<!-- Device Inventory Manager — https://wiki.cyberguard.srl/dim/agents/macos-intune/ -->

# macOS with Microsoft Intune

On macOS the agent is deployed in two parts, both assigned to the same group of Macs:

1. a **macOS app (PKG)** that installs the agent;
2. a **shell script** that copies your `config.dat` to the Mac.

The two parts are independent: the script waits for the agent to be installed before applying `config.dat`, so the order in which Intune runs them does not matter.

The agent supports Macs with Apple Silicon. Intel Macs are not supported. Software metering is not available on macOS.

## What you need

- The macOS package: **My Tenant** › **Edit** › **Agent** › **Download macOS agent**.
- A `config.dat` from the same tab (see [Enrollment campaigns and config.dat](https://wiki.cyberguard.srl/dim/agents.md#enrollment-campaigns-and-configdat)).
- A place where the Macs can download `config.dat` over HTTPS, for example a file in your Azure Storage account shared through a link with limited access.
- Permission to create apps and scripts in the Microsoft Intune admin center.

The macOS package is a ZIP file containing:

| File | Purpose |
| --- | --- |
| `CyberGuard-DIM-Agent-osx-arm64.pkg` | The agent installer for Apple Silicon. |
| `Install-CyberGuardDIMAgent-Config.sh` | The script that installs `config.dat` on the Mac. |
| `INSTALL-MACOS-IT-EN.txt` | Installation notes in Italian and English. |
| `CyberGuard-DIM-Agent-Icon.png` | Icon for the app in Intune and Company Portal. |
| `Uninstall-CyberGuardDimAgent.sh` | The script that removes the agent (see [Removing the agent](#removing-the-agent)). |
| `Diagnose-MacOSAgent.sh` | A read-only check for a Mac that does not appear in the portal (see [Troubleshooting](#troubleshooting)). |

## 1. Publish config.dat

Upload your `config.dat` to a location the Macs can reach over HTTPS and note its address, for example:

```text
https://contosostorage.blob.core.windows.net/cyberguard/config.dat?<access token>
```

Anyone who has this address can download the file, so share it only through your deployment and do not publish it elsewhere.

## 2. Create the app in Intune

In the Microsoft Intune admin center, go to **Apps** › **macOS** › **Create** and choose **macOS app (PKG)**. Do not use *Line-of-business app*. Upload `CyberGuard-DIM-Agent-osx-arm64.pkg`.

**App information**

| Field | Value |
| --- | --- |
| Name | `Inside Technologies CyberGuard DIM Agent` |
| Description | The CyberGuard DIM agent automatically collects information about company devices (hardware, operating system, installed applications, security status) and securely sends it to the Inside Technologies CyberGuard Device Inventory Manager portal, keeping the company's IT inventory always up to date. |
| Publisher | `Inside Technologies` |
| Logo | `CyberGuard-DIM-Agent-Icon.png` from the package |

**Program**

Paste this as the **Pre-install script** and leave the post-install script empty:

```bash
#!/bin/sh
softwareupdate --install-rosetta --agree-to-license 2>/dev/null || true
launchctl bootout system/com.insidetechnologies.cyberguard.dim-agent 2>/dev/null || true
exit 0
```

The first line installs Rosetta 2, which the current package still needs on Apple Silicon. The second stops the agent before an update replaces its files.

**Detection rules**

| Field | Value |
| --- | --- |
| Ignore app version | **No** |
| Included apps: bundle ID | `com.insidetechnologies.cyberguard.dim-agent` |
| Included apps: version | The agent version you are publishing, for example `1.7.16` |

> **Set *Ignore app version* to No.** With the default *Yes*, Intune only checks that some version of the agent is present: once a Mac has the agent, it is never updated again.

**Assignments**

Assign the app as **Required** to your group of Macs.

## 3. Create the configuration script

1. Open `Install-CyberGuardDIMAgent-Config.sh` in any text editor. You do not need a Mac to prepare it.
2. Near the top of the file, replace the value of `CONFIG_SOURCE` with the address from step 1:

   ```bash
   CONFIG_SOURCE='https://contosostorage.blob.core.windows.net/cyberguard/config.dat?<access token>'
   ```

3. Save the file without changing anything else.
4. In the Intune admin center, go to **Devices** › **macOS** › **Scripts** › **Add** and upload the file.
5. Set **Run script as signed-in user** to **No**, so that the script runs as root.
6. Choose the script frequency according to your policy: once is enough, and a recurring schedule also repairs a Mac where the file was removed.
7. Assign the script to the same group as the app.

The script downloads `config.dat`, installs it with permissions that only the system can read, restarts the agent and checks that it is running. Its log is in `/Library/Logs/Inside Technologies/CyberGuard DIM Agent/config-install.log`.

> The edited script points to your tenant's `config.dat`. Use it only in your own Intune tenant.

## 4. Check the installation

- In Intune, the app shows **Installed** and the script shows **Success** for the Mac.
- On the Mac, the agent is running:

  ```bash
  sudo launchctl print system/com.insidetechnologies.cyberguard.dim-agent
  ```

- In Device Inventory Manager, the device page shows the agent version and the time of the last collection.

The agent logs are in `/Library/Logs/Inside Technologies/CyberGuard DIM Agent/`.

## Updating the agent

When a new version appears in the **Agent** tab:

1. Download the new macOS package.
2. In Intune, open the app and replace the `.pkg` file.
3. In **Detection rules**, change the version to the new one.

`config.dat` stays where it is: you do not need to change the script.

## Changing the configuration

Upload the new `config.dat` to the same address. The agent reads the file at every cycle; a Mac picks up the new file the next time the script runs, so use a recurring script frequency if you expect to change settings.

## Troubleshooting

If a Mac does not appear in Device Inventory Manager, copy `Diagnose-MacOSAgent.sh` to the Mac and run it as root:

```bash
sudo sh ./Diagnose-MacOSAgent.sh
```

The script only reads and changes nothing. It shows whether the agent is running, whether `config.dat` is in place, whether the Mac ever registered with the portal, how many collections are waiting to be sent, and the last lines of the logs. Send its output to support if the cause is not clear.

## Removing the agent

1. In Intune, remove the assignment of the app and of the configuration script for the Macs to clean up, otherwise Intune installs them again.
2. Go to **Devices** › **macOS** › **Scripts** › **Add**, upload `Uninstall-CyberGuardDimAgent.sh` from the package, set **Run script as signed-in user** to **No** and assign it to those Macs.

The script stops the agent and deletes its files, `config.dat` and its logs. On a single Mac you can also run it by hand:

```bash
sudo sh ./Uninstall-CyberGuardDimAgent.sh
```

The device stays in Device Inventory Manager with its history. If the Mac is also leaving Intune, see [Devices that leave Intune](https://wiki.cyberguard.srl/dim/devices/device-leaves-intune.md).