policy.

The rollout happens in three parts. Each part maps to one section below:

1. Part 1: Import the Microsoft Scout Windows ADMX/ADML templates into Intune
2. Part 2: Create a Windows configuration policy, enable Frontier access inside it, and assign it to devices
3. Part 3: Create and assign a matching macOS configuration profile

Prerequisites

Before you start, make sure you have the following:

• A Microsoft 365 work or school account associated with your organization (personal accounts do not work)
• Intune tenant administrator credentials
• Access to the Microsoft Intune admin center at intune.microsoft.com
• The latest Microsoft Visual C++ Redistributable (Windows devices only)
• The Microsoft Scout Windows policy template files: microsoft-scout.admx and microsoft-scout.adml
• The Microsoft Scout macOS configuration profile file: microsoft-scout.mobileconfig

Microsoft publishes these template and profile files on its official GitHub organization. Search “Microsoft Scout Intune templates” on GitHub, or check Microsoft’s Frontier documentation portal for the current download link, since Microsoft occasionally moves the repository while Scout is still in preview. Download all three files before you start Part 1.

Part 1: Import the Microsoft Scout ADMX Template

Importing the template makes Microsoft Scout’s settings available when you create a Windows configuration policy.

1. Go to intune.microsoft.com and sign in with your tenant administrator credentials. Confirm the admin center loads for the correct tenant.
2. In the left navigation, select Devices. Under Manage devices, select Configuration, then open the Import ADMX tab.
3. Select Import, then upload both template files using the file picker: the ADMX file (microsoft-scout.admx) and the ADML file (microsoft-scout.adml). Once both filenames appear on the page, select Next.
4. On Review + create, confirm both files are listed correctly, then select Create.
5. Wait for Intune to finish uploading and processing the template. Do not continue until the import status shows complete.
6. Once the upload finishes, confirm the Microsoft Scout template status reads Available. You can now use it to build a Windows configuration policy.

Part 2: Create the Windows Microsoft Scout Policy

This policy turns on Frontier access for the devices you assign it to. Follow these steps in order.

1. Return to Devices, then Configuration. Open the Policies tab and select New policy.
2. Choose Windows 10 and later as the platform and Templates as the profile type.
3. Select Imported Administrative Templates from the template list. This pulls in the Microsoft Scout template you imported in Part 1. Select Create to open the policy setup screen (this starts the policy, it does not finish it yet).
4. Give the policy a clear name, such as “Microsoft Scout – Frontier access.” Add a description if you want, then select Next.
5. On Configuration settings, select the imported Microsoft Scout configuration template, then choose the correct policy version from the available options.
6. Under Microsoft Scout, then Capabilities, open the setting named Allow Microsoft Scout Frontier access.
7. Set it to Enabled, then select OK.

Important: this is the setting that actually controls sign-in. It enables the AllowScoutFrontierAccess capability on any device that receives the policy. If this setting stays disabled or unconfigured, users on Frontier builds see a waitlist screen and cannot sign in, even after installing the app.

1. On Scope tags, leave the default scope tags unless your organization needs a specific Intune RBAC scope tag. Select Next.
2. On Assignments, choose which groups or devices should receive the policy. Assign to All devices for a full tenant rollout, or target a smaller pilot group if you are testing first.
3. Review the policy summary, confirm the Frontier access setting shows as enabled, then select Create to finish the policy.
4. Confirm the new policy appears in your configuration policy list.

Part 3: Create the macOS Microsoft Scout Policy

With Windows covered, repeat the process for any Mac devices in your fleet. Mac devices need a separate custom configuration profile that carries the same tenant policy, since macOS does not use ADMX templates.

1. Return to Devices, then Configuration. Select New policy to start a macOS profile.
2. Choose macOS as the platform, Templates as the profile type, and Custom as the template name. Select Create.
3. Name the profile clearly, for example “Microsoft Scout – macOS Frontier access.” Add a description if needed, then select Next.
4. On Configuration settings, upload microsoft-scout.mobileconfig and set the following values:

1. Once the file uploads and its contents appear, select Next.
2. On Assignments, choose the devices or groups that should receive the macOS profile. Assign to All devices for a broad rollout, or scope it to a pilot group first.
3. Review the summary, confirm the uploaded file is listed correctly, then select Create.
4. Confirm the macOS profile appears in your configuration policy list.

How to Verify Microsoft Scout Deployment Was Successful

Creating the policies in Part 2 and Part 3 only confirms the configuration was saved correctly. It does not confirm sign-in actually works. Both the Windows policy and the macOS profile need to sync to their target devices before anyone can actually sign in. Before rolling this out tenant-wide, confirm the deployment works on at least one device per platform:

• Confirm the Windows policy shows AllowScoutFrontierAccess as enabled through the Allow Microsoft Scout Frontier access setting
• Confirm assigned devices actually belong to your target groups
• Give Intune policy sync enough time to complete on target devices
• On a managed Frontier device, open Microsoft Scout and check that the user can sign in without hitting the waitlist screen

Microsoft Scout Intune Deployment Troubleshooting

Frequently Asked Questions

Related Articles

• How to Install Microsoft Scout Agent on Windows and macOS
• How to Run Git and Shell Commands Using Microsoft Scout
• How to Configure Microsoft Scout Heartbeats and Automations
• How Microsoft Scout for Developers Automates Git and Shell Tasks
• How to Automate Microsoft 365 Using WorkIQ With Microsoft Scout