> For the complete documentation index, see [llms.txt](https://docs.secure-contacts.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.secure-contacts.com/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant/step-2-macos-deploy-sca-with-intune.md). # Step 2 -macOS- Deploy SCA with Intune In this step, upload the official SCA PKG and create a **macOS app (PKG)** in Microsoft Intune. Application deployment and App Configuration are separate Intune objects. Assign both to the same macOS test device group. {% stepper %} {% step %} ## Download the SCA Package * Download `SecureContacts--arm64.pkg` from [SCA Desktop Releases](https://github.com/Provectus-Software-GmbH/SCA_Desktop_Releases/releases/latest).
* Review the release notes and record the selected version for the pilot. Use the **ARM64 PKG** asset. Do not upload a source-code ZIP or a Windows installer. {% endstep %} {% step %} ## Review the package before upload * Keep the signed PKG unchanged. On an administrator Mac, check the package signature and Gatekeeper assessment:
```bash pkgutil --check-signature "/path/to/SecureContacts-VERSION-arm64.pkg" spctl --assess --type install --verbose=4 "/path/to/SecureContacts-VERSION-arm64.pkg" ``` * Replace the example path with the downloaded file. The repository validator expects **Developer ID Installer: Provectus Software GmbH (572S9T76X8)**. Investigate a failed assessment before continuing.
{% hint style="info" %} The expected installed app is `/Applications/SecureContacts.app`, with bundle ID `de.provectus.SecureContactsDesktop`. Record these values for detection and pilot verification. {% endhint %} {% endstep %} {% step %} ## Create the macOS App * In the Microsoft Intune admin center, open **Apps → All apps → Create**.
* Select **macOS app (PKG)** and continue to the application wizard.
{% hint style="warning" %} The supplied update pipeline requires a macOS PKG app object. A macOS line-of-business app is a different Intune object type and cannot be used as the pipeline target. {% endhint %} {% endstep %} {% step %} ## App information * Select **Select app package file**, upload the downloaded PKG, and confirm the package details.
* Review the extracted information and complete the app metadata:
| Setting | Value or action | | ----------------- | ----------------------------------------------------------------------------------- | | Name | For example, Secure Contacts - macOS. Keep the name recognizable across releases. | | Description | Describe the business purpose and support route for your users. | | Publisher | Provectus Software GmbH. | | Owner | The team responsible for application deployment and support. | | Package version | Verify it corresponds to the downloaded release; retain the actual numeric version. | | Logo and category | Set these according to your Company Portal conventions if required. | {% hint style="warning" %} Wait for the upload to finish. Do not interpret a saved app object as a completed device installation. {% endhint %} {% endstep %} {% step %} ## Program For the standard SCA PKG, leave the optional **Pre-install script** and **Post-install script** empty. {% hint style="info" %} Use additional scripts only for an independently tested organizational requirement. The signed package provides the installation payload; this workflow does not require Windows-style install commands or IntuneWin packaging. {% endhint %} {% endstep %} {% step %} ## Requirements * Set the minimum operating system to **macOS 15** or the higher baseline approved for the release. {% hint style="info" %} Target **Apple silicon / ARM64** devices. If the wizard exposes an architecture selector, use it; otherwise enforce the compatible device population through the pilot group and your assignment design. {% endhint %} {% endstep %} {% step %} ## Detection rules * Review **Included apps** and configure SCA as follows: | Setting | Value | | ---------------------- | -------------------------------------------------------------------------- | | Ignore app version | No — use version-aware detection for Intune-controlled updates. | | Included app bundle ID | `de.provectus.SecureContactsDesktop` | | Included app version | The actual application version in the selected PKG, without a leading `v`. | | SCA entries | Exactly one entry matching the SCA bundle ID. | {% hint style="info" %} The installed location `/Applications/SecureContacts.app` is a verification path, not a separate field to invent in the wizard. {% endhint %} {% hint style="info" %} The update pipeline relies on exactly one SCA entry in Included apps. During publication it updates that entry's version. Incorrect initial metadata must be corrected before enabling automation. {% endhint %} {% endstep %} {% step %} ## Scope tags and Assignments * Apply the scope tags required by your Intune administration model.
* Add a **Required** assignment to the macOS test device group. Confirm the group contains the intended Apple silicon Macs and that exclusions do not remove the test device from scope.
{% endstep %} {% step %} ## Review + create * Review the package, requirements, detection values, and pilot assignment, then select **Create**. * Open the saved app and confirm the upload has completed. Record the app's Intune ID. If it is not shown in the details, copy the GUID following `appId/` in the address while viewing the app. {% hint style="info" %} The optional pipeline uses this value as `INTUNE_MACOS_APP_ID`. It is neither an Entra client ID nor the macOS bundle ID. {% endhint %} {% endstep %} {% endstepper %} ## Verify the deployment result The expected outcome is an Intune **macOS app (PKG)** assigned to the pilot group with the correct SCA bundle ID and version. Installation reporting can take time after device check-in. {% hint style="info" %} If the application is not offered or installed, first check assignment membership, exclusions, minimum OS, device architecture, and the app's installation status. Diagnose an installation error before changing the configuration profile. {% endhint %} {% hint style="success" %} The SCA application is configured for pilot deployment. Continue with its managed preferences, then verify the complete rollout on the test Mac. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.secure-contacts.com/quickstart-guide/macos-intune-managed-steps-to-activate-sca-in-your-entra-tenant/step-2-macos-deploy-sca-with-intune.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.