>
    Strata Copilot
    Deploy Prisma Access Agents to macOS Endpoints Using Microsoft Intune
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access Agent
    3. Prisma Access Agent Administration
    4. Deploy the Prisma Access Agent
    5. Deploy Prisma Access Agents Using Microsoft Intune
    6. Deploy Prisma Access Agents to macOS Endpoints Using Microsoft Intune
    Download PDF
    Prisma Access Agent

    Deploy Prisma Access Agents to macOS Endpoints Using Microsoft Intune

    Table of Contents

    Deploy Prisma Access Agents to macOS Endpoints Using Microsoft Intune

    Learn how to deploy Prisma Access Agents to your macOS endpoints using Microsoft Intune.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • NGFW (Managed by Panorama)
    • Check the prerequisites for the deployment you're using
    • Prisma Access Agent
    • macOS endpoints managed by Microsoft Intune
    • Contact your Palo Alto Networks account representative to activate the Prisma Access Agent feature
    Prior to deploying the Prisma Access Agent to macOS devices, you must configure the installation parameters, host the installation package on a server accessible to the endpoints, and then use Microsoft Intune to deploy the installation shell script. You must also deploy a combined configuration profile that enables system extensions, grants full disk access, configures the transparent proxy VPN, configures the content filter, and enables notifications.
    1. Prepare and host the Prisma Access Agent installation package.
      1. Download the Prisma Access Agent for macOS package and configuration file (config.json) from ConfigurationEndpoint Management in Strata Cloud Manager.
      2. Configure the Prisma Access Agent deployment parameters by editing the config.json file. You must include the following parameters:
        • server_url—The Endpoint Manager FQDN (mandatory for pre-deployment)
        • tenant_id—The tenant ID of your PAA setup.
        • disable_remote_shell—Specify true or false to determine whether to remove the feature for accessing an endpoint for troubleshooting using a remote shell.
        • unload_gp—Specify true or false. If the GlobalProtect app is already installed on the end user's device, this parameter specifies whether to disable the GlobalProtect app during the installation of the Prisma Access Agent.
        For example:
        {
     "server_url":"xxx.epm.gpcloudservice.com",
     "tenant_id":"xxxxxxxxxx",
     "disable_remote_shell": false,
     "unload_gp": true
}
      3. Create a .zip file containing both the Prisma Access Agent installer and the config.json file.
      4. Host the .zip file on a server that the enrolled macOS devices can successfully reach.
    2. Deploy the installation script for Prisma Access Agent using Microsoft Intune.
      1. Log in to the Microsoft Intune admin center.
      2. Go to DevicesmacOSScripts.
      3. Create and upload a bash script designed to download the zip file that you prepared in Step 1 from your hosted server, extract it, and run the .pkg installer.
        The following is a sample script named paainstall.sh that you can use as the basis for your own script. Be sure to specify the values for the server_address and ZIP_URL for your prepared installation package.
        In the following sample script, the prepared ZIP file is called PAAcon.zip.
        #!/bin/bash

server_address="192.0.2.5"
ZIP_URL="https://192.0.2.5/PAAcon.zip"

TMP_ZIP="/tmp/PAAcon.zip"
EXTRACT_DIR="/tmp/PAAcon"
LOG_FILE="/var/log/paacon_install.log"

# Setup logging
exec > >(tee -a "$LOG_FILE") 2>&1

echo "=== PAAcon Installation Script ==="
echo "Started at: $(date)"

# Check if already installed
if [ -d "/Applications/PAAcon.app" ] || [ -d "/Library/Application Support/PAAcon" ]; then
    echo "PAAcon already installed, skipping installation..."
   exit 0
fi

echo "Checking server connectivity..."

if ping -c 1 -W 1 "$server_address" > /dev/null 2>&1; then
    echo "Server reached"

    # Clean up any previous files
    rm -rf "$TMP_ZIP" "$EXTRACT_DIR"

    echo "Downloading package..."
    curl -k -L -f -o "$TMP_ZIP" "$ZIP_URL"

    if [ $? -ne 0 ]; then
        echo "Download failed"
        exit 1
    fi

    echo "Extracting package..."
    unzip -o "$TMP_ZIP" -d /tmp > /dev/null 2>&1

    if [ $? -ne 0 ]; then
        echo "Unzip failed"
        exit 1
    fi

    # Automatically detect the pkg file inside extracted folder
    PKG_PATH=$(find "$EXTRACT_DIR" -type f -name "*.pkg" | head -n 1)

    if [ -z "$PKG_PATH" ]; then
        echo "Installer package not found."
        # Cleanup before exit
        rm -rf "$TMP_ZIP" "$EXTRACT_DIR"
        exit 1
    fi

    echo "Installing package: $PKG_PATH"
    sudo installer -pkg "$PKG_PATH" -target /

    if [ $? -eq 0 ]; then
        echo "Installation completed successfully."

