# Deploy with Intune

Ship the Straza MSI to Windows machines as an Intune Win32 app that runs in System context, and the signed Straza pkg to Macs as a macOS PKG app with a shell script and a Managed Login Items profile, each with the managed install for your Straza server.

- Who: You, as the Intune administrator of the machines whose agents you govern
- Where: A Windows machine for the packaging, and the Microsoft Intune admin center
- Profile: Standalone and enterprise

In short: Intune puts the Straza background service on Windows machines and Macs, with the managed install for your Straza server. On Windows one Win32 app runs the MSI and the managed install in System context. On a Mac a PKG app installs the package, a script runs the managed install, and a Managed Login Items profile keeps the service on.


Intunecanput`strazaservice`oneveryWindowsmachineandeveryMacofafleet.ForWindows,thispagepackagestheStrazaMSIandthemanagedinstallforyourStrazaserverasoneWin32appthatIntunerunsinSystemcontext.Thosearethetwostepsthat[InstalltheserviceonWindows](https://docs.straza.ai/guides/operate/install/index.md#install-the-service-on-windows)takesbyhand.Eachpersonthenenrollsonce,as[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md#a-windows-machine)shows.ForMacs,[DeploytomacOS](#deploy-to-macos)addstheStrazapackageformacOS,themanagedinstallandaprofilethatkeepstheserviceswitchedon.##Beforeyoustart{.nostep}-TheStrazaMSI,`straza_<version>_windows_amd64.msi`,from2.0.0oralaterrelease,checkedwithcosignanditschecksumas[Install](https://docs.straza.ai/guides/operate/install/index.md#download-a-release-and-verify-it)shows.ItcarriesnoAuthenticodesignatureyet,sothechecksumiswhatshowsthatitcamefromthereleasejob.-Windowsmachinesonamd64,becausetheMSIinstallsonamd64only.-Microsoft'sWin32ContentPrepTool,`IntuneWinAppUtil.exe`,onthemachinewhereyoupackage.-TheaddressofyourStrazaserver,andtheharnessesthemachinesrun:`claude-code`,`codex`or`gemini`.##PackagetheinstallerMakeanemptyfoldernamed`straza-app`andcopytheMSIintoitas`straza.msi`,sothescriptscarrynoversion.Savethefirstscriptbelowas`install.cmd`inthatfolder,withyourownserver'saddressandeveryharnessthemachinesrunattheendofitsmanagedinstallline.Savethesecondas`uninstall.cmd`.```bat@echooffmsiexec/i"%~dp0straza.msi"/qn/norestartsetrc=%errorlevel%ifnot%rc%==0ifnot%rc%==3010exit/b%rc%"C:\ProgramData\straza\bin\straza.exe"install--managed--serverhttps://straza.example.comclaude-codeiferrorlevel1exit/b1exit/b%rc%``````bat@echooffmsiexec/x"%~dp0straza.msi"/qn/norestart%*exit/b%errorlevel%````install.cmd`stopsonanyexitcodeoftheMSIotherthan`0`and`3010`.Itthenrunsthemanagedinstallwiththe`straza.exe`theMSIinstalled,andithandsIntunetheMSI'sexitcode.A`3010`meanstheinstallsucceededandarestartfinishesremovinganoldfilethatwasinuse,andIntunecountsitasasoftreboot.ClaudeCodeusesonlyitshighestmanagedsettingssource,soonaWindowsmachinewitharegistrypolicyforClaudeCodeorserver-managedsettingsthatlackStraza'shooks,ClaudeCodeskipsthemwithnowarning,as[ClaudeCodeskipsStraza'shooksunderahighermanagedsource](https://docs.straza.ai/security/known-limits/index.md)inKnownlimitssays.Thenpackagethefolder.PowerShell,inthefolderthatholdsstraza-app:```powershellIntuneWinAppUtil.exe-c.\straza-app-s.\straza-app\install.cmd-o.\out-q```Youshouldsee:`install.intunewin`inthefolder`out`,thepackagethatIntunetakes.