Microsoft Intune is a powerful tool for remotely managing devices, applications, and configurations on an organizational level. You will find instructions for remotely enabling necessary permissions and installing Insightful on MacOS company-managed devices.
If you wish to install Insightful directly on your employees' devices or let them do that by themselves, please check out our article on Company Computer installation steps for MacOS.
Prerequisites
1. Intune Administrator Role: Ensure you have the necessary permissions in the Microsoft Endpoint Manager Admin Center.
2. Supported Devices: Intune supports deployments on macOS 12 and later. Devices must be managed by Intune and directly connected to the Internet.
3. Scripts: Prepare the shell script which will include Insightful installation code, ensuring it is error-free.
4. Configuration Profiles: Make sure you have the configuration profile which will ensure that necessary permissions on MacOS devices are enabled. You can find instructions for obtaining the configuration profile in our article on How to handle macOS permissions remotely via configuration profiles.
Step 1: Prepare the Shell Script
Write the shell script using Visual Code, Notepad++, or another text/code editor. Please make sure that you put #!/bin/bash in the first line of the script and the installation code from your Insightful admin dashboard in the second.
Example script (sample.sh):
#!/bin/bash
export base="https://app.insightful.io/updates/mac/installation"; /bin/bash -c "organizationId="xxxxxxxxxx"; $(curl -fsSL $base/install.sh)"
Step 2: Deploy a Configuration Profile
A Configuration profile is a settings file used to configure devices. Deploying it on your employees' MacOS devices will ensure that the necessary permissions are enabled for Insightful to function properly.
To deploy the already prepared configuration profile:
1. Log in to the Microsoft Endpoint Manager Admin Center.
2. Navigate to Devices > macOS > Configuration.
3. Click on Policies > + Create > + New Policy.
4. Select the platform:
Choose macOS.
5. Choose the profile type:
Select Templates and then Custom as the profile type.
Click Create
6. Import the Configuration Profile:
Enter a descriptive Name and Description for the profile.
In the Configuration settings section, click Import.
Select the configuration profile with the .mobileconfig extension you want to import.
Click Next.
7. Assign the profile:
Select the target devices or groups: Choose the specific macOS devices or groups of devices to which you want to apply the profile.
8. Click Create to save and deploy the profile.
Step 3: Upload the Script to Intune
1. Log in to the Microsoft Endpoint Manager Admin Center.
2. Navigate to Devices > macOS > Scripts.
3. Click Add to create a new script profile.
4. Provide the following details:
Name: Enter a meaningful name for the script.
Description: Optionally, describe the script’s purpose.
5. Upload the script file:
Browse and select your shell script.
6. Configure the script settings:
Run the script as a signed-in user: You should uncheck this checkbox in order for the script to run successfully.
Hide script notifications: You should check this setting if you want to hide the installation notifications.
Script frequency: Choose that the script runs once.
Max number of times to retry if the script fails: Select how many times the script should be run if it returns a non-zero exit code (zero meaning success).
7. Assign the script to a group:
Select the user or device groups that should receive the script.
8. Click Add to save and deploy the script.
Step 4: Verify Deployment
1. Monitor Script Deployment:
Go to Devices > Scripts > Select the script > Device Status.
Check if the script has successfully run on targeted devices.
2. Monitor Configuration Profile Deployment:
Go to Devices > Configuration > Select the configuration profile > Device Status.
Verify that the profile is successfully assigned to devices.
3. Troubleshooting Logs:
On macOS devices, check logs for script execution at /var/log.
Best Practices:
Test Scripts: Always test the script on a test device before deploying it via Intune.
Limit Scope: Deploy to a small pilot group initially before rolling out to all devices.
Secure the Script: Avoid hardcoding sensitive information like passwords.
Documentation: Maintain clear documentation of what each script or profile does.