Deploying shft with Microsoft Intune

This guide covers deploying the shft app and configuration profile through Microsoft Intune for macOS devices.

Prerequisites

• Microsoft Intune with macOS management configured
• macOS devices enrolled in Intune (via Apple Business Manager / automated device enrolment or user enrolment)
• The shft .pkg installer
• The shft configuration profile (see Configuration profile reference)

Step 1: Upload the shft package

1. In the Microsoft Intune admin center, navigate to Apps → macOS
2. Click Add
3. Select App type: macOS app (PKG)
4. Click Select

App information

5. Upload the shft-<version>.pkg file

Detection rules

Intune uses detection rules to determine if the app is already installed:

Alternatively, use a custom script:

#!/bin/bash
if [ -d "/Applications/shft.app" ]; then
    echo "shft is installed"
    exit 0
else
    exit 1
fi

Assignments

Assign the app to the appropriate groups:

• Required — installs automatically on target devices
• Available for enrolled devices — appears in Company Portal for user-initiated install

6. Click Create

Step 2: Create the configuration profile

Intune deploys macOS configuration profiles through the Settings Catalog or a Custom profile with a .mobileconfig file. For shft, use the custom profile approach.

1. Navigate to Devices → Configuration profiles
2. Click Create profile
3. Select:

4. Set the profile basics:

5. Under Configuration settings, click Add a row for the custom configuration profile:

6. Upload the .mobileconfig file

Build the profile using the example in Configuration profile reference. Ensure PayloadScope is set to User.

7. Under Assignments, assign to the same groups as the app deployment

8. Click Create

Step 3: Verify deployment

1. On a target Mac, open Company Portal and check that shft appears
2. If assigned as Required, wait for the next Intune sync (or trigger a sync from Company Portal → Settings)
3. Verify shft is installed: ls /Applications/shft.app
4. Verify the profile is applied: defaults read com.shft.config
5. Open shft and confirm your organisation branding appears

Intune-specific notes

Deployment channel: User vs Device

The shft configuration profile must use the User channel deployment. This is because shft reads preferences from UserDefaults(suiteName: "com.shft.config"), which reads from the user-level managed preferences namespace.

If you deploy the profile through the Device channel, the preferences will be written to the system level and shft will not see them. Always use User channel.

PKG requirements for Intune

Intune requires PKG files to meet certain criteria:

• The PKG must be a flat package (not a bundle-style package)
• The PKG must be signed
• Maximum file size: 8 GB

The shft PKG meets all these requirements.

Sync timing

Intune syncs with macOS devices approximately every 8 hours by default. To ensure the profile and app are deployed before a migration:

1. Deploy the profile and app at least 24 hours before the scheduled migration
2. Or ask the user to open Company Portal and tap Check Status to trigger an immediate sync

Conditional access

If your Intune environment uses Conditional Access policies, ensure that the Macs involved in migration can reach each other on the local network. Conditional Access does not affect shft's local network operations, but network-level policies (e.g., NAC) might.

Compliance policies

Create a compliance policy to verify migration readiness:

1. Navigate to Devices → Compliance policies
2. Create a policy for macOS
3. Add a custom compliance script that checks for shft installation and profile presence

#!/bin/bash
shft_installed=false
profile_applied=false
 
if [ -d "/Applications/shft.app" ]; then
    shft_installed=true
fi
 
if defaults read com.shft.config shft.brandingName &>/dev/null; then
    profile_applied=true
fi
 
cat <<EOF
{"shft_installed": $shft_installed, "profile_applied": $profile_applied}
EOF

Troubleshooting profile delivery

If the configuration profile is not being applied:

1. Check the deployment channel — it must be User channel, not Device channel
2. Verify the .mobileconfig is valid: plutil -lint your-profile.mobileconfig
3. Check the Intune Management Extension logs on the Mac: /Library/Logs/Microsoft/Intune/
4. Verify the PayloadType matches the preference domain: com.shft.config
5. Ensure the PayloadScope in the .mobileconfig is set to User