        # Cleanup after successful installation
        echo "Cleaning up temporary files..."
        rm -rf "$TMP_ZIP" "$EXTRACT_DIR"
        echo "Cleanup completed"

        echo "Finished at: $(date)"
        exit 0
    else
        echo "Installation failed."
        # Cleanup even on failure
        rm -rf "$TMP_ZIP" "$EXTRACT_DIR"
        exit 1
    fi

else
    echo "Server $server_address is not reachable"
    exit 1
fi
      4. Set Run script as signed-in user to No.
      5. Configure the other settings as required and assign the script to the necessary groups of users.
    3. Deploy the basic Prisma Access Agent configuration profile.
      The basic configuration profile is a single mobileconfig file that combines all required macOS system permissions: system extensions, full disk access, transparent proxy VPN, content filter, and notifications.
      1. Prepare a .mobileconfig file for the basic Prisma Access Agent configuration profile with the following content:
        <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>AllowUserOverrides</key>
            <true/>
            <key>AllowedSystemExtensions</key>
            <dict>
                <key>PXPZ95SK77</key>
                <array>
                    <string>com.paloaltonetworks.pang.networkextension</string>
                    <string>com.paloaltonetworks.pang.securityextension</string>
                </array>
            </dict>
            <key>AllowedSystemExtensionTypes</key>
            <dict>
                <key>PXPZ95SK77</key>
                <array>
                    <string>NetworkExtension</string>
                    <string>EndpointSecurityExtension</string>
                </array>
            </dict>
            <key>PayloadDescription</key>
            <string></string>
            <key>PayloadDisplayName</key>
            <string>SYSTEM_EXTENSIONS</string>
            <key>PayloadEnabled</key>
            <true/>
            <key>PayloadIdentifier</key>
            <string>83D4B0C4-F161-4E40-96F4-D3508E383F5B</string>
            <key>PayloadOrganization</key>
            <string>Palo Alto Networks Inc.</string>
            <key>PayloadType</key>
            <string>com.apple.system-extension-policy</string>
            <key>PayloadUUID</key>
            <string>83D4B0C4-F161-4E40-96F4-D3508E383F5B</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>RemovableSystemExtensions</key>
            <dict>
                <key>PXPZ95SK77</key>
                <array>
                    <string>com.paloaltonetworks.pang.securityextension</string>
                    <string>com.paloaltonetworks.pang.networkextension</string>
                </array>
            </dict>
        </dict>
        <dict>
            <key>PayloadDescription</key>
            <string></string>
            <key>PayloadDisplayName</key>
            <string>PRIVACY_PREFERENCES_POLICY_CONTROL</string>
            <key>PayloadEnabled</key>
            <true/>
            <key>PayloadIdentifier</key>
            <string>23074892-DCA9-4EE8-A00D-AFC995CD6476</string>
            <key>PayloadOrganization</key>
            <string>Palo Alto Networks Inc.</string>
            <key>PayloadType</key>
            <string>com.apple.TCC.configuration-profile-policy</string>
            <key>PayloadUUID</key>
            <string>23074892-DCA9-4EE8-A00D-AFC995CD6476</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>Services</key>
            <dict>
                <key>SystemPolicyAllFiles</key>
                <array>
                    <dict>
                        <key>Allowed</key>
                        <true/>
                        <key>CodeRequirement</key>
                        <string>identifier "com.paloaltonetworks.pang.securityextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77</string>
                        <key>Identifier</key>
                        <string>com.paloaltonetworks.pang.securityextension</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                        <key>StaticCode</key>
                        <false/>
                    </dict>
                </array>
            </dict>
        </dict>
        <dict>
            <key>IPv4</key>
            <dict>
                <key>OverridePrimary</key>
                <integer>1</integer>
            </dict>
            <key>OnDemandUserOverrideDisabled</key>
            <false/>
            <key>PayloadDescription</key>
            <string>Configures VPN settings for Prisma Access Agent transparent proxy</string>
            <key>PayloadDisplayName</key>
            <string>VPN</string>
            <key>PayloadEnabled</key>
            <true/>
            <key>PayloadIdentifier</key>
            <string>EB042678-A45B-4308-8D87-C7E67C0FF576</string>
            <key>PayloadOrganization</key>
            <string>Palo Alto Networks Inc.</string>
            <key>PayloadType</key>
            <string>com.apple.vpn.managed</string>
            <key>PayloadUUID</key>
            <string>EB042678-A45B-4308-8D87-C7E67C0FF576</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>UserDefinedName</key>
