> ## Documentation Index
> Fetch the complete documentation index at: https://docs.originhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy the Origin macOS Agent via Microsoft Intune

> Push the Origin macOS agent silently to managed endpoints using Microsoft Intune — one PPPC profile, a JWT staging script, and a macOS PKG app deployment.

This guide walks you through a fully silent deployment of the Origin macOS agent using Microsoft Intune. You'll upload one Custom configuration profile that pre-approves the permissions the agent needs, run an IME warmup script to verify agent health, stage a provisioning JWT via a shell script policy, and deploy the Origin package as a macOS PKG app — with no user interaction at any step.

<Steps>
  <Step title="Prerequisites">
    Confirm the following before proceeding:

    * **Microsoft Intune admin center access** — Intune Administrator or equivalent role with permission to create configuration profiles, upload apps, and assign deployments.
    * **An Apple MDM Push Certificate** active in Intune (**Devices → Enrollment → Apple → Apple MDM push certificate**). Without this, no macOS device can be managed.
    * **A valid Origin provisioning JWT** — obtain from the Origin console under **Settings → Provisioning Tokens**.
    * **The Origin macOS installer** — download from the Origin console under **Settings → Installers**. Delivered as `Origin.pkg`.
    * **The PPPC configuration profile and install scripts** from the deployment package (see Step 3).
    * **Target macOS devices enrolled in Intune with User-Approved MDM (UAMDM)**. Devices enrolled via Company Portal or Apple Automated Device Enrollment satisfy this.
    * **An Entra ID security group** containing your target devices — used during assignment in Step 5.
    * **A pilot device** dedicated to validating the deployment chain end-to-end before broader rollout. The first device to receive a PKG app deployment in any tenant is at higher risk of agent-startup timing issues — see the IME warmup substep in Step 5.

    <Note>
      The installer and the provisioning token live in **two different Settings views** — Installers for the `.pkg`, Provisioning Tokens for the JWT. Tokens carry an expiry and a use limit, so confirm both cover your rollout before you begin.

      **Deployment package download:** [drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF](https://drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF)
    </Note>
  </Step>

  <Step title="Scope of automation">
    Two macOS permissions stand between the installer and a fully registered agent. MDM pre-approves both — no user interaction is required for either.

    | Permission               | Pre-approved by profile? | User action |
    | ------------------------ | ------------------------ | ----------- |
    | Full Disk Access         | Yes                      | None        |
    | Endpoint Security Client | Yes                      | None        |

    Deploying the PPPC profile before the package installs ensures the agent registers silently without any user-facing prompts.
  </Step>

  <Step title="Files">
    Download from [drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF](https://drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF). All files can be used as-is — no per-tenant customization is needed.

    | File                          | Purpose                                                                                                                                                                                                                 |
    | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | `origin-privacy.mobileconfig` | PPPC profile — grants Full Disk Access and Endpoint Security to the Origin agent.                                                                                                                                       |
    | `intune-warmup.sh`            | One-time smoke test confirming the Intune Management Agent (IME) is installed and reporting cleanly. Deployed via **Devices → Scripts and remediations** before Origin assignments, to surface IME health issues early. |
    | `intune-stage-jwt-origin.sh`  | Standalone shell script that stages the provisioning JWT to `/var/tmp/origin-provisioning-jwt`. Deployed via **Devices → Scripts and remediations** before the macOS app (PKG) deployment. Idempotent — safe to retry.  |

    <Note>
      The bundle may also contain a proxy root CA template, a system-extensions policy, and a VPN/transparent-proxy profile from Origin's earlier proxy-based capture architecture. **Do not deploy these — they are no longer required.**
    </Note>

    **Identifiers**

    | Identifier      | Value              |
    | --------------- | ------------------ |
    | Team ID         | `D3C73MWD7Y`       |
    | Agent bundle ID | `com.origin.agent` |
  </Step>

  <Step title="Deployment order">
    The configuration profile must land on the endpoint before the `.pkg` installs — otherwise the agent hits permission prompts during registration and the silent-install chain breaks.

    1. **Privacy preferences (PPPC)** (`origin-privacy.mobileconfig`) — Grants Full Disk Access and Endpoint Security based on Team ID `D3C73MWD7Y` and bundle ID `com.origin.agent`. Eliminates TCC prompts on first run.
    2. **JWT staging shell script** (`intune-stage-jwt-origin.sh`) — Stages the provisioning JWT to `/var/tmp/origin-provisioning-jwt` via a standalone shell script policy at **Devices → Scripts and remediations**. Must show **Succeeded** on a target device before that device is added to the macOS app (PKG) assignment. Idempotent — safe to re-run.
    3. **The Origin `.pkg`** (`Origin.pkg`) — Deployed as a macOS app (PKG) with no pre-install script. The postinstall reads the JWT staged in step 2 and registers silently.
  </Step>

  <Step title="Intune walkthrough">
    The whole flow happens inside the Microsoft Intune admin center at `intune.microsoft.com`.

    ### 01. Upload the configuration profile

    The `.mobileconfig` must be uploaded as a **Custom** configuration profile. Do not use Intune's built-in PPPC template — it reconstructs the XML and breaks the code requirement that makes PPPC allow-listing work.

    <Note>
      **Where to upload**

      Intune admin center → **Devices → By platform → macOS → Configuration → Create → New Policy**. Set Profile type to **Templates**, then choose **Custom**. This is the only profile type that ingests a raw `.mobileconfig` without rewriting it.
    </Note>

    1. Intune admin center → **Devices → By platform → macOS → Configuration**.
    2. Click **+ Create → New Policy**.
    3. Set Profile type to **Templates**, select **Custom**, click **Create**.
    4. **Basics**: name the profile (e.g. `Origin — Privacy Preferences (PPPC)`) and click **Next**.
    5. **Configuration settings**:
       * Custom configuration profile name: a friendly name shown on the device (e.g. `Origin Privacy Preferences`).
       * Deployment channel: **Device channel** — required. The user channel will not allow the PPPC payload to take effect.
       * Configuration profile file: upload `origin-privacy.mobileconfig`.
    6. Click **Next**.
    7. **Assignments**: add your Entra ID device group under **Included groups**. Click **Next**.
    8. **Review + create → Create**.

    <Warning>
      Before moving to the package, confirm the profile is installed using either method:

      **Admin center:** Devices → All devices → select your test Mac → **Device configuration**. The profile should show status **Succeeded**.

      **On the Mac:** System Settings → General → Device Management, or run:

      ```bash theme={null}
      sudo profiles show -all | grep -i "origin"
      ```

      Do not proceed until it is confirmed installed on the target device.
    </Warning>

    ### 02. Verify Intune Management Agent reporting (warmup)

    Before deploying the JWT staging script or the Origin `.pkg`, deploy a benign warmup script to confirm the Intune Management Agent (IME) is installed on your target devices and that result-reporting is healthy. The first PKG- or script-type assignment to a fresh tenant or device triggers the IME install, and the agent-startup window is the source of most "phantom failure" reports. Burning that timing budget on a no-op script is much cheaper than burning it on the JWT staging script and ending up with a cached failure to clean up.

    <Note>
      **Why this step exists**

      The IME on macOS has two halves: a system-context daemon (`IntuneMdmDaemon`) and a user-context agent (`IntuneMdmAgent`). Scripts execute via the daemon, but result-reporting back to the Intune service goes through the agent. On a fresh enrollment the daemon comes up first; the agent only starts after a user signs into Company Portal. If a real assignment fires during that gap, the script can succeed on disk while reporting as failed in the admin center — and the cached failure is sticky. The warmup script's only job is to absorb that timing window with a no-op so subsequent real deployments report cleanly.
    </Note>

    1. Intune admin center → **Devices → Scripts and remediations → Platform scripts tab → + Add → macOS**.
    2. **Basics:** Name `Origin — IME Warmup`. Click **Next**.
    3. **Script settings:** upload or paste the warmup script (below). Settings:
       * Run script as signed-in user: **No** (run as root).
       * Hide script notifications on devices: **Yes**.
       * Script frequency: **Not configured** (run once).
       * Max number of times to retry if script fails: **3**.

    ```bash theme={null}
    #!/bin/bash
    # Origin Agent -- Intune Management Agent warmup smoke test.
    # Confirms the IME is installed and result-reporting works correctly
    # before any real Origin deployment runs.
    LOG="/Library/Logs/Origin/intune-warmup.log"
    mkdir -p "$(dirname "$LOG")"
    exec >>"$LOG" 2>&1
    echo "--- $(date -u +%Y-%m-%dT%H:%M:%SZ) warmup running ---"
    echo "Hostname: $(hostname). User context: $(whoami)."
    echo "Warmup complete."
    exit 0
    ```

    4. **Assignments:** add your Entra ID device group. Click **Next**.
    5. **Review + add → Add**.
    6. Force a sync from Company Portal on your pilot device. Wait for the script's status to show **Succeeded** in **Devices → Scripts and remediations → Origin — IME Warmup → Device status**.
    7. Do not proceed to Substep 03 until status shows **Succeeded**. A **Failed** warmup means the IME isn't healthy on this device — diagnose before continuing (see Step 7).