##AddtheappIntheMicrosoftIntuneadmincenter,openApps,thenAllApps,andcreateanappofthetypeWindowsapp(Win32).Select`install.intunewin`astheapppackagefile.FillintheProgramandRequirementspagesasthetableshows,andkeepthedefaultlistofreturncodes,where`3010`isasoftreboot.|Field|Value||---|---||Installertype|Commandline||Installcommand|`install.cmd`||Uninstallcommand|`uninstall.cmd`||Installbehavior|System||Devicerestartbehavior|Determinebehaviorbasedonreturncodes||Operatingsystemarchitecture|x64only|Addthedetectionruleofthenextstep,thenassigntheapptoyourdevicegroupasRequired.##DetecttheinstallOntheDetectionrulespage,chooseacustomdetectionscriptanduploadtheonebelow,savedas`detect.ps1`.LeaveitstwooptionsatNo:runningasa32-bitprocessandenforcingasignaturecheck.WritetheversionfromyourMSI'sfilenamein`$want`,suchas`2.0.0`for`straza_2.0.0_windows_amd64.msi`.```powershell$want='2.0.1'$exe='C:\ProgramData\straza\bin\straza.exe'$svc=Get-Servicestraza-service-ErrorActionSilentlyContinueif($svc.Status-ne'Running'-or-not(Test-Path$exe)){exit1}$line=&$exeversionif($line-like"straza$want(*"){Write-Output$line;exit0}exit1```Intunecountstheappasinstalledonlywhenthescriptprintsalineandexitswith0.Thisscriptdoessowhentheservicerunsand`strazaversion`namestheversionyoupackaged.Afilerulecannotcomparethatversion,because`straza.exe`carriesnofileversion.Theservicereports`Running`onlyonceitspipelistens,soamachinewhereitcannottakeitspipefailsdetection.##Upgradeandremove{.nostep}Foralaterrelease,packageitsMSIthesameway,withitsversionin`$want`.Additasanewappthatsupersedesthisone,withUninstallpreviousversionsettoNo.ThenewMSIthenupgradestheinstalledoneinplacewhileharnesswindowsstayopen,andeveryenrollmentonthemachinestays.Afterthefirstupgradethatbrings`git-remote-straza.exe`,peoplesignoutandinonce,as[GitthroughStraza](https://docs.straza.ai/guides/serve-mcp-apps/git-through-straza/index.md#before-you-start)says.SettoYes,Intunewouldruntheoldapp'suninstallfirst,whichremovesthemanagedwiringandtheserviceuntilthenewinstallputsthemback.TheuninstallremovesthemanagedwiringofClaudeCode,CodexCLIandGeminiCLI,stopsandremoves`strazaservice`andremoves`straza.exe`anditscopy`git-remote-straza.exe`.WiththemgoestheMSI'sPATHentry.Itkeepsthekeysin`C:\ProgramData\straza-service`,soalaterinstallresumeseveryenrollment.Italsokeeps`C:\ProgramData\straza\config.yaml`andthecodexshimbesidethebinary.Todeletethekeysaswell,asonmachinesyouretire,settheuninstallcommandto`uninstall.cmdPURGE=1`.Thenrevokeeachmachine'sdevicesattheStrazaserver,as[Backupandupgrade](https://docs.straza.ai/guides/operate/backup-and-upgrade/index.md#remove-straza-from-a-client-machine)shows.IntunerunsbothscriptsastheWindowsSYSTEMaccount,whichisnoperson'saccount.Forcodex,themanagedinstallthereforewritesnoStrazaMCPregistrationintoanyperson's`config.toml`,andthemanagedcodexhooksstillenforceeverycodextoolcall.Theuninstallleaveseachperson's`config.toml`asitis.##DeploytomacOS{.nostep}OnaMacfleet,IntuneinstallstheStrazapackageformacOSasamacOSapp,runsthemanagedinstallasashellscriptofitsown,andinstallsaprofilethatkeepstheserviceswitchedon.Thosearethestepsthat[InstalltheserviceonmacOS](https://docs.straza.ai/guides/operate/install/index.md#install-the-service-on-macos)takesbyhand,andeachpersonthenenrollsonce,as[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md#a-macos-machine)shows.Youneedthefollowing:-TheStrazapkg,`straza_<version>_darwin_universal.pkg`,from2.0.0oralaterrelease,checkedwithcosignanditschecksumas[Install](https://docs.straza.ai/guides/operate/install/index.md#download-a-release-and-verify-it)shows.ThereleasejobsignsitwiththeDeveloperIDofSynapTechs.r.o.,teamWMPWM57KYK,andApplenotarizesit.