Roll out with Microsoft Intune

Deploy a Quint install package to Intune-managed Macs: two custom configuration profiles on the device channel, a macOS app (PKG), and the order that keeps the system extensions prompt-free.

At the end of this page every Mac in your Intune group has Quint installed, both system extensions approved without a prompt, and is joined to your organisation. For what each file does, see Roll out with MDM. For Windows computers in Intune, see Windows.

Intune for Macs is early access. If any step needed a click on the Mac, tell Quint support.

​

Before you start

• Macs on macOS 14 or later, enrolled in Intune, with user-approved MDM or Automated Device Enrollment.
• If the fleet also runs another vendor’s content filter, macOS 15 or later is the safer floor.
• An Intune role that can create device configuration profiles and add apps.
• The Admin or Owner role in the Quint dashboard, to make the package.

1. Make the package

   In Quint, open Add machines. Choose Mac, then A device management tool (MDM), then Microsoft Intune, and name the package for the group. Click Make my files and download every file: quint-approvals.mobileconfig, the quint-enrollment-….mobileconfig file and the Mac installer. See Add machines.

2. Create the approvals profile

   In the Intune admin center, open Devices › macOS › Configuration, select Create › New policy, and choose the profile type Templates › Custom.

   • Name it “Quint approvals” and upload quint-approvals.mobileconfig.
   • Set Deployment channel to Device channel. Intune does not let you change the channel after the profile is saved.
   • Assign it to the group of Macs you are rolling out to.
3. Create the enrollment profile

   Create a second Templates › Custom policy the same way. Name it “Quint enrollment”, upload the quint-enrollment-….mobileconfig file, set Deployment channel to Device channel, and assign it to the same group.

4. Confirm the profiles landed

   On one Mac in the group, open System Settings › General › Device Management (on macOS 14, Privacy & Security › Profiles). “Quint approvals” and “Quint enrollment” are listed. Wait for this before you assign the installer.

5. Add the installer

   Open Apps › macOS, select Add, and choose the app type macOS app (PKG). Upload quint-v1.1.29.pkg. In Requirements, set the minimum operating system to macOS 14. In Detection rules, keep only com.quint.security (QuintAgent.app) under Included apps. Assign it as Required to the same group.

   Use macOS app (PKG) rather than Line-of-business app. The package starts the endpoint’s service and writes a machine-wide Claude Code setting when it installs, which the PKG app type runs through the Intune management agent.

6. Verify each machine

   The wizard’s First computer step shows the first Mac’s checks. Then open Data Sources: each Mac appears under Telemetry by host with its Capture layers and Last seen. Verify a machine explains each state.

​

Order, and new Macs

The profiles have to reach a Mac before the installer. Intune installs configuration profiles and apps independently, so on Macs that are already enrolled the order comes from the passes above: profiles first, confirmed, then the installer. On Quint 1.1.29, a Mac that gets the installer before its enrollment profile does not start Quint; install the app on that Mac again once the profile is there.

For new Macs enrolled through Automated Device Enrollment, set Await final configuration to Yes in the enrollment policy (Devices › Device onboarding › Enrollment › macOS › Enrollment program tokens, your token, Enrollment policies). Setup Assistant holds the Mac while Intune installs its configuration policies. Microsoft does not document an order between profiles and apps during the hold, so a new Mac in a group that already has the app can receive both together; if it then does not report, see If this fails.

A package admits new computers for one year from the day it is made, up to its limit. Machines & licensing shows both. When it is full, expired or stopped, make a new package and replace the “Quint enrollment” profile’s file in Intune with the new one.

​

Prevent unenrollment

In your Automated Device Enrollment policy, set Locked enrollment to Yes. A Mac enrolled that way cannot remove its MDM profile, and with it the Quint approvals. The setting applies when a Mac enrolls; Macs already enrolled keep theirs. On user-approved enrollment, see the one remaining bypass.

​

If this fails

What you see	What it means	What to do
macOS prompts to allow a system extension	The installer landed before the approvals profile	Confirm “Quint approvals” is under System Settings › General › Device Management (on macOS 14, Privacy & Security › Profiles), then log out and back in.
A profile reports an error in Intune	It was created on the user channel	System extension, privacy, content filter and login-item settings install only on the device channel. Create a new profile on the Device channel and upload the same file.
The app reports a failed install	It was added as a line-of-business app, or its detection rule lists more than QuintAgent.app	Add it as macOS app (PKG), with only com.quint.security under Included apps.
A Mac installs but never appears in Data Sources	The installer landed before the enrollment profile, or the package is no longer Active	Confirm “Quint enrollment” is on the Mac, then reinstall the app. Check the package in Machines & licensing.

​

Remove the endpoint

Remove the endpoint first, while both Quint profiles are still assigned, and unassign the profiles last. See Remove a machine.