Skip to content

Commit 92e3e31

Browse files
deadlypants1973deadlypants1973
committed
[CF1] macOS intune deployment
1 parent 660b6ae commit 92e3e31

File tree

1 file changed

+167
-1
lines changed
  • src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners

1 file changed

+167
-1
lines changed

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/intune.mdx‎

Lines changed: 167 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,173 @@ If you prefer to use Intune's Win32 App tool to run the Powershell script, refer
109109

110110
## macOS
111111

112-
Refer to the [generic instructions for macOS](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#macos).
112+
The following steps outline deploying WARP on MacOS using Intune.
113+
114+
### Prerequisites
115+
116+
- A Microsoft Intune account.
117+
- A Cloudflare account that has completed the Zero Trust onboarding flow.
118+
- macOS devices enrolled in Intune.
119+
120+
### Deployment order
121+
122+
:::tip[Best practice]
123+
Deploy configuration profiles before the WARP application itself. This ensures that when the WARP client installs, it already has the required permissions and certificates, avoiding failed installations.
124+
:::
125+
126+
- Upload user-side certificate and team domain certificate (2 separate configuration policies).
127+
- Allow system extensions (bundle ID and team identifier policy).
128+
- Upload MobileConfig (custom configuration policy).
129+
- Upload and assign the WARP `.pkg` (application policy).
130+
131+
### 1. Upload certificates
132+
133+
You must deploy two certificates via Intune: user-side certificate and team domain certificate.
134+
135+
#### 1.1 User-side certificate
136+
137+
1. Log into [Zero Trust](https://one.dash.cloudflare.com/).
138+
2. Go to **Settings** > **Resources** > under **Certificates**, select **Manage**.
139+
3. Find your [certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) and select the three dot icon next to it > select **Download .crt**.
140+
4. In the [Microsoft Intune admin center](https://intune.microsoft.com) > go to **Devices** > select **macOS**.
141+
5. Under **Manage devices**, select **Configurations**.
142+
6. Select **Create** > **New Policy**.
143+
7. For **Profile Type**, select _Templates_ > select **Trusted certificate** as the **Template name** > **Create**.
144+
8. In **Basics**, input the necessary field(s) > **Next**.
145+
9. For **Deployment Channel**, select **Device Channel**.
146+
10. Upload your file.
147+
// this has to be in cer format, and the user only has crt, what steps do they take to remedy this?
148+
149+
#### 1.2 Team domain certificate
150+
151+
1. Go your [team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name) in a browser.
152+
```
153+
https://<team-name>.cloudflareaccess.com
154+
```
155+
2. Export the TLS certificate as `.cer`.
156+
3. Repeat the upload steps in 1.1.
157+
158+
By completing this step, you ensure that macOS devices trust WARP’s connection to your team domain and Cloudflare.
159+
160+
### 2. Allow WARP system extensions
161+
162+
1. In the [Microsoft Intune admin center](https://intune.microsoft.com) > go to **Devices** > **macOS**.
163+
2. Under **Manage devices**, select **Configurations**.
164+
3. Select **Create** > **New Policy**.
165+
4. For **Profile type**, select _Settings catalog_ > **Create**.
166+
5. In **Basics**, input the necessary field(s) > **Next**.
167+
6. In **Configuration settings**, select **Add settings**.
168+
7. In the **Settings picker**, search for **System Extensions** under System Configuration.
169+
8. Enable **Allowed System Extensions**.
170+
9. Edit instance and add:
171+
Bundle Identifier: `com.cloudflare.1.1.1.1`
172+
Team Identifier: `68BUP38M2J`
173+
10. Select a button to save. // which button on which screen?
174+
11. In **Assignments**, select an option (for example, **Add all devices** or **Add all users**) that is valid for your scope. This will be the same scope for all steps.
175+
12. Select **Next**.
176+
13. // step here where they press the button to create
177+
// full steps here need to fleshed out with UI walkthrough
178+
179+
This step allows WARP to install withour user interaction. By completing this step, you allow WARP to install and manage its required system extensions without end-user prompts.
180+
181+
### 3. Upload `MobileConfig` configuration
182+
183+
1. Open a text editor and paste in the following `.mobileconfig` template:
184+
185+
```
186+
<?xml version="1.0" encoding="UTF-8"?>
187+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
188+
<plist version="1.0">
189+
<dict>
190+
<key>PayloadDisplayName</key>
191+
<string>Cloudflare WARP</string>
192+
<key>PayloadIdentifier</key>
193+
<string>cloudflare_warp</string>
