Trying out Munki, a macOS software management system

Platforms

macOS

Products

IntuneMunkiAzure Storage

Result

Managed Software Center on every Mac, with required and optional apps from your own repository

Overview

Install Munki on Intune-managed Macs with a shell script and a custom profile, and host the package repository in Azure Blob Storage for a private self-service app catalog.

Munki is a collection of open-source tools developed by Walt Disney Animation Studios. The tools are used together with an on-premise or cloud repository of packages by macOS administrators to distribute software installs on the client machines. Munki can work together with MDM/UEM solutions like Microsoft Intune that can help to onboard Munki into its managed devices. Munki deploys apps from popular Apple installer packages (.pkg) or Disk images (.dmg) formats as automatically installed (Managed) or as optional apps through their own self-service app.

Managed Software Center (part of Munki) is an application deployed to macOS client machines that lets users install, update and remove apps themselves from the private app store.

• Managed (Required) apps are automatically installed on devices without user intervention.
• Self-service (Available) apps appear in the Munki Managed Software Center on the user's computer and users may choose to install, update or uninstall them at any time.

Munki was an alternative for Intune App Wrapping Tool for Mac that converted application installation files (pkg) into the .IntuneMac format. This package pre-processing operation is not required for apps distributed by Munki, therefore a file size limit of 2GB for LOB apps is not applicable. Also, Munki can add pre and post-installation scripts to already signed app packages by other developers (apps distributed but not built from source) without any pre-processing of the pkg files, this also allows modifications of those scripts anytime without touching the actual package file.

Prerequisites

Before you start, check that you have the following.

Further reading: Getting started with Munki, Comprehensive guide to managing macOS with Intune by Oliver Kieselbach, and my post about Munki and AutoPkgr.

Configuration

With the prerequisites in place, set it up in this order.

Prepare the InstallMunki.sh script

This is basically a software package installation script for macOS devices, like many other scripts that are available here (provided by Neil Johnson).

Oliver Kieselbach who developed the Middleware (middleware_azure.py) also adapted one of the scripts from Neil's library, which installs Munki Tools (.pkg) together with his script middleware_azure.py making the whole installation of Munki tools very easy for us.

Download the script and modify the variables that point to your publicly available Azure Blob Storage:

• https://github.com/okieselbach/Intune/blob/master/macOS/installMunki.sh

This script will have to be deployed to all macOS devices managed by Microsoft Intune, but it also requires a Custom profile (.mobileconfig) from step 3 below.

Set up Azure Blob Storage

Azure Storage Explorer is a handy tool that allows you to manage storage blobs, files, queues, and tables.

I have two blob containers, a public one and a private one (named munki):

• munki blob (private) – this is my package repository, created locally on Mac mini (Munki Admin) and uploaded to this container
• public blob – with only 2 files, the latest Munki tools (.pkg) and middleware_azure.py that are both prerequisites for the InstallMunki.sh script

For the munki blob container, use Get Shared Access Signature to create a new one with Read permission and copy its Query string (SharedAccessSignature Token)

Note: A Shared Access Signature (SAS) provides secure delegated access to resources in your storage account.

The Query string (SAS Token) needs to be escaped, meaning some special characters are replaced with XML entities, for example:

• & is replaced with &
• < is replaced with <
• > is replaced with >

There are many local and online tools that can do it for you, for example, codebeautify.org

Create the custom profile (.mobileconfig)

Custom profiles are a feature in Intune. They are designed to add device settings and features that aren't built in to Intune. For Munki, the SoftwareRepoURL and SharedAccessSignature keys need to be added to the Custom profile, as in this example:

<dict>
    <key>SoftwareRepoURL</key>
    <string>https://XXXX.blob.core.windows.net/munki</string>
    <key>SharedAccessSignature</key>
    <string>XXXX</string>
</dict>

Replace XXXX in the URL with your storage account name, and XXXX in the second string with the escaped SAS token.

The profile needs to be deployed to all macOS managed devices by Intune, together with the script InstallMunki.sh.

Build the repository in MunkiAdmin

Munki Admin is an application with a graphical user interface (GUI) to manage a repository of packages. To get started, you need to install Munki tools on the macOS administrator's machine from here or by running the InstallMunki.sh script prepared earlier:

sudo bash InstallMunki.sh

Munki Admin (MunkiAdmin-1.8.1.dmg) can be downloaded from here

After installing Munki Admin, create:

• New Repository
• New Manifest

The Repository (e.g. MunkiRepo) is managed locally but it needs to be uploaded each time to the Azure Blob Storage (munki private) for any app changes to reach end users.

Important admin controls like Packages, Catalogs and Manifests are behind the icons in the top menu bar.

• Packages (.pkg) or disk images (.dmg) containing the software to be installed
• Catalogs are the main mechanism by which a macOS administrator can deploy certain software installations and updates to one group of users while denying those same installs and updates to another group.
• Manifests are simple lists of items to install (or verify as installed) and items to remove (or verify as removed).

Adding new applications is straightforward with Munki Admin by easily dragging and dropping any .pkg or .dmg files.

When software packages are added, specify in the manifest (site_default) which apps are installed automatically (Managed installs) and which are offered to end users as Optional installs.

Save your work in Munki Admin and upload the whole repository to the private munki container in Azure Blob Storage.

User Experience

The Managed Software Center (MSC) app is installed on an Intune-managed Mac (macOS 12) by the InstallMunki.sh script, and the Custom profile (.mobileconfig) lets the client connect to the private blob (munki) package repository.

The user started the installation of two apps, Citrix Workspace and Adobe Acrobat Reader.

The progress bar is shown under Updates.

Both apps are installed, with an option to remove them.

Launchpad: