You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
IntuneBrew is a PowerShell-based tool that simplifies the process of uploading and managing macOS applications in Microsoft Intune. It automates the entire workflowβfrom downloading apps to uploading them to Intune with proper metadata and icons.
This project uses publicly available metadata from Homebrewβs JSON API. Homebrew is a registered trademark of its respective owners and is not affiliated with or endorsing this project.
Open your Automation Account and select Account Settings -> Identity.
Turn Status on tab "System assigned" to "On".
Add the following API permissions to your System Managed Identity using this PowerShell script: Microsoft Tech Community
DeviceManagementApps.ReadWrite.All
Open Entra admin center -> Applications -> Enterprise Applications. Change Filter "Application type" to "Managed Identities" and search for your Automation Account name. Open the entity.
Verify that the right permissions are set to the Managed Identity in the Security -> Permissions tab.
Create a new Variable in your Automation Account with the name "AuthenticationMethod" and value "SystemManagedIdentity" to use the System Managed Identity.
Using User Assigned Managed Identity
Open Azure Portal and search for "Managed Identities".
Click "Create" and select your Azure Subscription & Resource group. Choose your region and set a name for the identity.
Open your Automation Account and select Account Settings -> Identity.
Switch to tab "User assigned" and click "Add". Choose the previously created Managed Identity.
Add the following API permissions to your System Managed Identity using this PowerShell script: Microsoft Tech Community
DeviceManagementApps.ReadWrite.All
Open Entra admin center -> Applications -> Enterprise Applications. Change Filter "Application type" to "Managed Identities" and search for your Automation Account name. Open the entity.
Verify that the right permissions are set to the Managed Identity in the Security -> Permissions tab.
Create a new Variable in your Automation Account with the name "AuthenticationMethod" and value "UserAssignedManagedIdentity" to use the User Assigned Managed Identity.
Using ClientSecret from Entra ID App Registration
Create a new App Registration in Azure
Add the following API permissions:
DeviceManagementApps.ReadWrite.All
Update the parameters in the script with your Azure details.
$appid = '' # App ID of the App Registration
$tenantid = '' # Tenant ID of your EntraID
$certThumbprint = '' # Thumbprint of the certificate associated with the App Registration
The -ConfigFile parameter enables non-interactive authentication, which is perfect for automation scenarios and macOS support. This method uses a JSON configuration file containing your authentication credentials.
Create a configuration file based on one of these templates:
For Client Secret Authentication (clientSecret.json):
authMethod: Must be exactly "Certificate" (case-sensitive)
tenantId: Your Azure AD tenant ID (GUID format)
clientId: The Application (client) ID from your App Registration
certificateThumbprint: The thumbprint of the certificate uploaded to your App Registration (40 character hex string, no spaces or colons)
The certificate must be installed in the current user or local machine certificate store
Ensure your App Registration has the required permissions:
DeviceManagementApps.ReadWrite.All
Use the configuration file with any IntuneBrew command:
# Update all apps non-interactively
.\IntuneBrew.ps1 -UpdateAll -ConfigFile "clientSecret.json"# Upload specific apps with automation
.\IntuneBrew.ps1 -Upload "slack","zoom"-ConfigFile "certificateThumbprint.json"
Tip
The ConfigFile parameter is especially useful for:
Automated deployments in CI/CD pipelines
Scheduled tasks without user interaction
Avoiding interactive authentication prompts
Copy Assignments
Using the -CopyAssignments switch with IntuneBrew.ps1 or creating a CopyAssignments Variable with Boolean Value true in your Azure Automation indicates that assignments from the existing app version should be copied to the new version.
