Mac – Intune/SCCM – Sign PKG, Wrap PKG for Deployment

email me

Create a Signed Package
{{{ Required for Intune  }}}

[devuser@mac-lab1 Downloads % sudo productsign –sign “Developer ID Installer: Eddie Jackson (YourAppleID-DDD3V2X8N)” Skype-8.83-unsigned.pkg Skype-8.83-signed.pkg
Password: {enter password}
productsign: using timestamp authority for signature
productsign: signing product with identity “Developer ID Installer: Eddie Jackson (YourAppleID-DDD3V2X8N)” from keychain /Users/devuser/Library/Keychains/login.keychain-db
productsign: adding certificate “Developer ID Certification Authority”
productsign: adding certificate “Apple Root CA”
productsign: Wrote signed product archive to Skype-8.83-signed.pkg

Create Intune Package (For Company Portal)
{{{ No Longer Supported }}}

devuser@mac-lab1 Downloads % sudo ./IntuneAppUtil -c “Skype-8.83-signed.pkg” -o ./
Microsoft Intune Application Utility for Mac OS X
Copyright 2018 Microsoft Corporation

Creating intunemac file for /Users/devuser/Downloads/Skype-8.83-signed.pkg
Composing the intunemac file output
Output written to .//Skype-8.83-signed.pkg.intunemac.

IntuneAppUtil successfully processed “Skype-8.83-signed.pkg”,
to deploy refer to the product documentation.

Create SCCM Package (For Parallels Portal)
{{{ Supported for Parallels Only  }}}

devuser@mac-lab1 Downloads % sudo ./CMAppUtil -s -c “Skype-8.83-signed.pkg” -o ./
System Center Configuration Manager Application Utility for Mac OS X
Version: 5.00.8743.1000
Copyright 2013 Microsoft Corporation

Creating Cmmac file for /Users/devuser/Downloads/Skype-8.83-signed.pkg
Empty detection xml
Composing the cmmac file output
Output written to .//Skype-8.83-signed.pkg.cmmac.

CMAppUtil successfully processed “Skype-8.83-signed.pkg”,
to deploy refer to the product documentation.
devuser@mac-lab1 Downloads %

Upload to Intune
Upload to SCCM


Microsoft Intune App Wrapping Tool
{{{ No Longer Supported }}}

Use the Microsoft Intune App Wrapping Tool for macOS to pre-process macOS line-of-business apps. The wrapping tool converts application installation files into the .intunemac format. The wrapping tool also detects the parameters required by the mobile device management (MDM) agent to determine the application installation state. After you use this tool on your apps, you will be able to upload and assign the apps in the Microsoft Intune console.

Before you install and use the Microsoft Intune App Wrapping Tool for macOS you must:

Sample commands to use for the Microsoft Intune App Wrapping Tool for macOS:

  • IntuneAppUtil -h

    • This will show usage information for the tool.
  • IntuneAppUtil -c <source_file> -o <output_file> [-i] [-n] [-v]

    • This will generate the .intunemac file from the .pkg line-of-business app file.
  • IntuneAppUtil -r <filename.intunemac> [-v]

    • This will extract the detected parameters and version for the created .intunemac file.

Command-line parameters available

  • -h  Help
  • -r  Outputs the detection.xml file of the provided .intunemac file to stdout. The output contains the detection parameters and version of IntuneAppUtil used to create the .intunemac file.
  • -c <source_file>     Converts the provided input filename. Only pkg file is supported.
  • -o <output_file>    Used in conjunction with -c parameter to specify the output path
  • -v  Verbose: Produces additional progress output and error diagnostics.
  • -i Used in conjunction with -c parameter to specify the package bundle Id. Optional.
  • -n Used in conjunction with -c parameter to specify the package bnndle version. Optional.

If no valid application information can be found, this tool will use package bundle Id and package bundle version to build app detection data. You can use “-i” and “-n” parameters to override them.

Note: After you download IntuneAppUtil to your Mac device, you may need to assign read and execute permissions to it.

Microsoft SCCM App Wrapping Tool
{{{ Supported for Parallels Only  }}}

The process for creating and deploying Configuration Manager applications to Mac computers is similar to the deployment process for Windows computers. However, before you create Configuration Manager applications that contain Mac deployment types, you must prepare the applications by using the CMAppUtil tool. This tool is downloaded with the Mac client installation files. The CMAppUtil tool can gather information about the application, which includes detection data from the following Mac packages:

  • Apple disk image (.dmg)
  • Meta package file (.mpkg)
  • macOS X installer package (.pkg)
  • macOS X application (.app)

After it gathers application information, the CMAppUtil then creates a file with the extension .cmmac. This file contains the installation files for the Mac software and information about detection methods that can be used to evaluate whether the application is already installed. CMAppUtil can also process .dmg files that contain multiple Mac applications and create different deployment types for each application.

  1. Copy the Mac software installation package to the folder on the Mac computer where you extracted the contents of the macclient.dmg file that you downloaded from the Microsoft Download Center.
  2. On the same Mac computer, open a terminal window and navigate to the folder where you extracted the contents of the macclient.dmg file.
  3. Navigate to the Tools folder and type the following command-line command:./CMAppUtil <properties>For example, say you want to convert the contents of an Apple disk image file named MySoftware.dmg that’s stored in the user’s desktop folder into a cmmac file in the same folder. You also want to create cmmac files for all applications that are found in the disk image file. To do this, use the following command line:./CMApputil –c /Users/ <User Name> /Desktop/MySoftware.dmg -o /Users/ <User Name> /Desktop -a


    The application name can’t be more than 128 characters.

    To configure options for CMAppUtil, use the command-line properties in the following table:

    Property More information
    -h Displays the available command-line properties.
    -r Outputs the detection.xml of the provided .cmmac file to stdout. The output contains the detection parameters and the version of CMAppUtil that was used to create the .cmmac file.
    -c Specifies the source file to be converted.
    -o Specifies the output path in conjunction with the –c property.
    -a Automatically creates .cmmac files in conjunction with the –c property for all applications and packages in the disk image file.
    -s Skips generating the detection.xml if no detection parameters are found and forces the creation of the .cmmac file without the detection.xml file.
    -v Displays more detailed output from the CMAppUtil tool together with diagnostic information.
  4. Ensure that the .cmmac file has been created in the output folder that you specified.