This document describes how to set up Microsoft Intune for macOS devices. Intune distributes the F5 Workforce AI Security proxy auto-configuration (PAC) file URL and root certificate authority (CA) certificate to them.
Supported platforms
macOS 13.0 and later
About this document
This document describes how to set up Microsoft Intune to distribute Workforce AI Security proxy settings to macOS devices. You use Custom configuration profiles. The profiles from Workforce AI Security include both the proxy PAC URL and the trusted root CA certificate in one deployment. This document doesn't cover how to enroll devices in Microsoft Intune. It also doesn't cover how to manage other parts of the Microsoft Intune platform.
Proxy auto-configuration file
Workforce AI Security distributes its proxy information in a PAC file. The PAC file sends generative AI traffic to the Workforce AI Security proxy service. The device sends other traffic by its typical route.
Workforce AI Security uses the PAC file to update the list of generative AI domains. Most operating systems and browsers request the PAC file every 1 through 2 hours. If a device can't get a new file, the device keeps using the current file.
Root certificate
Workforce AI Security needs certificate trust to intercept connections and apply policy. Other network security and secure access service edge (SASE) vendors work the same way. This policy applies to connections to generative AI websites. Devices that Workforce AI Security governs must trust the Workforce AI Security root CA certificate.
Prerequisites
All configuration in this section takes place in the Microsoft Intune admin center. Unless otherwise stated, all instructions start from the Microsoft Intune admin center.
The Workforce AI Security configuration profiles for Intune are on the configuration page for the Proxy connector. This page is in the Workforce AI Security admin interface. These mobileconfig files contain both the proxy PAC URL and the trusted root CA certificate.
To download the configuration files:
In CONFIGURE, go to Connectors.
Select an existing Proxy connector, or create one:
Select ADD CONNECTOR.
Enter a descriptive name, such as
macOS - Intune.Select Proxy as the connector type.
Select SAVE.
On the connector details page, in the MDM Files section, select DOWNLOAD.
The downloaded ZIP file contains deployment files for several platforms. For Intune macOS deployments, use one of these files:
surepath.ai.macos.intune.email.mobileconfig- Email-based user identificationsurepath.ai.macos.intune.udid.mobileconfig- User identification based on the unique device identifier (UDID)
Choose a configuration profile
Workforce AI Security provides two configuration profile variants for Intune macOS deployments. Choose between the email and UDID variants. Base your choice on your security needs and your users' experience.
The email-based profile (surepath.ai.macos.intune.email.mobileconfig) never prompts for user authentication. Users see no authentication page redirects. For email-based identification to work, the device must have a user with an email address assigned in Intune.
The UDID-based profile (surepath.ai.macos.intune.udid.mobileconfig) requires user authentication before Workforce AI Security attributes traffic to a user. Use this method if your organization wants users to authenticate before Workforce AI Security identifies them.
Create the Intune policy for macOS
The configuration profiles from Workforce AI Security contain both the proxy PAC URL and the trusted root CA certificate. You can deploy both settings in one policy.
Go to Devices > Configuration.
Select Create > New Policy.
For Platform, select macOS.
For Profile type, select Templates.
From the Template name menu, select Custom.
Select Create.
On the Basics tab, enter a Name. You can also enter a Description.
Select Next.
On the Configuration settings tab, enter a Custom configuration profile name.
For Deployment channel, select Device channel.
For Configuration profile file, select the folder icon and browse to one of these files:
surepath.ai.macos.intune.email.mobileconfigfor email-based identificationsurepath.ai.macos.intune.udid.mobileconfigfor UDID-based identification
Select Next.
On the Assignments tab, add the devices or groups of devices that receive the policy. The policy is device-based. Assign it to devices or device groups, not user groups.
Select Next.
On the Review + create tab, confirm that the configuration is correct.
Select Create.
Verify the integration
After you complete the deployment, verify that the endpoint is integrated correctly. Use the Workforce AI Security Ready tool.