Skip to main content
A step-by-step walkthrough for silent deployment of the Origin macOS agent — configuration profile, JWT staging script, and end-to-end Microsoft Intune workflow.

​
Step 01 — Prerequisites

Confirm the following before proceeding:
  • Microsoft Intune admin center access — Intune Administrator or equivalent role with permission to create configuration profiles, upload apps, and assign deployments.
  • An Apple MDM Push Certificate that is active in Intune (Devices → Enrollment → Apple → Apple MDM push certificate). Without this, no macOS device can be managed.
  • A valid Origin provisioning JWT (install token) — obtain from the Origin console under Endpoints → Connect.
  • The Origin macOS installer — download from the Origin console under Endpoints → Connect. Delivered as Origin.pkg.
  • The configuration profile and install scripts bundled with this guide (see files inventory in Step 03).
  • Target macOS devices enrolled in Intune with User-Approved MDM (UAMDM). Devices enrolled via Company Portal or Apple Automated Device Enrollment satisfy this requirement.
  • An Entra ID security group containing your target devices — used during assignment in Step 05.
  • A pilot device dedicated to validating the deployment chain end-to-end before broader rollout. The first device that receives a PKG app deployment in any tenant is at higher risk of agent-startup timing issues — validate on this device before scoping the app more broadly.
Where to find itBoth the .pkg installer and the provisioning JWT live in the same place in the Origin console: Endpoints → Connect. Grab both before moving into Intune.Download the configuration profile from MDM Overview: origin-privacy.mobileconfig. The JWT staging script is provided in full in Step 05 below.

​
Step 02 — Scope of Automation

One macOS permission stands between the installer and a fully registered agent. MDM pre-approves it — no user interaction is required. Deploying the privacy configuration profile before the package installs ensures the agent can register silently without any user-facing permission dialogs.

​
Step 03 — Files

The configuration profile is downloadable from the docs site. The JWT staging script is reproduced in full in Step 05 — copy it straight into Intune.

​
Identifiers

​
Step 04 — Deployment Order

The privacy configuration profile should land on the endpoint before the .pkg installs — otherwise the agent hits a Full Disk Access prompt on first run. Follow this order strictly:
  1. Privacy preferences (PPPC) (origin-privacy.mobileconfig) — Grants Full Disk Access to the Origin agent based on Team ID D3C73MWD7Y and bundle ID com.origin.agent. Eliminates the TCC prompt that would otherwise appear on first run.
  2. JWT staging shell script (intune-stage-jwt-origin.sh) — Stages the provisioning JWT to /var/tmp/origin-provisioning-jwt via a standalone shell script policy at Devices → Scripts and remediations. Must show Succeeded on a target device before that device is added to the macOS app (PKG) assignment. Idempotent — safe to re-run.
  3. The Origin .pkg (via macOS app deployment) (Origin.pkg) — The installer itself. Deployed as a macOS app (PKG) with no pre-install script. The .pkg postinstall reads the JWT staged in step 2 and registers silently. See Step 05 for the full app setup.

​
Step 05 — Intune Walkthrough

The following sequence assumes you have the origin-privacy.mobileconfig profile plus the .pkg and the JWT staging shell script staged locally. The whole flow happens inside the Microsoft Intune admin center at intune.microsoft.com.

​
01. Upload the configuration profile

The origin-privacy.mobileconfig file must be uploaded as a Custom configuration profile. Do not use Intune’s built-in PPPC template — it reconstructs the XML and breaks the code requirement that makes PPPC allow-listing work.
Where to uploadIntune admin center → Devices → By platform → macOS → Configuration → Create → New Policy. Set Profile type to Templates, then choose Custom. This is the only profile type that ingests a raw .mobileconfig without rewriting it.
  1. Intune admin center → Devices → By platform → macOS → Configuration.
  2. Click + Create → New Policy.
  3. Set Profile type to Templates, select Custom, click Create.
  4. Basics: Name the profile (e.g. Origin — Privacy Preferences (PPPC)) and click Next.
  5. Configuration settings:
    • Custom configuration profile name: a friendly name shown on the device (e.g. Origin Privacy Preferences).
    • Deployment channel: Device channel — required. The user channel will not allow the PPPC payload to take effect.
    • Configuration profile file: upload origin-privacy.mobileconfig.
  6. Click Next.
  7. Assignments: add your Entra ID device group under Included groups. Click Next.
  8. Review + create → Create.
Verify before proceedingBefore moving to the package, confirm the Origin privacy profile is installed using either method:Admin center: Devices → All devices → select your test Mac → Device configuration. The profile should show status Succeeded.On the Mac: System Settings → General → Device Management, or run:
This should return the Origin privacy profile. Do not proceed until it is confirmed installed on the target device.