    ### 03. Deploy the JWT staging shell script

    This script stages the provisioning JWT to `/var/tmp/origin-provisioning-jwt` so the Origin `.pkg` postinstall can read it silently. It is deployed as its own shell script policy — not as a pre-install script attached to the macOS PKG app.

    1. Intune admin center → **Devices → Scripts and remediations → Platform scripts tab → + Add → macOS**.
    2. **Basics:** Name `Origin — Stage Provisioning JWT`. Click **Next**.
    3. **Script settings:** paste the script below, replacing the empty `JWT=""` value with your provisioning token from **Settings → Provisioning Tokens**. Settings:
       * Run script as signed-in user: **No** (run as root).
       * Hide script notifications on devices: **Yes**.
       * Script frequency: **Not configured** (run once).
       * Max number of times to retry if script fails: **3**.
    4. **Assignments:** add your Entra ID device group. Click **Next**.
    5. **Review + add → Add**.
    6. Force a sync from Company Portal on your pilot device. Wait for status to show **Succeeded**.

    ```bash theme={null}
    #!/bin/bash
    # Origin Agent -- Intune JWT Staging Script
    # Stages the provisioning JWT to /var/tmp/origin-provisioning-jwt.
    # Deploy via: Devices > Scripts and remediations > macOS
    LOG="/Library/Logs/Origin/intune-stage-jwt.log"
    JWT_FILE="/var/tmp/origin-provisioning-jwt"
    ####################################################################
    # EDIT THIS: paste your provisioning JWT between the quotes
    JWT=""
    ####################################################################
    # All output goes to the log file -- never to stdout.
    mkdir -p "$(dirname "$LOG")"
    exec >>"$LOG" 2>&1
    echo "--- $(date -u +%Y-%m-%dT%H:%M:%SZ) starting ---"
    # Idempotency: if Origin is already running, no-op success.
    if pgrep -x origin >/dev/null 2>&1; then
      echo "Origin agent already running; skipping JWT staging."
      exit 0
    fi
    # Idempotency: if JWT already staged with content, no-op success.
    if [[ -s "$JWT_FILE" ]]; then
      echo "JWT already staged; skipping."
      exit 0
    fi
    # Validate JWT is configured.
    if [[ -z "$JWT" ]]; then
      echo "ERROR: JWT not configured. Edit the script body."
      exit 1
    fi
    # Stage the JWT atomically.
    umask 077
    printf '%s' "$JWT" > "$JWT_FILE.tmp"
    chmod 600 "$JWT_FILE.tmp"
    mv -f "$JWT_FILE.tmp" "$JWT_FILE"
    echo "JWT staged successfully ($(wc -c < "$JWT_FILE") bytes)."
    exit 0
    ```

    On the device, verify the JWT was actually staged: `sudo ls -la /var/tmp/origin-provisioning-jwt` should show a `0600`-mode file owned by `root:wheel` with content. Until this is confirmed, do not proceed to Substep 04.

    <Note>
      **Why the token lives in the script body**

      Intune doesn't expose script parameters for macOS shell scripts the way it does for Windows Win32 apps — the script body is the only place to put the JWT. Any Intune admin with read permission on this script policy can see it. Scope admin permissions accordingly.
    </Note>

    ### 04. Add the Origin package as a macOS PKG app

    The Origin `.pkg` is deployed using Intune's **macOS app (PKG)** deployment type, with **no pre-install or post-install script** — JWT staging was handled in Substep 03. The postinstall reads the staged JWT directly when the package installs.

