Deploy the Origin macOS Agent via Microsoft Intune

• Microsoft Intune admin center access — Intune Administrator or equivalent role with permission to create configuration profiles, upload apps, and assign deployments.
• An Apple MDM Push Certificate active in Intune (Devices → Enrollment → Apple → Apple MDM push certificate). Without this, no macOS device can be managed.
• A valid Origin provisioning JWT — obtain from the Origin console under Settings → Provisioning Tokens.
• The Origin macOS installer — download from the Origin console under Settings → Installers. Delivered as Origin.pkg.
• The PPPC configuration profile and install scripts from the deployment package (see Step 3).
• Target macOS devices enrolled in Intune with User-Approved MDM (UAMDM). Devices enrolled via Company Portal or Apple Automated Device Enrollment satisfy this.
• An Entra ID security group containing your target devices — used during assignment in Step 5.
• A pilot device dedicated to validating the deployment chain end-to-end before broader rollout. The first device to receive a PKG app deployment in any tenant is at higher risk of agent-startup timing issues — see the IME warmup substep in Step 5.

1. Privacy preferences (PPPC) (origin-privacy.mobileconfig) — Grants Full Disk Access and Endpoint Security based on Team ID D3C73MWD7Y and bundle ID com.origin.agent. Eliminates TCC prompts on first run.
2. JWT staging shell script (intune-stage-jwt-origin.sh) — Stages the provisioning JWT to /var/tmp/origin-provisioning-jwt via a standalone shell script policy at Devices → Scripts and remediations. Must show Succeeded on a target device before that device is added to the macOS app (PKG) assignment. Idempotent — safe to re-run.
3. The Origin .pkg (Origin.pkg) — Deployed as a macOS app (PKG) with no pre-install script. The postinstall reads the JWT staged in step 2 and registers silently.

​

01. Upload the configuration profile

1. Intune admin center → Devices → By platform → macOS → Configuration.
2. Click + Create → New Policy.
3. Set Profile type to Templates, select Custom, click Create.
4. Basics: name the profile (e.g. Origin — Privacy Preferences (PPPC)) and click Next.
5. Configuration settings:
   • Custom configuration profile name: a friendly name shown on the device (e.g. Origin Privacy Preferences).
   • Deployment channel: Device channel — required. The user channel will not allow the PPPC payload to take effect.
   • Configuration profile file: upload origin-privacy.mobileconfig.
6. Click Next.
7. Assignments: add your Entra ID device group under Included groups. Click Next.
8. Review + create → Create.

sudo profiles show -all | grep -i "origin"

​

02. Verify Intune Management Agent reporting (warmup)

1. Intune admin center → Devices → Scripts and remediations → Platform scripts tab → + Add → macOS.
2. Basics: Name Origin — IME Warmup. Click Next.
3. Script settings: upload or paste the warmup script (below). Settings:
   • Run script as signed-in user: No (run as root).
   • Hide script notifications on devices: Yes.
   • Script frequency: Not configured (run once).
   • Max number of times to retry if script fails: 3.

#!/bin/bash
# Origin Agent -- Intune Management Agent warmup smoke test.
# Confirms the IME is installed and result-reporting works correctly
# before any real Origin deployment runs.
LOG="/Library/Logs/Origin/intune-warmup.log"
mkdir -p "$(dirname "$LOG")"
exec >>"$LOG" 2>&1
echo "--- $(date -u +%Y-%m-%dT%H:%M:%SZ) warmup running ---"
echo "Hostname: $(hostname). User context: $(whoami)."
echo "Warmup complete."
exit 0

4. Assignments: add your Entra ID device group. Click Next.
5. Review + add → Add.
6. Force a sync from Company Portal on your pilot device. Wait for the script’s status to show Succeeded in Devices → Scripts and remediations → Origin — IME Warmup → Device status.
7. Do not proceed to Substep 03 until status shows Succeeded. A Failed warmup means the IME isn’t healthy on this device — diagnose before continuing (see Step 7).

​

03. Deploy the JWT staging shell script

1. Intune admin center → Devices → Scripts and remediations → Platform scripts tab → + Add → macOS.
2. Basics: Name Origin — Stage Provisioning JWT. Click Next.
3. Script settings: paste the script below, replacing the empty JWT="" value with your provisioning token from Settings → Provisioning Tokens. Settings:
   • Run script as signed-in user: No (run as root).
   • Hide script notifications on devices: Yes.
   • Script frequency: Not configured (run once).
   • Max number of times to retry if script fails: 3.
4. Assignments: add your Entra ID device group. Click Next.
5. Review + add → Add.
6. Force a sync from Company Portal on your pilot device. Wait for status to show Succeeded.

