Skip to content

Deployment with Microsoft Intune (macOS)

This guide covers the necessary steps to deploy the SenseOn Universal Sensor to macOS devices using Microsoft Intune. For Windows devices, see Deployment with Microsoft Intune (Windows).

Intune deploys SenseOn to macOS in two steps:

  1. Grant the agent Full Disk Access by uploading a configuration profile.
  2. Run the SenseOn install command via an Intune shell script. The script installs the latest published Universal Sensor version on each in-scope device.

ℹ Prerequisites:

  • Target Macs must be enrolled in Intune and running macOS 12.0 or later — Intune shell scripts do not support older versions, even though the Universal Sensor itself supports macOS 10.15 or later.
  • Intune runs shell scripts through the Microsoft Intune management agent, which is installed automatically on enrolled Macs the first time a shell script is assigned to them. The agent requires a direct connection to the internet; Microsoft does not support connecting it through a proxy.

Step 1: Enable Full Disk Access

The SenseOn endpoint agent requires Full Disk Access to operate. Deploy the SenseOn Full Disk Access configuration profile through Intune so that access is granted without any action from the end user:

  1. Download the file named SEE-FDA.mobileconfig. Click here to download SEE-FDA.mobileconfig.
  2. Open the Microsoft Intune admin centre and go to Devices > macOS > Manage devices > Configuration.
  3. Click Create > New policy, set Profile type to Templates, select Custom, and click Create.
  4. Give the profile a name such as SenseOn Full Disk Access and click Next.

  5. Set Deployment channel to Device channel, upload the SEE-FDA.mobileconfig file, and click Next.

    ⚠ The deployment channel cannot be changed after the profile is saved. If User channel is selected by mistake, delete the profile and create a new one. 6. Under Assignments, select the device group(s) you wish to deploy to, then click Next until you reach Review + create, and click Create.

💡 Deploy this profile before (or together with) the install script in Step 3, so Full Disk Access is already granted when the agent starts.

Step 2: Copy your install command

  1. Log in to SenseOn.
  2. Navigate to Settings > Universal Sensor.
  3. Copy the macOS install command.

Step 3: Create the Intune shell script

  1. On your admin workstation, save the following script as senseon-install.sh, substituting your tenant hostname and installer key from Step 2:

    #!/bin/bash
set -e
curl -fsSL https://<your-tenant>.senseon.io/install.sh -o /tmp/senseon-install.sh
shasum -a 256 /tmp/senseon-install.sh  # compare against the SHA-256 value shown in Settings > Universal Sensor
SENSEON_INSTALLER_KEY="<your-installer-key>" bash /tmp/senseon-install.sh

    If your security policy does not require checksum verification, you can use the single-line form instead:

    #!/bin/bash
set -e
curl -fsSL https://<your-tenant>.senseon.io/install.sh \
  | SENSEON_INSTALLER_KEY="<your-installer-key>" bash

  2. In the Intune admin centre, go to Devices > macOS > Manage devices > Scripts and click Add.

  3. Give the script a name such as SenseOn Install and click Next.
  4. Under Upload script, select the senseon-install.sh file, then configure the remaining script settings as follows:
    • Run script as signed-in user: No — Intune then runs the script as the root user, which the installer requires.
    • Hide script notifications on devices: Yes
    • Script frequency: Not configured — the script runs once per device.
    • Max number of times to retry if script fails: 3 times
  5. Under Assignments, select the device group(s) you wish to deploy to, then click Next until you reach Review + add, and click Add.

Step 4: Verify

Once a managed Mac checks in and runs the script, it appears in Digital Estate > Devices within a few minutes. To check the rollout progress in Intune:

  1. Go to Devices > macOS > Manage devices > Scripts.
  2. Open the script you created and select Device status. Each in-scope device is listed with its run status.

📝 Note: The Intune management agent checks in for new scripts every 8 hours, separately from the MDM check-in, so a newly assigned script may not run immediately. To force a check-in on a device, open Company Portal, select the device, and click Check settings.

📝 Note: Intune reports a script as successful if it exits with code 0. The set -e line in the script above makes any failed step surface in Intune as a script failure rather than a false success.

For diagnostics if a host does not appear in SenseOn, see Troubleshooting.

❓ Need help: If the installation has not been successful please confirm that TLS interception is not taking place. If it is, you will need to allow list *.snson.net. Then contact our support team for additional help.