    <Note>
      **Intune Management Agent prerequisite**

      The macOS app (PKG) deployment type requires the Microsoft Intune Management Agent (version 2309.007 or greater) on the endpoint. The IME should already be present from Substep 02. If it isn't, that's a sign Substep 02 didn't actually succeed — diagnose before continuing.
    </Note>

    ### 05. Configure requirements, detection, and assignment

    1. Intune admin center → **Apps → All apps → + Create**.
    2. Under **Other**, select **macOS app (PKG)**, then click **Select**.
    3. **App information → Select app package file:** upload `Origin.pkg`. Intune reads bundle ID and version from the package metadata.
    4. Confirm the auto-populated values, fill in **Publisher** and any optional fields. Click **Next**.
    5. **Program:** leave both **Pre-install script** and **Post-install script** blank. This is critical — adding a pre-install script reintroduces the failure modes documented in Step 7.
    6. Set **Ignore app version** to **No** so Intune respects the version in the package metadata for upgrade decisions.
    7. Click **Next** to continue to **Requirements**.

    | Setting                  | Value                                                                                         |
    | ------------------------ | --------------------------------------------------------------------------------------------- |
    | Minimum operating system | Set to Origin's supported macOS floor — see [Agent Overview](/getting-started/agent-overview) |

    **Detection rules**

    | Field        | Value                                                                                       |
    | ------------ | ------------------------------------------------------------------------------------------- |
    | Rules format | Use included app rules (default) — Intune detects via the bundle IDs included in the `.pkg` |
    | Action       | Leave defaults — Intune populates from the package                                          |

    **Assignments**

    | Field                          | Value                                                                                                      |
    | ------------------------------ | ---------------------------------------------------------------------------------------------------------- |
    | Required                       | Add the same Entra ID device group used for the configuration profile                                      |
    | Available for enrolled devices | Leave empty (this would let users self-install via Company Portal — not what we want for a silent rollout) |
    | Uninstall                      | Not supported for macOS PKG apps deployed via Intune Management Agent                                      |

    Review the values and click **Create**.

    <Warning>
      **Required ordering before assigning the PKG app**

      Intune has no built-in dependency mechanism between scripts and apps. Order is enforced by gating which devices receive each assignment:

      1. The PPPC profile and the warmup script (Substep 02) should be assigned to your full pilot/rollout group from the start.
      2. The JWT staging script (Substep 03) should also be assigned broadly — it's idempotent, so over-assigning is safe.
      3. The macOS PKG app (this substep) should be assigned to a narrower sub-group that you populate only after a device shows **Succeeded** on the profile, the warmup script, and the JWT staging script. For pilot validation, populate the sub-group manually one device at a time. For broader rollout, automate population via a dynamic group whose membership rule keys off a custom attribute the JWT script writes on success.
    </Warning>

    ### 06. Trigger the install

    Once a device is in scope for the macOS PKG app (with all upstream items already **Succeeded**), the install runs automatically on the next device check-in. To force it for testing:

    * **From the Mac:** open Company Portal → Devices → select the device → ⋯ → **Check status**. This forces an immediate sync.
    * **From the admin center:** Devices → All devices → select the target device → **Sync**.
    * **From Terminal on the Mac** (forces a profile check-in only — does not directly trigger app install): `sudo profiles renew -type enrollment`

    **End-to-end flow:** PPPC profile applies → warmup confirms IME health → JWT staging script writes `/var/tmp/origin-provisioning-jwt` → Intune Management Agent installs the `.pkg` → the postinstall reads the staged JWT, registers silently, and deletes the file. No user interaction is required at any step.
  </Step>

  <Step title="Verification">
    Run these on a target endpoint after the install completes.

    **Profile installed**

    ```bash theme={null}
    sudo profiles show -all | grep -i "origin"
    ```

    Should return the Origin Privacy Preferences profile.

    **Agent process running**

    ```bash theme={null}
    pgrep -x origin
    ```

    Returns a PID when the agent is running.

    **Review agent log**

    ```bash theme={null}
    cat /Library/Origin/logs/agent.log.$(date -u +%Y-%m-%d)
    ```

    **JWT staging script log**

    ```bash theme={null}
    sudo cat /Library/Logs/Origin/intune-stage-jwt.log
    ```

    Should show a successful run with `JWT staged successfully (NNN bytes).` or one of the idempotency no-op messages.

    **Intune Management Agent log**

    ```bash theme={null}
    sudo tail -n 100 /Library/Logs/Microsoft/Intune/IntuneMDMDaemon*.log
    ```

    Confirms the package installed cleanly. Look for `App install succeeded` for the Origin policy ID. If you see `Cached app policy result matches` repeatedly without resolution, see Step 7.

    ### Origin menu bar icon

    Once the agent is running, the Origin menu bar icon appears. Click it to confirm the agent is active and to access two operator-friendly checks without dropping to Terminal:

    * **Generate diagnostic report** — bundles agent state, recent logs, and registration status into a single file you can hand to Origin support.
    * **View logs** — opens the local log directory directly.

