Deploying the sensor via your MDM system.Installing the package file via terminal.There are three methods for installing the falcon sensor on your macOS system: Interactively installing the sensor package 1 time for script retries should be plenty, but this setting is at your discretion.Setting Not Configured for the Script Frequency will ensure it runs only once (Unless the script is updated or the user's cache is deleted).Choose your preference for Hide script notifications on devices.Select 'No' For Run script as signed-in user so it runs as the superuser instead of the local user.Open open the Microsoft Endpoint Manager admin center.

(Thanks to both and RhubarbBread on the MacAdmins slack for guidance on this) This script uses JXA & Open Scripting Architecture to parse JSON (We used to use Python, but runtimes are being deprecated in MacOS). Now the actual deployment of Crowdstrike - This should work on M1 and Intel with no additional dependencies. Repeat steps 3-8 for MobileConfigs/Falcon Profile - kexts.mobileconfig Review the settings for your profile, and click Create Upload MobileConfigs/Falcon Profile.mobileconfigĬhoose the users and/or devices to deploy to Click CreateĮnter the basic details for the profile. In the blade that opens on the right, select macOS for platform, Templates for Profile type, and Custom for template name. Open open the Microsoft Endpoint Manager admin center mobileconfig files in /MobileConfigs by doing the following:

mobileconfigs - one with the standalone kexts and one with the rest of the permissions - the kexts will still fail on Apple Silicon, but it doesn't cause any issues with the installation, since Crowdstrike doesn't try to use them on M1.ĭeploy the. The closest thing to do to get this to work is to deploy two. This would be an easy fix if there was a way to identify arm64 devices in intune for use in Dynamic Groups or the new Filters feature - but so far I haven't figured out a decent way to do this (If you find something, please submit an issue or PR on this repo!). Unfortunately this profile does not work on Apple Silicon (M1) devices due to lack of support for KExts. Step 1 - Deploy configuration profilesĬrowdstrike provides a Configuration profile to enable KExts, System Extensions, Full Disk Access and Web Content Filtering that can be deployed by Intune. Here's the steps I went through to get it working.

It's much easier and more reliable to use a shell script to deploy Crowdstrike Falcon Protect to end-users. pkg files directly - instead requiring wrapping them using custom scripts. Installing Crowdstrike Falcon Protect via Microsoft Intune

Install crowdstrike on mac