​
02. Deploy the JWT staging shell script

This script stages the provisioning JWT to /var/tmp/origin-provisioning-jwt so the Origin .pkg postinstall can read it silently when the package installs. It is deployed as its own shell script policy — not as a pre-install script attached to the macOS PKG app.
  1. Intune admin center → Devices → Scripts and remediations → Platform scripts tab → + Add → macOS.
  2. Basics: Name Origin — Stage Provisioning JWT. Click Next.
  3. Script settings: paste the script below, replacing the empty JWT="" value with your provisioning token from Endpoints → Connect in the Origin console. Settings:
    • Run script as signed-in user: No (run as root).
    • Hide script notifications on devices: Yes.
    • Script frequency: Not configured (run once).
    • Max number of times to retry if script fails: 3.
  4. Assignments: add your Entra ID device group. Click Next.
  5. Review + add → Add.
  6. Force a sync from Company Portal on your pilot device. Wait for status to show Succeeded.
On the device, verify the JWT was actually staged: sudo ls -la /var/tmp/origin-provisioning-jwt should show a 0600-mode file owned by root:wheel with content. Until this is confirmed, do not proceed to Substep 04.
Why the token lives in the script bodyIntune doesn’t expose script parameters for macOS shell scripts the way it does for Windows Win32 apps — the script body is the only place to put the JWT. Any Intune admin with read permission on this script policy can see it. Scope admin permissions accordingly. For organizations where this exposure is unacceptable, see the tenant-signed PKG path that eliminates JWT staging entirely.

​
03. Add the Origin package as a macOS PKG app

The Origin .pkg is deployed using Intune’s macOS app (PKG) deployment type. The PKG app has no pre-install or post-install script — JWT staging was handled in Substep 02. The .pkg postinstall reads the staged JWT directly when the package installs.
Intune Management Extension prerequisiteThe macOS app (PKG) deployment type requires the Microsoft Intune Management Extension (version 2309.007 or greater) on the endpoint. The Intune Management Extension installs automatically on the first script- or PKG-type assignment, so the JWT staging script in Substep 02 should already have triggered it. If that script never reported Succeeded, the Intune Management Extension may not be healthy on the device — diagnose before continuing (see Step 07).

​
04. Configure requirements, detection, and assignment

  1. Intune admin center → Apps → All apps → + Create.
  2. Under Other, select macOS app (PKG), then click Select.
  3. App information → Select app package file: upload Origin.pkg. Intune reads bundle ID and version from the package metadata.
  4. Confirm the auto-populated values, fill in Publisher (e.g. Prelude Research) and any optional fields. Click Next.
  5. Program: leave both Pre-install script and Post-install script blank. This is critical — adding a pre-install script reintroduces the failure modes documented in Step 07.
  6. Set Ignore app version to No so Intune respects the version in the package metadata for upgrade decisions.
  7. Click Next to continue to Requirements.
Detection rules Assignments Review the values and click Create.
Required ordering before assigning the PKG appIntune has no built-in dependency mechanism between scripts and apps. Order is enforced by gating which devices receive each assignment:
  1. The privacy configuration profile (Substep 01) should be assigned to your full pilot/rollout group from the start.
  2. The JWT staging script (Substep 02) should also be assigned broadly — it’s idempotent, so over-assigning is safe.
  3. The macOS PKG app (this substep) should be assigned to a narrower sub-group that you populate only after a device shows Succeeded on both the privacy profile and the JWT staging script. For pilot validation, populate the sub-group manually one device at a time. For broader rollout, automate population via a dynamic group whose membership rule keys off a custom attribute the JWT script writes on success.

​
05. Trigger the install

Once a device is in scope for the macOS PKG app (with the upstream privacy profile and JWT staging script already Succeeded), the install runs automatically on the next device check-in. To force it for testing:
  • From the Mac: open Company Portal → Devices → select the device → ⋯ → Check status. This forces an immediate sync.
  • From the admin center: Devices → All devices → select the target device → Sync.
  • From Terminal on the Mac (forces a profile check-in only — does not directly trigger app install): sudo profiles renew -type enrollment
End-to-end flow: the privacy profile applies → the JWT staging script writes /var/tmp/origin-provisioning-jwt (installing the Intune Management Extension on its first run) → Intune Management Extension installs the .pkg → the postinstall reads the staged JWT, registers silently, and deletes the file. No user interaction is required at any step.

​
Step 06 — Verification

Run these on a target endpoint after the install completes. Each command confirms a different stage of the install pipeline is healthy. Profile installed
Should return the Origin privacy profile. Agent process running
Returns a PID when the agent is running. Review agent log
Prints today’s agent log. Useful for confirming the agent has started cleanly, registration succeeded, and there are no errors after install. JWT staging script log
Should show a successful run with JWT staged successfully (NNN bytes). or one of the idempotency no-op messages if the JWT was already staged or Origin was already running. Intune Management Extension log
Confirms the package installed cleanly. Look for App install succeeded for the Origin policy ID. If you see Cached app policy result matches repeatedly without resolution, see Step 07.

