Step 2 -macOS- Deploy SCA with Intune

In this step, upload the official SCA PKG and create a macOS app (PKG) in Microsoft Intune.

Application deployment and App Configuration are separate Intune objects. Assign both to the same macOS test device group.

1

Download the SCA Package

• Download SecureContacts-<version>-arm64.pkg from SCA Desktop Releases.

• Review the release notes and record the selected version for the pilot. Use the ARM64 PKG asset. Do not upload a source-code ZIP or a Windows installer.

2

Review the package before upload

• Keep the signed PKG unchanged. On an administrator Mac, check the package signature and Gatekeeper assessment:

pkgutil --check-signature "/path/to/SecureContacts-VERSION-arm64.pkg"
spctl --assess --type install --verbose=4 "/path/to/SecureContacts-VERSION-arm64.pkg"

• Replace the example path with the downloaded file. The repository validator expects Developer ID Installer: Provectus Software GmbH (572S9T76X8). Investigate a failed assessment before continuing.

The expected installed app is /Applications/SecureContacts.app, with bundle ID de.provectus.SecureContactsDesktop. Record these values for detection and pilot verification.

3

Create the macOS App

• In the Microsoft Intune admin center, open Apps → All apps → Create.

• Select macOS app (PKG) and continue to the application wizard.

The supplied update pipeline requires a macOS PKG app object. A macOS line-of-business app is a different Intune object type and cannot be used as the pipeline target.

4

App information

• Select Select app package file, upload the downloaded PKG, and confirm the package details.

• Review the extracted information and complete the app metadata:

Setting	Value or action
Name	For example, Secure Contacts - macOS. Keep the name recognizable across releases.
Description	Describe the business purpose and support route for your users.
Publisher	Provectus Software GmbH.
Owner	The team responsible for application deployment and support.
Package version	Verify it corresponds to the downloaded release; retain the actual numeric version.
Logo and category	Set these according to your Company Portal conventions if required.

Wait for the upload to finish. Do not interpret a saved app object as a completed device installation.

5

Program

For the standard SCA PKG, leave the optional Pre-install script and Post-install script empty.

Use additional scripts only for an independently tested organizational requirement. The signed package provides the installation payload; this workflow does not require Windows-style install commands or IntuneWin packaging.

6

Requirements

• Set the minimum operating system to macOS 15 or the higher baseline approved for the release.

Target Apple silicon / ARM64 devices. If the wizard exposes an architecture selector, use it; otherwise enforce the compatible device population through the pilot group and your assignment design.

7

Detection rules

• Review Included apps and configure SCA as follows:

Setting	Value
Ignore app version	No — use version-aware detection for Intune-controlled updates.
Included app bundle ID	de.provectus.SecureContactsDesktop
Included app version	The actual application version in the selected PKG, without a leading v.
SCA entries	Exactly one entry matching the SCA bundle ID.

The installed location /Applications/SecureContacts.app is a verification path, not a separate field to invent in the wizard.

The update pipeline relies on exactly one SCA entry in Included apps. During publication it updates that entry's version. Incorrect initial metadata must be corrected before enabling automation.

8

Scope tags and Assignments

• Apply the scope tags required by your Intune administration model.

• Add a Required assignment to the macOS test device group. Confirm the group contains the intended Apple silicon Macs and that exclusions do not remove the test device from scope.

9

Review + create

• Review the package, requirements, detection values, and pilot assignment, then select Create.

• Open the saved app and confirm the upload has completed. Record the app's Intune ID. If it is not shown in the details, copy the GUID following appId/ in the address while viewing the app.

The optional pipeline uses this value as INTUNE_MACOS_APP_ID. It is neither an Entra client ID nor the macOS bundle ID.

Verify the deployment result

The expected outcome is an Intune macOS app (PKG) assigned to the pilot group with the correct SCA bundle ID and version. Installation reporting can take time after device check-in.

If the application is not offered or installed, first check assignment membership, exclusions, minimum OS, device architecture, and the app's installation status. Diagnose an installation error before changing the configuration profile.

The SCA application is configured for pilot deployment. Continue with its managed preferences, then verify the complete rollout on the test Mac.