#!/bin/bash
# Origin Agent -- Intune JWT Staging Script
# Stages the provisioning JWT to /var/tmp/origin-provisioning-jwt.
# Deploy via: Devices > Scripts and remediations > macOS
LOG="/Library/Logs/Origin/intune-stage-jwt.log"
JWT_FILE="/var/tmp/origin-provisioning-jwt"
####################################################################
# EDIT THIS: paste your provisioning JWT between the quotes
JWT=""
####################################################################
# All output goes to the log file -- never to stdout.
mkdir -p "$(dirname "$LOG")"
exec >>"$LOG" 2>&1
echo "--- $(date -u +%Y-%m-%dT%H:%M:%SZ) starting ---"
# Idempotency: if Origin is already running, no-op success.
if pgrep -x origin >/dev/null 2>&1; then
  echo "Origin agent already running; skipping JWT staging."
  exit 0
fi
# Idempotency: if JWT already staged with content, no-op success.
if [[ -s "$JWT_FILE" ]]; then
  echo "JWT already staged; skipping."
  exit 0
fi
# Validate JWT is configured.
if [[ -z "$JWT" ]]; then
  echo "ERROR: JWT not configured. Edit the script body."
  exit 1
fi
# Stage the JWT atomically.
umask 077
printf '%s' "$JWT" > "$JWT_FILE.tmp"
chmod 600 "$JWT_FILE.tmp"
mv -f "$JWT_FILE.tmp" "$JWT_FILE"
echo "JWT staged successfully ($(wc -c < "$JWT_FILE") bytes)."
exit 0

​

04. Add the Origin package as a macOS PKG app

​

05. Configure requirements, detection, and assignment

1. Intune admin center → Apps → All apps → + Create.
2. Under Other, select macOS app (PKG), then click Select.
3. App information → Select app package file: upload Origin.pkg. Intune reads bundle ID and version from the package metadata.
4. Confirm the auto-populated values, fill in Publisher and any optional fields. Click Next.
5. Program: leave both Pre-install script and Post-install script blank. This is critical — adding a pre-install script reintroduces the failure modes documented in Step 7.
6. Set Ignore app version to No so Intune respects the version in the package metadata for upgrade decisions.
7. Click Next to continue to Requirements.

​

06. Trigger the install

• From the Mac: open Company Portal → Devices → select the device → ⋯ → Check status. This forces an immediate sync.
• From the admin center: Devices → All devices → select the target device → Sync.
• From Terminal on the Mac (forces a profile check-in only — does not directly trigger app install): sudo profiles renew -type enrollment

sudo profiles show -all | grep -i "origin"

pgrep -x origin

cat /Library/Origin/logs/agent.log.$(date -u +%Y-%m-%d)

sudo cat /Library/Logs/Origin/intune-stage-jwt.log

sudo tail -n 100 /Library/Logs/Microsoft/Intune/IntuneMDMDaemon*.log

​

Origin menu bar icon

• Generate diagnostic report — bundles agent state, recent logs, and registration status into a single file you can hand to Origin support.
• View logs — opens the local log directory directly.

​

Profile shows “Error” or “Conflict” in Intune

• Profile uploaded with the wrong template type — if you used Intune’s built-in PPPC template instead of Templates → Custom, the XML was rebuilt and the code requirement no longer matches Origin’s signature. Delete the profile and re-create it as a Custom profile uploading the raw .mobileconfig.
• User channel selected instead of Device channel — the PPPC payload is device-scoped and silently no-ops when delivered through the user channel. Recreate the profile with Deployment channel: Device channel.
• Profile stuck in “Pending” — force a sync from Company Portal on the device, or use Sync in the admin center.

​

Full Disk Access not granted despite profile

• The PPPC profile’s code requirement matches Developer ID signed builds with Team ID D3C73MWD7Y. Ad-hoc signed or internal development builds won’t match and Full Disk Access will not pre-grant.
• Confirm the profile was uploaded as a Custom template — the built-in PPPC template will silently strip the code requirement.

​

JWT staging script reports “Failed” but the JWT file exists

• Verify the file exists with content: sudo ls -la /var/tmp/origin-provisioning-jwt. A 0600-mode file owned by root:wheel with non-zero size means the script succeeded — Intune is misreporting.
• Check the script’s own log: sudo cat /Library/Logs/Origin/intune-stage-jwt.log. If it shows JWT staged successfully and exit 0, the script worked.
• Recovery: if the JWT is staged correctly, simply assign the macOS PKG app to the device — the postinstall will consume the JWT regardless of what Intune thinks of the script’s status.
• If you need Intune to report success, toggle the script’s group assignment off, wait 5 minutes, then re-assign. This forces a fresh evaluation. The script’s idempotency check returns 0 cleanly.

​

PKG app reports “Pre-install script did not complete successfully (0X87D3014A)”

​

Cached failure persists across multiple sync attempts

• Toggle the assignment. Apps → All apps → Origin → Properties → Assignments → remove the group → Save. Wait 5 minutes, force a sync from Company Portal, then re-add the assignment. Intune treats this as a brand-new policy and clears the cached result.
• Retire and re-enroll. If the assignment toggle doesn’t break the cache, retire the device from the admin center, manually clean /Library/Intune/ and /Library/Logs/Microsoft/Intune/, delete the device record from Intune, then re-enroll fresh via Company Portal. This is the only fully-clean reset for a poisoned policy state.

​

Warmup script fails on first deployment

​

App stays in “Pending” forever in Company Portal

• Confirm the device’s primary user has an Intune license assigned in M365 Admin Center. Without the license, agent installation requests get silently dropped.
• Check that the device hasn’t been added to a conflicting assignment that excludes it from the script policy.
• This is a known Intune cosmetic bug — Company Portal can show Pending even after the app has successfully installed. Verify with pgrep -x origin on the endpoint and the install status in the admin center, both of which are authoritative.