​
Origin menu bar icon

Once the agent is running, the Origin menu bar icon appears in the macOS menu bar. Click it to confirm the agent is active and to access two operator-friendly checks without dropping to Terminal:
  • Generate diagnostic report — bundles agent state, recent logs, and registration status into a single file you can hand to Origin support.
  • View logs — opens the local log directory directly, equivalent to the cat command above without needing the date.
Origin console verificationIn the Origin console, click Computers in the left-hand navigation, then search for the target hostname. A successfully registered endpoint will appear in the list with a recent snapshot time and its detected AI agents populated.
Intune admin center verificationDevices → All devices → select the target Mac → Managed Apps. The Origin app should show install status Installed. Under Device configuration, the Origin privacy profile should show Succeeded.

​
Step 07 — Troubleshooting

​
Profile shows “Error” or “Conflict” in Intune

Check the per-device status in Devices → All devices → [device] → Device configuration → [profile name] → Per-setting status. The most common causes:
  • Profile uploaded with the wrong template type — if you used Intune’s built-in PPPC template instead of Templates → Custom, the XML was rebuilt and the code requirement no longer matches Origin’s signature. Delete the profile and recreate it as a Custom profile uploading the raw .mobileconfig.
  • User channel selected instead of Device channel — the PPPC payload is device-scoped and silently no-ops when delivered through the user channel. Recreate the profile with Deployment channel: Device channel.
  • Profile stuck in “Pending” — force a sync from Company Portal on the device, or use Sync in the admin center.
  • Verify the profile actually installed: sudo profiles show -all | grep -i "origin".

​
Full Disk Access not granted despite profile

  • The PPPC profile’s code requirement matches Developer ID signed builds with Team ID D3C73MWD7Y. Ad-hoc signed or internal development builds won’t match and FDA will not pre-grant.
  • Confirm the profile was uploaded as a Custom template (see above) — the built-in PPPC template will silently strip the code requirement.

​
JWT staging script reports “Failed” but the JWT file exists

Diagnostic and fix for the case where the script ran but Intune reports failure:
  • Verify the file actually exists with content: sudo ls -la /var/tmp/origin-provisioning-jwt. A 0600-mode file owned by root:wheel with non-zero size means the script succeeded — Intune is misreporting.
  • Check the script’s own log: sudo cat /Library/Logs/Origin/intune-stage-jwt.log. If the log shows JWT staged successfully and exit 0, the script worked.
  • Recovery: if the JWT is staged correctly, simply assign the macOS PKG app to the device — the postinstall will consume the JWT regardless of what Intune thinks of the script’s status.
  • If you need Intune to actually report success, toggle the script’s group assignment off, wait 5 minutes, then re-assign. This forces Intune to re-evaluate from a fresh state. The script’s idempotency check (“JWT already staged; skipping”) returns 0 cleanly.

​
PKG app reports “Pre-install script did not complete successfully (0X87D3014A)”

This means the macOS PKG app was configured with a pre-install script — which this deployment guide explicitly avoids. Open the app in Apps → All apps → Origin app → Properties → Edit and confirm both Pre-install script and Post-install script fields are blank. If they aren’t, blank them, save, and re-sync.

​
Cached failure persists across multiple sync attempts

Intune’s macOS app retry logic has a documented weakness: when the IntuneMDMDaemon’s cached policy result matches a prior failure (visible as Cached app policy result matches the current policy result in IntuneMDMDaemon*.log), it stops retrying meaningfully. Recovery options in order of preference:
  • Toggle the assignment. Apps → All apps → Origin → Properties → Assignments → remove the group → Save. Wait 5 minutes, force a sync from Company Portal, then re-add the assignment. Intune treats this as a brand-new policy and clears the cached result.
  • Retire and re-enroll. If the assignment toggle doesn’t break the cache, retire the device from the admin center, manually clean /Library/Intune/ and /Library/Logs/Microsoft/Intune/, delete the device record from Intune, then re-enroll fresh via Company Portal. This is the only fully clean reset for a poisoned policy state.
  • Wait it out (not recommended). Intune may eventually break the cache on its own, but timing is unpredictable.

​
JWT staging script fails on first deployment

A failure on the very first script assignment usually indicates the Intune Management Extension itself isn’t healthy on this device yet. Check ls /Library/Intune/ — if empty or missing the agent app bundle, force a sync and wait 5–10 minutes for the agent to install, then let the idempotent script retry.

​
App stays in “Pending” forever in Company Portal

  • Confirm the device’s primary user has an Intune license assigned in M365 Admin Center. Without the license, agent installation requests get silently dropped.
  • Check that the device hasn’t been added to a conflicting assignment that excludes it from the script policy.
  • This is a known Intune cosmetic bug — Company Portal can show Pending even after the app has successfully installed. Verify with pgrep -x origin on the endpoint and the install status in the admin center, both of which are authoritative.
  • If the install really hasn’t started, confirm the device received the Intune Management Extension: ls /Library/Intune/. If empty, force a sync and wait — the agent installs on first PKG app or shell script assignment.