            <string>PAA Transparent Proxy</string>
            <key>VPN</key>
            <dict>
                <key>AuthName</key>
                <string></string>
                <key>AuthenticationMethod</key>
                <string>Password</string>
                <key>IncludeAllNetworks</key>
                <false/>
                <key>OnDemandEnabled</key>
                <true/>
                <key>OnDemandRules</key>
                <array>
                    <dict>
                        <key>Action</key>
                        <string>Connect</string>
                    </dict>
                </array>
                <key>OnDemandUserOverrideDisabled</key>
                <false/>
                <key>ProviderBundleIdentifier</key>
                <string>com.paloaltonetworks.pang.networkextension</string>
                <key>ProviderDesignatedRequirement</key>
                <string>identifier "com.paloaltonetworks.pang.networkextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77</string>
                <key>ProviderType</key>
                <string>app-proxy</string>
                <key>RemoteAddress</key>
                <string>8.8.8.8</string>
            </dict>
            <key>VPNSubType</key>
            <string>com.paloaltonetworks.pang</string>
            <key>VPNType</key>
            <string>VPN</string>
        </dict>
        <dict>
            <key>FilterDataProviderBundleIdentifier</key>
            <string>com.paloaltonetworks.pang.networkextension</string>
            <key>FilterDataProviderDesignatedRequirement</key>
            <string>identifier "com.paloaltonetworks.pang.networkextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU]=PXPZ95SK77</string>
            <key>FilterSockets</key>
            <true/>
            <key>FilterType</key>
            <string>Plugin</string>
            <key>PayloadDisplayName</key>
            <string>Web Content Filter Payload</string>
            <key>PayloadIdentifier</key>
            <string>CF7C4457-DE52-454A-82F9-B571F0158948</string>
            <key>PayloadOrganization</key>
            <string>Palo Alto Networks Inc.</string>
            <key>PayloadType</key>
            <string>com.apple.webcontent-filter</string>
            <key>PayloadUUID</key>
            <string>CF7C4457-DE52-454A-82F9-B571F0158948</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PluginBundleID</key>
            <string>com.paloaltonetworks.pang</string>
            <key>UserDefinedName</key>
            <string>PAA content filter</string>
        </dict>
        <dict>
            <key>NotificationSettings</key>
            <array>
                <dict>
                    <key>BundleIdentifier</key>
                    <string>com.paloaltonetworks.PrismaAccessAgent</string>
                    <key>NotificationsEnabled</key>
                    <true/>
                </dict>
            </array>
            <key>PayloadDescription</key>
            <string>Enables notifications for Prisma Access Agent</string>
            <key>PayloadDisplayName</key>
            <string>Notifications Payload</string>
            <key>PayloadIdentifier</key>
            <string>51E05A4A-EA62-427C-9F34-936C2D259EF0</string>
            <key>PayloadOrganization</key>
            <string>Palo Alto Networks Inc.</string>
            <key>PayloadType</key>
            <string>com.apple.notificationsettings</string>
            <key>PayloadUUID</key>
            <string>51E05A4A-EA62-427C-9F34-936C2D259EF0</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string></string>
    <key>PayloadDisplayName</key>
    <string>PAA_basic_config</string>
    <key>PayloadEnabled</key>
    <true/>
    <key>PayloadIdentifier</key>
    <string>D79B89CE-6EFF-4781-90E8-5CFC5CD33B94</string>
    <key>PayloadOrganization</key>
    <string>Palo Alto Networks Inc.</string>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>D79B89CE-6EFF-4781-90E8-5CFC5CD33B94</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>
      2. In the Microsoft Intune admin center, go to DevicesmacOSConfiguration.
      3. Select CreateNew Policy.
      4. Set the Profile type to Templates, select Custom, and click Create.
      5. Enter a policy name (PAA_basic_config is recommended), upload the .mobileconfig file you created, and assign it to the appropriate groups.
    4. (Optional) If your organization uses Endpoint DLP, deploy the Endpoint DLP configuration profile to your target device groups and verify it has been applied on the endpoints before deploying the installation script. This step is not required if you are deploying the standard Prisma Access Agent package.
      Both the Prisma Access Agent configuration profile and the Endpoint DLP configuration profile contain system extension payloads that macOS requires MDM to pre-authorize before the installation script runs. Without pre-authorization, macOS prompts users to manually approve each extension.
    5. Verify the configuration profiles are correctly applied on enrolled endpoints.

    © 2026 Palo Alto Networks, Inc. All rights reserved.