Welcome to the central repository for macOS Endpoint Management via Microsoft Intune.
This repository serves as a comprehensive catalog of automated shell scripts designed to securely and silently deploy software, configure environments, and enforce security baselines across macOS fleets. By leveraging modern package managers and APIs, these scripts drastically reduce helpdesk tickets and standardize the employee onboarding experience.
Unlike Windows Intune "Proactive Remediations" which split Detection and Remediation into two scripts, the macOS Intune agent executes a single Shell Script payload.
To achieve an enterprise-grade "Self-Healing" behavior on macOS, every script in this repository follows a strict Idempotent methodology, bundling both phases natively:
- Detection (Idempotency Check): The script first checks if the application or configuration already exists and is up-to-date. If compliant, it safely exits (
0), preventing redundant network traffic and CPU overhead. - Remediation (Execution): If non-compliant, the script drops privileges when necessary, securely downloads payloads via verified sources (e.g., Installomator or Homebrew), performs the installation, and verifies the final state.
- Auditability (Logging): Every action is logged sequentially to
/Library/Logs/Microsoft/IntuneScripts/for granular remote troubleshooting.
The ecosystem relies on two powerful engines to ensure applications are always installed from the vendor's latest official release, bypassing the need to manually package .pkg files:
- Installomator: The primary engine. It dynamically scrapes vendor URLs, verifies Team IDs, and installs macOS applications natively as
root. - Homebrew: The secondary engine, utilized strictly for developer CLI tools (e.g., Node, Python). The scripts automatically detect the logged-in console user and drop privileges to install packages in the user's context without requiring admin rights.
Below is the complete inventory of automated deployment scripts available for assignment in the Microsoft Intune portal.
| Application | Directory | Method |
|---|---|---|
| VS Code | scripts/vscode | Installomator |
| Android Studio | scripts/android-studio | Installomator |
| IntelliJ IDEA CE | scripts/intellij | Installomator |
| PyCharm CE | scripts/pycharm | Installomator |
| Xcode (App Store) | scripts/xcode | Native VPP + Script |
| Xcode Command Line Tools | scripts/xcode-clt | softwareupdate |
| Git | scripts/git | Homebrew |
| GitHub Desktop | scripts/github-desktop | Installomator |
| GitHub CLI | scripts/github-cli | Direct Binary |
| Docker | scripts/docker | Installomator |
| Terraform | scripts/terraform | Homebrew |
| Node.js & NPM | scripts/node | Homebrew |
| Python 3 | scripts/python | Homebrew |
| PHP | scripts/php | Homebrew |
| Composer (PHP) | scripts/composer | Homebrew |
| Java JDK (OpenJDK) | scripts/java-jdk | Homebrew |
| GoLang | scripts/golang | Installomator |
| Rust | scripts/rust | Homebrew |
| .NET SDK | scripts/dotnet-sdk | Installomator |
| Antigravity CLI | scripts/antigravity-cli | Custom Manifest |
| UTM (Virtual Machines) | scripts/utm | Installomator |
| Application | Directory | Method |
|---|---|---|
| DBeaver CE | scripts/dbeaver-ce | Installomator |
| DbGate | scripts/dbgate | Installomator |
| MySQL Workbench | scripts/mysql-workbench | Installomator |
| MySQL CLI | scripts/mysql-cli | Homebrew |
| pgAdmin 4 | scripts/pgadmin4 | Installomator |
| PostgreSQL CLI | scripts/postgresql-cli | Homebrew |
| MongoDB Compass | scripts/mongodb-compass | Installomator |
| MongoDB Shell (mongosh) | scripts/mongodb-shell | Homebrew |
| Application | Directory | Method |
|---|---|---|
| Figma | scripts/figma | Installomator |
| Sketch | scripts/sketch | Installomator |
| Miro | scripts/miro | Installomator |
| Zeplin | scripts/zeplin | Installomator |
| Adobe Creative Cloud | scripts/adobe-creative-cloud | Installomator |
| Blender | scripts/blender | Installomator |
| Application | Directory | Method |
|---|---|---|
| Notion | scripts/notion | Installomator |
| Canva | scripts/canva | Installomator |
| OBS Studio | scripts/obs-studio | Installomator |
| Grammarly Desktop | scripts/grammarly | Installomator |
| Postman | scripts/postman | Installomator |
| Insomnia | scripts/insomnia | Installomator |
| VLC Media Player | scripts/vlc | Installomator |
| Flameshot | scripts/flameshot | Installomator |
| Application | Directory | Method |
|---|---|---|
| Google Chrome | scripts/google-chrome | Installomator |
| Microsoft Edge | scripts/microsoft-edge | Installomator |
| Mozilla Firefox | scripts/firefox | Installomator |
| Opera Browser | scripts/opera | Installomator |
| Slack | scripts/slack | Installomator |
| Zoom | scripts/zoom | Installomator |
| ChatGPT | scripts/chatgpt | Installomator |
| Google Drive | scripts/google-drive | Installomator |
| Application | Directory | Method |
|---|---|---|
| SentinelOne EDR | scripts/sentinelone | Custom Profile + Script |
| Splunk Forwarder | scripts/splunk | Custom Script |
| Aikido Local Scanner | scripts/aikido-local-scanner | Custom Script |
| AWS VPN Client | scripts/aws-vpn | Installomator |
| OpenVPN GUI | scripts/openvpn-gui | Installomator |
| OpenVPN CLI | scripts/openvpn-cli | Homebrew |
| Application | Directory | Method |
|---|---|---|
| Installomator (Engine) | scripts/setup-installomator | Core Script |
| Homebrew (Engine) | scripts/homebrew | Core Script |
- Execution Context: All deployments run locally as
root(machine context). End users do not require administrator (sudo) privileges for any software installation. - Supply Chain Integrity: Installomator validates Apple Developer
Team IDsand binary signatures dynamically before mounting any DMG or executing any PKG. - Transport Security: All artifact downloads are strictly enforced over
HTTPSwith strict certificate verification.
These scripts are provided as-is for enterprise management. Always test deployments in an Intune Pilot Ring (targeting a non-production test group) before pushing to a production fleet. The author assumes no liability for downtime or data loss caused by untested mass deployments.
Maintained by Gustavo Michel.