Azure Intune: macOS

Witness Anywhere – Intune Admin Guide (macOS Physical devices)

Mac OS PAC Enrollment Flow

1. Registration Script runs → device registers with WitnessAI and receives the PAC URL
2. Plist file created → PAC URL, static FQDN, and device fingerprint stored locally
3. PAC URL applied → proxy configured on all active network interfaces
4. Stunnel installed → TLS tunnel established for secure proxy communication
5. Audit script runs every 15 minutes → ensures PAC URL remains active and correct.

Configuration Guide

1. Generate PAC Token & Download Files

1. As a User with Admin Role or above, log into the WitnessAI Console.
2. Click on the Settings menu item, then click on Proxy Configuration in the sub-menu.
3. Enter a name in the Key Name field.
4. Choose an Expiration Date.
5. Click the Generate PAC Token button.
6. Locate the row in the list with the Key Name and Expiration Date of the PAC Token you created, and click the Download Symbol.
7. Click on Intune (Mac) from the dropdown, and a zip file will be downloaded to your Downloads folder.

2. Download Files from WitnessAI Console

3. Push the WitnessAI Root Certificate

1. In the Microsoft Intune admin center, navigate to Devices → By platform → macOS → Manage devices → Configuration
2. Click Create → New Policy
3. Set Profile type to Templates and select Trusted certificate, then click Create

4. Enter a name: WitnessAI Root Certificate
5. Click Next to go to Configuration Settings
6. Set Deployment Channel to Device Channel

• Upload the WitnessAI.crt file

1. Click Next
2. Assign to the relevant device/user groups
3. Click Next → Review + create → Create

4. Upload the Registration Script

1. Navigate to Devices → By platform → macOS → Manage devices → Scripts
2. Click Add
3. Enter a name: WitnessAI Registration, then click Next
4. In Script settings:
• Upload script: upload register_device.sh
• Run script as signed-in user: No
• Hide script notifications on devices: Yes
• Script frequency: Not configured (runs once per device)

5. Click Next, assign to the relevant device/user groups
6. Click Next → Review + add → Add

5. Upload the PAC Audit Script

1. Follow steps 1–3 from Section 3 above, using the name WitnessAI PAC Audit
2. In Script settings:
• Upload script: upload pac_audit.sh
• Run script as signed-in user: No
• Hide script notifications on devices: Yes
• Script frequency: Every 15 minutes

3. Assign to the relevant device/user groups and save

6. Configure the WitnessAI Status Custom Attribute

1. Navigate to Devices → By platform → macOS → Organize devices → Custom attributes for macOS
2. Click Add
3. Enter a name: WitnessAI Status and click Next
4. In the Attribute settings page, set Data type to String
5. Upload witnessai_status.sh

6. Click Next, assign to the relevant device/user groups, then Add

7. Upload the Flush Script

1. Follow steps 1–3 from Section 3 above, using the name WitnessAI Flush
2. In Script settings:
• Upload script: upload flush.sh
• Run script as signed-in user: No
• Hide script notifications on devices: Yes
• Script frequency: Not configured
3. Assign only to the devices you want to offboard and save