NetNXT Logo

How to Deploy SentinelOne Agent on macOS Using Intune

February 17, 2026
2 min read
ByYogita

Overview

This Knowledge Base article provides step-by-step instructions to deploy the SentinelOne agent on macOS devices using Microsoft Intune. This deployment method uses Intune configuration profiles and a shell script to install and register the agent automatically with your SentinelOne tenant.

Step 1: Upload SentinelOne PKG to Storage

Upload the PKG file to one of the following:

Recommended:

• Azure Blob Storage
• Secure Web Server
• Internal Repository

Example:

https://storageaccount.blob.core.windows.net/mac/Sentinel.pkg

Ensure the URL is publicly accessible or accessible to devices.

Step 2: Deploying the Necessary Profiles

There are four profiles we need to deploy:

  1. Network Monitoring

  2. Privacy Control

  3. Notifications

  4. Network Filtering

All these Profiles you can get from here. We need to create a custom device configuration policy in Intune.

a) From Intune, navigate to devices > macos > configuration. Click Add

b) Then select Templates > Custom:

c) Provide a name for the Intune policy, and then click Next to continue to the configuration settings.

  • Enter the profile name. This name will appear in the macOS Settings on the device.

  • Select the deployment channel as Device Channel.

  • Browse and upload the .mobileconfig file.

  • Click Next

d) Assign to your target groups, and then repeat these steps for the other three profiles

FAQ

1) How do I deploy SentinelOne on macOS using Microsoft Intune?

Upload the SentinelOne PKG to secure storage, create custom macOS configuration profiles in Intune, upload required .mobileconfig files, and assign them to device groups.

2) What profiles are required for SentinelOne macOS Intune deployment?

You must deploy Network Monitoring, Privacy Control, Notifications, and Network Filtering profiles to ensure full functionality and avoid user prompts.

3) Where should I host the SentinelOne macOS PKG file?

Host the PKG file on Azure Blob Storage, a secure web server, or an internal repository accessible to enrolled macOS devices.

4) Why are macOS configuration profiles required for SentinelOne?

macOS requires explicit system permissions for extensions, filtering, and monitoring. Profiles pre-approve these settings for silent, zero-touch deployment.

5) What deployment channel should be used in Intune for macOS profiles?

Use the Device Channel when creating custom macOS configuration policies to ensure proper system-level approval and enforcement.

Was this article helpful?