Deploying the Datto RMM macOS agent with Microsoft Intune

Upload a shell script to Intune to install the Datto RMM Agent on assigned Mac devices.

Before you begin

Confirm that the target devices are enrolled in Intune. Save the installation script as a .sh file and test it locally. For a quarantined agent, use a script that reads the Site ID from the local configuration file. For a new deployment, add your Site ID to the script.

NOTE  For information on creating an install script for macOS devices in Intune, refer to Create the Shell or Bash scripts for macOS Agents.

Procedure

Follow the steps below to create a deployment script in Intune.

NOTE  For more information on the fields configured, refer to Add script fields.

1. In the Intune Admin Center, go to Devices, then macOS, and then Scripts.
2. Click Add.
3. In the Name field, type Install Datto RMM Agent.
4. In the Description field, type Downloads and installs the Datto RMM Agent on macOS devices.
5. Click Next.
6. Under Script File, upload your shell script, for example InstallDattoRMM.sh.

   NOTE  For information on creating a deployment script, refer to Create the Shell or Bash scripts for macOS Agents.

7. In the Run Script As Signed-In User list, select No.
8. (Optional) In the Hide Script Notifications on Device list, select Yes.
9. In the Script Frequency list, select Run Once.
10. (Optional) In the Max Number of Times to Retry list, select 3.
11. Click Next.
12. Select the Microsoft Entra ID groups that receive the script, for example All macOS Devices or Datto RMM Deployment Test Group.

    NOTE  For more information on configuring device groups in Microsoft Intune, refer to Create Device or User Groups for each customer/site.

13. Click Next.
14. Review the settings, and then click Add.

Result

Intune deploys the script to assigned devices during the next check-in and installs the Datto RMM Agent.

Add script fields

The Add Script pages appear in the Intune Admin Center under Devices, macOS, and Scripts. Use these fields to upload and configure the installation script.

Field	Description
Name	The name of the script, for example Install Datto RMM Agent.
Description	A short summary of what the script does.
Script File	The .sh shell script to upload, for example InstallDattoRMM.sh.
Run Script As Signed-In User	Determines whether the script runs as the signed-in user. Select No to run the script as root, which software installation requires.
Hide Script Notifications on Device	(Optional) Determines whether script notifications appear on the device. Select Yes to hide them.
Script Frequency	How often the script runs. Select Run Once for installation scripts.
Max Number of Times to Retry	(Optional) The number of times Intune retries the script if it fails, for example 3.

Create the Shell or Bash scripts for macOS Agents

You will need a script for each site you wish to deploy Agents to. The generic script you need is below, but must be customized for each site. Perform the following steps to create and customize the script.

1. Copy and paste this script block into a text editor:

   #!/bin/bash
   
   Platform=<Paste your platform name here>
   SiteID=<paste your Site ID here>
   
   # Quarantined agent: You can edit this script to pull the Site ID from the existing Config File using
   #SiteID=$(xmllint --xpath 'string(//setting[@name="Profile"]/value)' \"/usr/local/share/CentraStage/CentraStage.exe.config")
   
   # Datto RMM Agent deploy designed and written by Jon North, Datto, March 2021
   # Updated by Aidan K, Datto, October 2026
   # Download the Agent installer, run it, wait for it to finish, delete it
   # First check if Agent is already installed and instantly exit if so.
   
   if [ -d "/Applications/RMM Agent.app" ] ; then
   echo "Datto RMM Agent already installed on this device" ; exit
   fi
   
   # Output target site ID and timestamp
   echo "Target site ID: $SiteID"
   echo "Current date and time is `date`"AgentFilename='DRMMSetup_'$(date +"%Y-%m-%d_%H-%M")
   
   # Download the Agent
   curl -L -o "/tmp/$AgentFilename.zip" "https://$Platform.rmm.datto.com/download-agent/mac/$SiteID"
   
   # Unzip and install the Agent
   mkdir -p  "/tmp/$AgentFilename"
   unzip -a -o "/tmp/$AgentFilename.zip" -d "/tmp/$AgentFilename"
   installer -pkg "/tmp/$AgentFilename/AgentSetup/CAG.pkg" -target /
   rm "/tmp/$AgentFilename.zip"
   rm -rf "/tmp/$AgentFilename"
   exit

IMPORTANT  If you are creating the script on a Windows device, ensure you use Unix-style newline characters or the script will fail to run on your macOS devices. Native Windows applications Notepad and Wordpad cannot do this, but the freeware application Notepad++ is able to. In the Edit menu, select EOL Conversion and then Unix (LF), NOT Macintosh (CR):


2. Copy the platform name of your Datto RMM account and paste it at the end of the Platform=<Paste your platform name here> line. The platform name is at the start of the URL; it will be Pinotage or Merlot (EMEA), Concord, Vidal, or Zinfandel (NA), or Syrah (APAC).
   
3. Copy the target site ID and paste it at the end of the SiteID=<paste your Site ID here> line. To find the site ID, refer to Site ID in Editing a site.

