> ## Documentation Index > Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt > Use this file to discover all available pages before exploring further. # Roll out with Microsoft Intune > Deploy a Quint install package to Intune-managed Macs: two custom configuration profiles on the device channel, a macOS app (PKG), and the order that keeps the system extensions prompt-free. At the end of this page every Mac in your Intune group has Quint installed, both system extensions approved without a prompt, and is joined to your organisation. For what each file does, see [Roll out with MDM](https://docs.quintai.dev/install/mdm.md). For Windows computers in Intune, see [Windows](https://docs.quintai.dev/install/windows.md). > [!NOTE] > > Intune for Macs is early access. If any step needed a click on the Mac, tell Quint support. ## Before you start * Macs on macOS 14 or later, enrolled in Intune, with user-approved MDM or Automated Device Enrollment. * If the fleet also runs another vendor's content filter, macOS 15 or later is the safer floor. * An Intune role that can create device configuration profiles and add apps. * The **Admin** or **Owner** role in the Quint dashboard, to make the package. **1. Make the package** In Quint, open **Add machines**. Choose **Mac**, then **A device management tool (MDM)**, then **Microsoft Intune**, and name the package for the group. Click **Make my files** and download every file: `quint-approvals.mobileconfig`, the `quint-enrollment-….mobileconfig` file and the Mac installer. See [Add machines](https://docs.quintai.dev/install/add-machines.md). **2. Create the approvals profile** In the Intune admin center, open **Devices › macOS › Configuration**, select **Create › New policy**, and choose the profile type **Templates › Custom**. * Name it "Quint approvals" and upload `quint-approvals.mobileconfig`. * Set **Deployment channel** to **Device channel**. Intune does not let you change the channel after the profile is saved. * Assign it to the group of Macs you are rolling out to. **3. Create the enrollment profile** Create a second **Templates › Custom** policy the same way. Name it "Quint enrollment", upload the `quint-enrollment-….mobileconfig` file, set **Deployment channel** to **Device channel**, and assign it to the same group. **4. Confirm the profiles landed** On one Mac in the group, open **System Settings › General › Device Management** (on macOS 14, **Privacy & Security › Profiles**). "Quint approvals" and "Quint enrollment" are listed. Wait for this before you assign the installer. **5. Add the installer** Open **Apps › macOS**, select **Add**, and choose the app type **macOS app (PKG)**. Upload `quint-v1.1.29.pkg`. In **Requirements**, set the minimum operating system to macOS 14. In **Detection rules**, keep only `com.quint.security` (QuintAgent.app) under **Included apps**. Assign it as **Required** to the same group. Use **macOS app (PKG)** rather than **Line-of-business app**. The package starts the endpoint's service and writes a machine-wide Claude Code setting when it installs, which the PKG app type runs through the Intune management agent. **6. Verify each machine** The wizard's **First computer** step shows the first Mac's checks. Then open **Data Sources**: each Mac appears under **Telemetry by host** with its **Capture layers** and **Last seen**. [Verify a machine](https://docs.quintai.dev/install/verify-and-troubleshoot.md) explains each state. ## Order, and new Macs The profiles have to reach a Mac before the installer. Intune installs configuration profiles and apps independently, so on Macs that are already enrolled the order comes from the passes above: profiles first, confirmed, then the installer. On Quint 1.1.29, a Mac that gets the installer before its enrollment profile does not start Quint; install the app on that Mac again once the profile is there. For new Macs enrolled through Automated Device Enrollment, set **Await final configuration** to **Yes** in the enrollment policy (**Devices › Device onboarding › Enrollment › macOS › Enrollment program tokens**, your token, **Enrollment policies**). Setup Assistant holds the Mac while Intune installs its configuration policies. Microsoft does not document an order between profiles and apps during the hold, so a new Mac in a group that already has the app can receive both together; if it then does not report, see [If this fails](#if-this-fails). A package admits new computers for one year from the day it is made, up to its limit. [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md) shows both. When it is full, expired or stopped, make a new package and replace the "Quint enrollment" profile's file in Intune with the new one. ## Prevent unenrollment In your Automated Device Enrollment policy, set **Locked enrollment** to **Yes**. A Mac enrolled that way cannot remove its MDM profile, and with it the Quint approvals. The setting applies when a Mac enrolls; Macs already enrolled keep theirs. On user-approved enrollment, see [the one remaining bypass](https://docs.quintai.dev/install/mdm.md#the-one-remaining-bypass). ## If this fails | What you see | What it means | What to do | | - | - | - | | macOS prompts to allow a system extension | The installer landed before the approvals profile | Confirm "Quint approvals" is under **System Settings › General › Device Management** (on macOS 14, **Privacy & Security › Profiles**), then log out and back in. | | A profile reports an error in Intune | It was created on the user channel | System extension, privacy, content filter and login-item settings install only on the device channel. Create a new profile on the **Device channel** and upload the same file. | | The app reports a failed install | It was added as a line-of-business app, or its detection rule lists more than QuintAgent.app | Add it as **macOS app (PKG)**, with only `com.quint.security` under **Included apps**. | | A Mac installs but never appears in **Data Sources** | The installer landed before the enrollment profile, or the package is no longer **Active** | Confirm "Quint enrollment" is on the Mac, then reinstall the app. Check the package in [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md). | ## Remove the endpoint Remove the endpoint first, while both Quint profiles are still assigned, and unassign the profiles last. See [Remove a machine](https://docs.quintai.dev/install/remove-a-machine.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.