Azure Automation Variables
The following automation variables can be configured in your Azure Automation Account:
Variable
Type
Required
Default
Description
AuthenticationMethod
String
Yes
-
Authentication method: SystemManagedIdentity, UserAssignedManagedIdentity, or ClientSecret
TenantId
String
For ClientSecret
-
Azure AD Tenant ID
AppId
String
For ClientSecret/UserAssigned
-
Application/Client ID
ClientSecret
String
For ClientSecret
-
Client Secret value (not the ID)
CopyAssignments
Boolean
No
false
Copy assignments from old app version to new version
UseExistingIntuneApp
Boolean
No
false
Update existing apps instead of creating new ones (preserves assignments)
MaxAppsPerRun
Integer
No
10
Maximum apps to process per run (prevents memory issues in Azure sandbox)
Notes:
When UseExistingIntuneApp is true, CopyAssignments is automatically ignored (assignments are preserved on the existing app)
MaxAppsPerRun helps prevent the Azure Automation sandbox from suspending due to the 1GB memory limit
App JSON Structure
Apps are defined in JSON files with the following structure:
IntuneBrew implements sophisticated version comparison logic:
Handles various version formats (semantic versioning, build numbers)
Supports complex version strings (e.g., "1.2.3,45678")
Manages version-specific updates and rollbacks
Provides clear version difference visualization
Version comparison rules:
Main version numbers are compared first (1.2.3 vs 1.2.4)
Build numbers are compared if main versions match
Special handling for complex version strings with build identifiers
π οΈ Error Handling
IntuneBrew includes robust error handling mechanisms:
Upload Retry Logic
Automatic retry for failed uploads (up to 3 attempts)
Exponential backoff between retries
New SAS token generation for expired URLs
File Processing
Temporary file cleanup
Handle locked files
Memory management for large files
Network Issues
Connection timeout handling
Bandwidth throttling
Resume interrupted uploads
Authentication
Token refresh handling
Certificate expiration checks
Fallback to interactive login
π€ Troubleshooting
Common Issues
File Access Errors
Ensure no other process is using the file
Try deleting temporary files manually
Restart the script
Upload Failures
Check your internet connection
Verify Azure AD permissions
Ensure file sizes don't exceed Intune limits
Authentication Issues
Verify your Azure AD credentials
Check tenant ID configuration
Ensure required permissions are granted
PowerShell 7 Command Not Found
If you're getting "IntuneBrew is not recognized as a name of a cmdlet, function, script file, or executable program" in PowerShell 7:
Step 1: Check your PATH environment variable
"Current PATH:"$env:PATH-split';'
Step 2: Verify IntuneBrew installation location
$intuneBrewInfo=Get-InstalledScript-Name IntuneBrew -ErrorAction SilentlyContinue
if ($intuneBrewInfo) {
"Installed Location for IntuneBrew:"$intuneBrewInfo|Select-Object Name, Version, InstalledLocation
} else {
Write-Warning"IntuneBrew is not installed. Run: Install-Script IntuneBrew -Force"return
}
Step 3: Add IntuneBrew to your PATH if needed
$scriptPath=$intuneBrewInfo.InstalledLocationif (-not ($env:PATH-split';'|Where-Object { $_-eq$scriptPath })) {
Write-Host"`nπ Adding IntuneBrew script folder to PATH..."-ForegroundColor Yellow
[Environment]::SetEnvironmentVariable("PATH","$env:PATH;$scriptPath", [EnvironmentVariableTarget]::User)
Write-Host"β Done. Restart PowerShell to use 'IntuneBrew' as a command."-ForegroundColor Green
} else {
Write-Host"β Script path is already in PATH."-ForegroundColor Green
}
π€ Contributing
Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.
Fork the Project
Create your Feature Branch (git checkout -b feature/AmazingFeature)
Commit your Changes (git commit -m 'Add some AmazingFeature')
Push to the Branch (git push origin feature/AmazingFeature)
Open a Pull Request
Automated Workflows
IntuneBrew uses a chain of GitHub Actions workflows to automate app management. Here's how the pipeline works:
Workflow Chain
App Request Approved
|
v
[1] Auto-Approve App Request
- Validates the app from Homebrew
- Adds app URL to collect_app_info.py
- Commits and pushes changes
|
v
[2] Build App Packages
- Collects app information from Homebrew
- Downloads and repackages apps (DMG/ZIP to PKG)
- Uploads packages to Azure Blob Storage
- Updates Apps/*.json with version info
- Generates supported_apps.json
- Updates README app count badge
|
+------------------+
| |
v v
[3a] Fetch App Icons [3b] Update Version Database
- Downloads missing - Syncs versions to Supabase
app icons from - Sends notifications to
Brandfetch API subscribed users
- Commits to Logos/ |
v
[4] Generate Uninstall Scripts
- Creates PowerShell uninstall
scripts for each app
- Commits to Uninstall Scripts/
Workflow Details
Workflow
Trigger
What It Does
Auto-Approve App Request
/.approve comment or auto-approved label
Validates and adds new apps to the supported list
Build App Packages
Push to collect_app_info.py, daily schedule, or manual
Downloads apps, creates PKG files, uploads to Azure
Fetch App Icons
After Build App Packages completes
Downloads missing app logos from Brandfetch
Update Version Database
After Build App Packages completes
Updates Supabase with version info, sends notifications
Generate Uninstall Scripts
After Update Version Database completes
Creates PowerShell uninstall scripts for Intune
Other Workflows
Workflow
Schedule
Purpose
Categorize Apps
Daily or on app changes
Uses AI to categorize apps
Check App CVEs
Daily at 6 AM UTC
Scans for security vulnerabilities
QA App Installation
Manual only
Tests app installations on macOS
PSScriptAnalyzer
On IntuneBrew.ps1 changes
Lints PowerShell code
Send Weekly Reports
Mondays at 8 AM UTC
Sends fleet summary reports
π License
This project is licensed under the MIT License - see the LICENSE file for details.
π Acknowledgments
Thanks to all contributors who have helped shape IntuneBrew
Microsoft Graph API documentation and community
The PowerShell community for their invaluable resources
IntuneBrew is a PowerShell-based tool that simplifies the process of uploading and managing macOS applications in Microsoft Intune. It automates the entire workflow from downloading apps to uploading them to Intune, complete with proper metadata and logos.