-MacsonmacOS13orlater,enrolledinIntunethroughAutomatedDeviceEnrollmentorwithanenrollmentthepersonapproved,whichtheprofileofthelaststepneeds.-TheaddressofyourStrazaserver,andtheharnessestheMacsrun:`claude-code`,`codex`or`gemini`.###AddthepkgasanappIntheMicrosoftIntuneadmincenter,openApps,thenAllApps,andcreateanappofthetypemacOSapp(PKG).Selectthepkgastheapppackagefile.OntheProgrampage,leaveboththepre-installscriptandthepost-installscriptempty.Intunereportstheappinstalledevenwhenitspost-installscriptfails,soamanagedinstalltherecouldfailwithnosignintheadmincenter,andthenextsteprunsitasascriptwhosefailureshows.OntheRequirementspage,choosemacOS13astheminimumoperatingsystem.FillintheDetectionrulespageasthetableshows,thenassigntheapptoyourdevicegroupasRequired.|Field|Value||---|---||Ignoreappversion|No||Includedapps|Oneentry,withthebundleID`ai.straza.straza`andtheversionofthepkg,suchas`2.0.1`for`straza_2.0.1_darwin_universal.pkg`.Deleteanyotherentry.|Thepkginstallsnoappbundle,so`ai.straza.straza`istheidentifierofitspackagereceipt.ApostonMicrosoft'sIntuneblogsaysthattheagentreadspackagereceiptstoo,andnotenanthasshownyetthatIntunereportsthisappasinstalled.WithIgnoreappversionsettoNo,IntuneinstallsapkgwhoseversiondiffersfromtheoneontheMac,whichishowalaterreleasereachesthefleet.###RunthemanagedinstallasascriptSavethescriptbelowas`straza-managed.sh`,withyourownserver'saddressin`server`andeveryharnesstheMacsrunattheendofitslastline,suchas`claude-codecodex`,becausethemanagedinstalltakesseveral.```sh#!/bin/sh#Intunerunsthisasroot,besidethepkgapp'sinstall,soitwaitsforthepkg.server=https://straza.example.combin=/opt/straza/bin/strazawaited=0while[!-x"$bin"];doif["$waited"-ge1800];thenecho"TheStrazamanagedinstallwaited30minutesfor$bin,whichtheStrazapkgappinstalls,anditisstillmissing,sonothingwaschanged.Checkthepkgapp'sinstallstatusforthisMacinIntune,thenletthisscriptrunagain.">&2exit1fisleep30waited=$((waited+30))doneexec"$bin"install--managed--server"$server"claude-code```ThenopenDevices,thenByplatform,macOS,Managedevices,Scripts,andaddthescriptwiththesesettings,assignedtothesamedevicegroup.|Field|Value||---|---||Uploadscript|`straza-managed.sh`||Runscriptassigned-inuser|No,soitrunsasroot||Scriptfrequency|Notconfigured,soitrunsonce||Maxnumberoftimestoretryifscriptfails|3|Intunerunsscriptsandappinstallssidebyside,sothescriptwaitsupto30minutesforthebinarythatthepkginstalls.Anonzeroexit,fromthatwaitorfromthemanagedinstall,showsasFailedinthescript'sDevicestatus,soaMacwhosemanagedinstallfailedstandsoutthere.Themanagedinstallrunsasroot,outsidesudo,soforcodexitwritesnoStrazaMCPregistrationintoanyperson's`config.toml`andsaysso.Themanagedcodexhooksstillgoverneverycodextoolcall.ClaudeCodeusesonlyitshighestmanagedsettingssource,soonaMacwithaClaudeCodeprofileorserver-managedsettingsthatlackStraza'shooks,ClaudeCodeskipsthemwithnowarning,as[ClaudeCodeskipsStraza'shooksunderahighermanagedsource](https://docs.straza.ai/security/known-limits/index.md)inKnownlimitssays.###KeeptheserviceswitchedonWithoutaManagedLoginItemsprofile,theservicecanbeswitchedoffunderLoginItems&ExtensionsinSystemSettings,andwhileitisoffeverygovernedtoolcallontheMacisrefused.CreateaprofileformacOSofthetypeSettingscatalog.Inthesettingspicker,searchforManagedLoginItems,addServiceManagement-ManagedLoginItems,andaddonerule.