   EXAMPLE  
   
   

   NOTE  If running the installer in order to update an existing install, you can set the SiteID to equal $(xmllint --xpath 'string(//setting[@name="Profile"]/value)'\"/usr/local/share/CentraStage/CentraStage.exe.config")

4. Save the resulting script as a file with the extension .bash. Repeat this process for each site you want to deploy Agents to.

NOTE   Ensure the files are saved with the .bash extension. If you have hidden file extensions, it may be that your text editor will append a .txt extension that you will not be able to see.

NOTE  The ID column is displayed by default, but may have been removed from your view. If this is the case, you can add it via the Column Chooser. Refer to List of sites and Column Chooser field definitions.

NOTE  If you have a large number of sites, you may find it easier to download the list. You can do this with the site variable import template. Refer to Import Site Variables in Global Settings.

Deploy a PPPC profile that grants the Datto RMM Agent the Accessibility, Screen Recording, and Full Disk Access permissions.

Before you begin

Confirm that the target devices are enrolled in Intune and that you have administrative access to the Intune Admin Center. Create a PPPC configuration profile (.mobileconfig or XML plist) that grants Accessibility, Screen Recording, and Full Disk Access (SystemPolicyAllFiles) to the agent. Reference the Bundle ID com.centrastage.tray and the Team ID "9SE992588M". You can use a tool such as PPPC Utility to create the file. You do not need to sign it.

NOTE  Starting with macOS 27, PPPC profiles no longer configure Accessibility. Use the DDM procedure in this topic for Accessibility on macOS 27 and later.

Procedure

1. In the Intune Admin Center, go to Devices, then macOS, and then Configuration.
2. Click Create, and then click New Policy.
3. In the Platform list, select macOS.
4. In the Profile Type list, select Templates.
5. Select the Custom template.
6. Click Create.
7. In the Name field, type a name for the policy, for example Datto RMM macOS PPPC Profile.
8. Click Next.
9. In the custom configuration profile settings, type a profile name.
10. Select the appropriate deployment channel.
11. Upload your PPPC configuration profile.
12. Click Next.
13. Select the Microsoft Entra ID groups that receive the profile, for example All macOS Devices or Datto RMM Pilot Devices.
14. Click Next.
15. Review the configuration, and then click Create.

Result

Intune deploys the PPPC profile to assigned devices during the next sync.

Replace the Team ID in a deployed profile when you already have a working Datto RMM PPPC policy in Intune.

Procedure

1. Open the existing PPPC configuration profile in a text editor.
2. Replace the Team ID BBM5M4X7UW with "9SE992588M".
3. Confirm that the Team ID is enclosed in standard quotation marks, for example certificate leaf[subject.OU] = "9SE992588M".
4. Upload the updated profile to the Intune policy.

Result

The profile references the current Team ID.

NOTE  If validation fails with a CodeRequirement error, confirm that the Bundle ID is com.centrastage.tray, that the quotation marks are not smart quotes, and that your editor added no invalid characters.

Deliver a DDM profile that prompts for Accessibility and Local Network approval on devices running macOS 27 or later.

Before you begin

Confirm that the devices run macOS 27 or later, are enrolled in Intune, support DDM, and have the Datto RMM Agent installed. Supervised devices are recommended.

Procedure

Follow the steps below to create a DDM profile in Intune.

NOTE  For more information on the fields configured, refer to DDM App Settings fields.

1. In the Intune Admin Center, go to Devices, then macOS, and then Configuration.
2. Click Create, and then click New Policy.
3. In the Platform list, select macOS.
4. In the Profile Type list, select Settings Catalog.
5. Click Create.
6. In the Name field, type a profile name, for example Datto RMM DDM Privacy Permissions.
7. Click Next.
8. Click Add Settings.
9. Go to Declarative Device Management (DDM), and then select App Settings from the list.
10. Expand Privacy, then Permission Defaults, then Permission Defaults, and then ANY.
11. Select Accessibility and Local Network.
12. Close the Settings picker.
13. Under Permissions > Defaults scroll to the right to the Configure Instance section.
14. In the Accessibility list, select Allow.
15. In the Local Network list, select Allow.
16. In the Organization Justification field, type the reason for the permissions, for example Required for Datto RMM remote support functionality.
17. In the Permission Defaults field, type com.centrastage.tray ("9SE992588M").
18. Click Save, then click Next.
19. Select the groups that receive the configuration, for example All macOS Devices or Datto RMM Pilot Devices.
20. Click Next.
21. Review the settings, and then click Create.

Result

Intune delivers the policy during the next sync. macOS then displays a privacy consent prompt for the Datto RMM Agent, and the person using the device must click Allow to grant the permission.

DDM App Settings fields

The Configure Instance section appears after you add the App Settings privacy settings to a Settings Catalog policy. Use these fields to define the permissions the agent requests.

Field	Description
Accessibility	The Accessibility permission for the agent. Select Allow.
Local Network	The Local Network permission for the agent. Select Allow.
Organization Justification	The reason your organization requires the permissions, for example Required for Datto RMM remote support functionality.
Permission Defaults	The Bundle ID and Team ID of the agent. Type com.centrastage.tray ("9SE992588M").