    <Note>
      **Origin console verification**

      In the Origin console, go to **Settings → Endpoint Inventory** and search for the target hostname. A successfully registered endpoint appears with a recent last-seen time and its detected AI agents populated.
    </Note>

    <Note>
      **Intune admin center verification**

      Devices → All devices → select the target Mac → **Managed Apps**. The Origin app should show install status **Installed**. Under **Device configuration**, the Origin profile should show **Succeeded**.
    </Note>
  </Step>

  <Step title="Troubleshooting">
    ### Profile shows "Error" or "Conflict" in Intune

    Check the per-device status in **Devices → All devices → \[device] → Device configuration → \[profile name] → Per-setting status**. The most common causes:

    * **Profile uploaded with the wrong template type** — if you used Intune's built-in PPPC template instead of Templates → Custom, the XML was rebuilt and the code requirement no longer matches Origin's signature. Delete the profile and re-create it as a Custom profile uploading the raw `.mobileconfig`.
    * **User channel selected instead of Device channel** — the PPPC payload is device-scoped and silently no-ops when delivered through the user channel. Recreate the profile with Deployment channel: **Device channel**.
    * **Profile stuck in "Pending"** — force a sync from Company Portal on the device, or use **Sync** in the admin center.

    ### Full Disk Access not granted despite profile

    * The PPPC profile's code requirement matches Developer ID signed builds with Team ID `D3C73MWD7Y`. Ad-hoc signed or internal development builds won't match and Full Disk Access will not pre-grant.
    * Confirm the profile was uploaded as a Custom template — the built-in PPPC template will silently strip the code requirement.

    ### JWT staging script reports "Failed" but the JWT file exists

    * Verify the file exists with content: `sudo ls -la /var/tmp/origin-provisioning-jwt`. A `0600`-mode file owned by `root:wheel` with non-zero size means the script succeeded — Intune is misreporting.
    * Check the script's own log: `sudo cat /Library/Logs/Origin/intune-stage-jwt.log`. If it shows `JWT staged successfully` and `exit 0`, the script worked.
    * **Recovery:** if the JWT is staged correctly, simply assign the macOS PKG app to the device — the postinstall will consume the JWT regardless of what Intune thinks of the script's status.
    * If you need Intune to report success, toggle the script's group assignment off, wait 5 minutes, then re-assign. This forces a fresh evaluation. The script's idempotency check returns 0 cleanly.

    ### PKG app reports "Pre-install script did not complete successfully (0X87D3014A)"

    The macOS PKG app was configured with a pre-install script — which this guide explicitly avoids. Open the app in **Apps → All apps → Origin app → Properties → Edit** and confirm both **Pre-install script** and **Post-install script** fields are blank. If they aren't, blank them, save, and re-sync.

    ### Cached failure persists across multiple sync attempts

    Intune's macOS app retry logic has a documented weakness: when the `IntuneMDMDaemon`'s cached policy result matches a prior failure (visible as `Cached app policy result matches the current policy result` in `IntuneMDMDaemon*.log`), it stops retrying meaningfully. Recovery options in order of preference:

    * **Toggle the assignment.** Apps → All apps → Origin → Properties → Assignments → remove the group → Save. Wait 5 minutes, force a sync from Company Portal, then re-add the assignment. Intune treats this as a brand-new policy and clears the cached result.
    * **Retire and re-enroll.** If the assignment toggle doesn't break the cache, retire the device from the admin center, manually clean `/Library/Intune/` and `/Library/Logs/Microsoft/Intune/`, delete the device record from Intune, then re-enroll fresh via Company Portal. This is the only fully-clean reset for a poisoned policy state.

    ### Warmup script fails on first deployment

    The Intune Management Agent isn't healthy on this device. Check `ls /Library/Intune/` — if empty or missing the agent app bundle, force a sync and wait 5–10 minutes for the agent to install.

    ### App stays in "Pending" forever in Company Portal

    * Confirm the device's primary user has an Intune license assigned in M365 Admin Center. Without the license, agent installation requests get silently dropped.
    * Check that the device hasn't been added to a conflicting assignment that excludes it from the script policy.
    * This is a known Intune cosmetic bug — Company Portal can show **Pending** even after the app has successfully installed. Verify with `pgrep -x origin` on the endpoint and the install status in the admin center, both of which are authoritative.
  </Step>
</Steps>