194+
<key>PayloadOrganization</key>
195+
<string>Cloudflare, Ltd.</string>
196+
<key>PayloadRemovalDisallowed</key>
197+
<false/>
198+
<key>PayloadType</key>
199+
<string>Configuration</string>
200+
<key>PayloadScope</key>
201+
<string>System</string>
202+
<key>PayloadUUID</key>
203+
<string>YOUR_PAYLOAD_UUID_HERE</string>
204+
<key>PayloadVersion</key>
205+
<integer>1</integer>
206+
<key>PayloadContent</key>
207+
<array>
208+
<dict>
209+
<key>organization</key>
210+
<string>YOUR_TEAM_NAME_HERE</string>
211+
<key>auto_connect</key>
212+
<integer>120</integer>
213+
<key>onboarding</key>
214+
<false/>
215+
<key>PayloadDisplayName</key>
216+
<string>Warp Configuration</string>
217+
<key>PayloadIdentifier</key>
218+
<string>com.cloudflare.warp.YOUR_PAYLOAD_UUID_HERE</string>
219+
<key>PayloadOrganization</key>
220+
<string>Cloudflare Ltd.</string>
221+
<key>PayloadType</key>
222+
<string>com.cloudflare.warp</string>
223+
<key>PayloadUUID</key>
224+
<string>YOUR_PAYLOAD_UUID_HERE</string>
225+
<key>PayloadVersion</key>
226+
<integer>1</integer>
227+
</dict>
228+
</array>
229+
</dict>
230+
</plist>
231+
```
232+
2. Open your macOS Terminal and run `uuidgen`. This will generate a value for `PayloadUUID`. Use this value to replace the default value (`YOUR_PAYLOAD_UUID_HERE`) used in the template (three locations total).
233+
3. Update your organization's string (`YOUR_TEAM_NAME_HERE`) with your [team name](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name).
234+
// are team name and payload UUID the only requirements? can everything else be left the same? like the autoconnect key //
235+
4. Modify the file with your desired [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/).
236+
```
237+
<array>
238+
<dict>
239+
<key>organization</key>
240+
<string>YOUR_TEAM_NAME_HERE</string>
241+
// Add additional configuration here
242+
```
243+
// what does this step mean? is it completely optional? need less generic guidance here //
244+
5. In the [Microsoft Intune admin center](https://intune.microsoft.com) > go to **Devices** > **macOS**.
245+
6. Under **Manage devices**, select **Configurations**.
246+
7. Select **Create** > **New Policy**.
247+
8. For **Profile Type**, select _Templates_ > select **Custom** as the **Template name** > **Create**.
248+
9. In **Basics**, input the necessary field(s) > **Next**.
249+
10. In **Custom configuration profile name**, input a name.
250+
11. For **Deployment Channel**, select **Device Channel**.
251+
12. Under **Configuration profile file**, upload your `.mobileconfig` file > **Next**.
252+
13. In **Assignments**, select an option (for example, **Add all devices** or **Add all users**) that is valid for your scope. This will be the same scope for all steps.
253+
254+
By completing this step, you preconfigure WARP with your team settings so it connects automatically upon installation.
255+
256+
### 4. Upload WARP client `.pkg`
257+
258+
:::tip
259+
Complete Step 4 one hour after Steps 1, 2, and 3 so clients have enough time to check in and update their device configurations.
260+
:::
261+
262+
1. Log into [Zero Trust](https://one.dash.cloudflare.com/).
263+
2. Go to **Settings** > **Resources** > find macOS under **Download the WARP client** > select **Download release**.
264+
265+
You will be taken to the WARP documentation on [stable releases for macOS](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos) and download a `.pkg` file.
266+
:::note[Repeat this step to update WARP when a new release is availables]
267+
Every time WARP releases a new version, you must repeat this process and get a new `.pkg` file for the new WARP version.
268+
:::
269+
3. Log into the [Microsoft Intune admin center](https://intune.microsoft.com) > **Apps** > **MacOS**.
270+
4. Select **Create**.
271+
5. For **App type**, select _macOS app (PKG)_.
272+
6. In **App information**, select the `.pkg` file you downloaded and input required details.
273+
7. In **Requirements**, refer to the OS versions listed in [stable releases for macOS](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos) and find what matches for you.
274+
8. In **Detection rules**, note that the WARP package will have filed in the App bundle ID and App version.
275+
9. In **Assignments**, select an option (for example, **Add all devices** or **Add all users**) that is valid for your scope.
276+
10. Continue on the Microsoft Intune admin center until you can select **Create** to create your policy.
277+
278+
By completing this step, you deliver the WARP client to targeted macOS devices, either automatically (assignment scope set as **Required**) or on-demand (assignment scope as **Available**) through your company portal.
113279

114280
## iOS
115281

0 commit comments

Comments
 (0)