macOS with Microsoft Intune

On macOS the agent is deployed in two parts, both assigned to the same group of Macs:

1. a macOS app (PKG) that installs the agent;
2. a shell script that copies your config.dat to the Mac.

The two parts are independent: the script waits for the agent to be installed before applying config.dat, so the order in which Intune runs them does not matter.

The agent supports Macs with Apple Silicon. Intel Macs are not supported. Software metering is not available on macOS.

#What you need

• The macOS package: My Tenant › Edit › Agent › Download macOS agent.
• A config.dat from the same tab (see Enrollment campaigns and config.dat).
• A place where the Macs can download config.dat over HTTPS, for example a file in your Azure Storage account shared through a link with limited access.
• Permission to create apps and scripts in the Microsoft Intune admin center.

The macOS package is a ZIP file containing:

#1. Publish config.dat

Upload your config.dat to a location the Macs can reach over HTTPS and note its address, for example:

https://contosostorage.blob.core.windows.net/cyberguard/config.dat?<access token>

Anyone who has this address can download the file, so share it only through your deployment and do not publish it elsewhere.

#2. Create the app in Intune

In the Microsoft Intune admin center, go to Apps › macOS › Create and choose macOS app (PKG). Do not use Line-of-business app. Upload CyberGuard-DIM-Agent-osx-arm64.pkg.

App information

Program

Paste this as the Pre-install script and leave the post-install script empty:

#!/bin/sh
softwareupdate --install-rosetta --agree-to-license 2>/dev/null || true
launchctl bootout system/com.insidetechnologies.cyberguard.dim-agent 2>/dev/null || true
exit 0

The first line installs Rosetta 2, which the current package still needs on Apple Silicon. The second stops the agent before an update replaces its files.

Detection rules

Set Ignore app version to No. With the default Yes, Intune only checks that some version of the agent is present: once a Mac has the agent, it is never updated again.

Assignments

Assign the app as Required to your group of Macs.

#3. Create the configuration script

1. Open Install-CyberGuardDIMAgent-Config.sh in any text editor. You do not need a Mac to prepare it.

2. Near the top of the file, replace the value of CONFIG_SOURCE with the address from step 1:

   CONFIG_SOURCE='https://contosostorage.blob.core.windows.net/cyberguard/config.dat?<access token>'
   

3. Save the file without changing anything else.

4. In the Intune admin center, go to Devices › macOS › Scripts › Add and upload the file.

5. Set Run script as signed-in user to No, so that the script runs as root.

6. Choose the script frequency according to your policy: once is enough, and a recurring schedule also repairs a Mac where the file was removed.

7. Assign the script to the same group as the app.

The script downloads config.dat, installs it with permissions that only the system can read, restarts the agent and checks that it is running. Its log is in /Library/Logs/Inside Technologies/CyberGuard DIM Agent/config-install.log.

The edited script points to your tenant's config.dat. Use it only in your own Intune tenant.

#4. Check the installation

• In Intune, the app shows Installed and the script shows Success for the Mac.

• On the Mac, the agent is running:

  sudo launchctl print system/com.insidetechnologies.cyberguard.dim-agent
  

• In Device Inventory Manager, the device page shows the agent version and the time of the last collection.

The agent logs are in /Library/Logs/Inside Technologies/CyberGuard DIM Agent/.

#Updating the agent

When a new version appears in the Agent tab:

1. Download the new macOS package.
2. In Intune, open the app and replace the .pkg file.
3. In Detection rules, change the version to the new one.

config.dat stays where it is: you do not need to change the script.

#Changing the configuration

Upload the new config.dat to the same address. The agent reads the file at every cycle; a Mac picks up the new file the next time the script runs, so use a recurring script frequency if you expect to change settings.

#Troubleshooting

If a Mac does not appear in Device Inventory Manager, copy Diagnose-MacOSAgent.sh to the Mac and run it as root:

sudo sh ./Diagnose-MacOSAgent.sh

The script only reads and changes nothing. It shows whether the agent is running, whether config.dat is in place, whether the Mac ever registered with the portal, how many collections are waiting to be sent, and the last lines of the logs. Send its output to support if the cause is not clear.

#Removing the agent

1. In Intune, remove the assignment of the app and of the configuration script for the Macs to clean up, otherwise Intune installs them again.
2. Go to Devices › macOS › Scripts › Add, upload Uninstall-CyberGuardDimAgent.sh from the package, set Run script as signed-in user to No and assign it to those Macs.

The script stops the agent and deletes its files, config.dat and its logs. On a single Mac you can also run it by hand:

sudo sh ./Uninstall-CyberGuardDimAgent.sh

The device stays in Device Inventory Manager with its history. If the Mac is also leaving Intune, see Devices that leave Intune.