- Platforms
- macOS
- Products
- Intune
- Result
- Firefox installs silently from a DMG file into the Applications folder of managed Macs
Overview
Deploy macOS apps packaged as DMG files with Microsoft Intune, without repackaging them, and fix the most common install error.
An Apple Disk Image (DMG) is a file that mounts like a drive and contains one or more apps. It is one of the common formats for distributing macOS apps outside the App Store. With the macOS app (DMG) app type, Microsoft Intune installs DMG files on managed Macs without repackaging them as .pkg. Before this app type existed, admins wrapped DMG apps in a package, as explained in this Intune Customer Success post.
The DMG must contain one or more .app files (for example Firefox.app). A DMG with a .pkg installer inside isn't supported:
For .pkg files you no longer need the Intune App Wrapping Tool: Microsoft removed .intunemac uploads in August 2022. Signed packages are added as a line-of-business app, and unsigned or script-only packages as macOS app (PKG).
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 for each user (included in Microsoft 365 E3, E5 and Business Premium) | Licensing |
| Admin role | Application Manager or Intune Administrator in Intune | Roles |
| Intune | MDM authority set to Intune and a valid Apple MDM push certificate | Push certificate |
| Microsoft Intune management agent for macOS (installed automatically with the first DMG, PKG or shell script) | Agent | |
| Devices | Macs enrolled in Intune; Intune supports macOS 15 and later | Supported platforms |
| A .dmg file up to 8 GB that contains one or more .app files (no .pkg inside) | DMG apps |
Configuration
Add the app, set requirements and detection rules, then assign it.
Add the DMG app
I deploy Firefox 96.0.3.dmg. In the Intune admin center (intune.microsoft.com), go to Apps > All Apps > Create and select the app type macOS app (DMG). In 2022 it was under Apps > macOS > Add:
Select the app package file (.dmg). The file can be up to 8 GB (in 2022 the limit was 2 GB):
Enter at least the Name, Description and Publisher:
Set the requirements
Choose the minimum operating system. In 2022 I picked macOS Catalina 10.15; Intune itself now supports macOS 15 and later (see supported operating systems):
Configure the detection rules
Under Included apps enter the app bundle ID (CFBundleIdentifier) and the app version of each app in the DMG. The first app in the list is used in app reporting. Set Ignore app version to Yes if the app updates itself, so Intune doesn't reinstall it (see Add a macOS DMG app):
If the app is already installed on a Mac, read both values in Terminal:
defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleIdentifier
defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionStringorg.mozilla.firefox
96.0.3Note: Microsoft's docs use CFBundleShortVersionString (the version users see) for the app version. In 2022 I used CFBundleVersion (9622.1.26), which you see in the screenshots.
Assign the app
Assign the app to your device groups. In 2022 only Required was available; now you can also use Available for enrolled devices and Uninstall. For uninstall, the bundle ID and version must match, unless Ignore app version is Yes:
The Firefox DMG app is ready to install:
Note: a DMG app isn't removed when the device is retired. The app and its data stay on the Mac.
User Experience
The app appears in the Applications folder without any user action.
The Intune management agent installs the app silently into the Applications folder. On macOS 13 and later, the agent needs Full Disk Access to update or delete DMG apps; Intune asks for it automatically:
Some apps need a system extension. Deploy it with a device configuration profile before the user starts the app, so users don't get prompts to allow the extension in System Settings > Privacy & Security (formerly Security & Privacy). The Intune extensions template is deprecated; use the settings catalog (see macOS extensions in Intune).
Troubleshooting
Microsoft's troubleshooting table lists the error codes for DMG apps. I saw only one error, when I deployed Adobe Acrobat Reader DC (AcroRdrDC_2101120039_MUI.dmg):
The status was Failed with 0x87D30131: The app couldn't be downloaded. Sync the device to retry installing the app.
This code usually means a poor network or a very large app, but neither matched my case. The real cause was that the Adobe DMG contained a .pkg instead of a .app. Today Intune reports this case as 0x87D3013E (the DMG doesn't contain any supported app). Deploy Adobe Acrobat Reader as a line-of-business .pkg instead.