|Field|Value||---|---||RuleType|TeamIdentifier||RuleValue|`WMPWM57KYK`||Comment|`Strazaservice`,orleaveitempty|Assigntheprofiletothesamedevicegroup.TherulematcheseveryloginitemwhosecodeissignedbyteamWMPWM57KYK,whichistheStrazaserviceofthereleasepkg.macOSturnssuchanitemonandkeepsiton,andonmacOS26italsoskipsitspromptaboutbackgrounditemsforit.Apackagebuiltfromsourcewithoutthatteam'sDeveloperIDdoesnotmatchtherule.###UpgradeandremoveonmacOSForalaterrelease,opentheapp,selectthenewpkgasitsapppackagefileandgivetheincludedappthenewversion.IntunetheninstallsitoneveryMacthathastheoldone,andthepkgupgradesinplacewhileharnesswindowsstayopen,as[Backupandupgrade](https://docs.straza.ai/guides/operate/backup-and-upgrade/index.md)describes.Themanagedinstallneedsnonewrun.Theupgradekeepsitsconfigurationandwiring.IntunehasnouninstallforamacOSPKGapp.TotakeStrazaoffaMac,removetheMacfromtheapp'sandthescript'sassignments,thenassignitasecondscriptthatrunstheuninstallofthebinaryitself,withRunscriptassigned-inusersettoNo.```sh#!/bin/shexec/opt/straza/bin/strazainstalleruninstall```Theuninstallstopstheserviceandremovesthemanagedwiring,thepackage'sfilesanditsreceipt,andkeepsthekeysin`/var/db/straza-service`forareinstall.OnaMacyouretire,add`--purge`,whichalsodeletesthekeysandthe_straza-serviceaccount,andthenrevoketheMac'sdevicesattheStrazaserver,as[Backupandupgrade](https://docs.straza.ai/guides/operate/backup-and-upgrade/index.md#remove-straza-from-a-client-machine)shows.##Whatwastested{.nostep}ThisrecipehasnotrunonanIntunetenant.ItiswrittenfromtheMSI'ssourcein`deploy/windows`andfromMicrosoft'spagesonWin32apps.OutsideIntune,atestscriptinstalledMSIsbuiltfromthesourcetreeonaWindows10machineon2026-10-26,upgradedonewhilehooksran,sawanolderonerefused,anduninstalledandpurgedthem,as[Requirementsandsizing](https://docs.straza.ai/reference/requirements-and-sizing/index.md#tested-with)records.ThemacOSparthasnotrunonanIntunetenanteither,sowhetherIntunedetectsthepkgthrough`ai.straza.straza`hasnotbeenseen,andnoMacenrolledinIntunehastakenthepkg,thescriptortheprofile.Itiswrittenfromthereleaseworkflowandthepkg'ssources,beforeanyreleasecarriedapkg,andfromMicrosoft'spagesonmacOSPKGappsandshellscripts.Anunsignedpackagebuiltfromthesourcetree,andon2026-10-27apackagesignedwiththeDeveloperIDandnotarizedbyApple,raninamacOS26.6.2virtualmachinethatnodevicemanagementtoolmanages.


Walked on v1.0.0-1614-g5e1d90de-dirty on 2026-10-26, except every Intune step, which has not run on a tenant, a Windows machine or a Mac. Not walked. The Windows part was written on 2026-10-23 from the working tree of the Windows MSI before its commit, and from Microsoft's pages on adding a Win32 app to Intune and on the Win32 Content Prep Tool, read the same day. The macOS part was written on 2026-10-26 from the working tree of the release workflow that adds the pkg, before any release carried one, and from Microsoft's pages on macOS PKG apps and macOS shell scripts, read the same day. No Intune tenant, no Windows machine and no Mac has run this recipe. Outside Intune, MSIs built from the source tree at v1.0.0-1600-g3c02a286 were installed, upgraded, uninstalled and purged on a Windows 10 machine by a test script on 2026-10-26. On 2026-10-27 a pkg built at v1.0.0-1615-g272946e5, signed with the Developer ID and notarized by Apple, passed spctl on a Mac, and a test script installed, upgraded, uninstalled and purged it in a macOS 26.6.2 virtual machine that no device management tool manages.