MacOS Agent Deployment via Intune - Allowing System Extensions

Hi Jason,

Thanks for reaching out to the Sophos Community Forum. 

I was able to find the following Microsoft Documentation, which suggests using the same .mobileconfig file provided with the Sophos installer package.
See: Use custom settings for macOS devices in Microsoft Intune

Specifically, under "Custom configuration profile settings," it advises that a .mobileconfig file can be used. 

Configuration profile file: Browse to the .xml or .mobileconfig file you created. The max file size is 1000000 bytes (just under 1 MB). The imported file is shown. You can also Remove a file after it's been added.

Hi Qoosh  Thanks for posting that article, that's exactly what I've been trying to do but the .mobileconfig doesn't import into Intune. I don't know if it's corrupt or just doesn't support Intune since it seems to import properly when I try it on a Jamf Pro environment.

I'm hoping that Sophos can create a new profile/XMF file that we can use for Intune and provide instructions. Is that doable?

Try doing the following on a macOS device. 

• Download the installer
• Move the .mobileconfig file to a directory of your choice
• Open Terminal
• Enter the command "security cms -D -i name_of_config_file.mobileconfig > NewMobileconfig.xml"

Without the chevron, this will just output the contents of the .mobileconfig to the terminal if you'd like to inspect/confirm the contents beforehand. 

Let me know if you find success with the resulting XML file as I'm certain others will also find this helpful.

Try doing the following on a macOS device. 

• Download the installer
• Move the .mobileconfig file to a directory of your choice
• Open Terminal
• Enter the command "security cms -D -i name_of_config_file.mobileconfig > NewMobileconfig.xml"

Without the chevron, this will just output the contents of the .mobileconfig to the terminal if you'd like to inspect/confirm the contents beforehand. 

Let me know if you find success with the resulting XML file as I'm certain others will also find this helpful.

The steps you provided are helpful and worked to convert the mobileconfig into an XML that Intune can read.

I would like to have Sophos update the documentation to provide steps specifically for Intune deployment, so the process is vetted and can be followed easily by others.

Is it possible for Sophos to do internal testing with Intune deployment and update the documentation?