IntuneBrew is a PowerShell-based tool that simplifies the process of uploading and managing macOS applications in Microsoft Intune. It automates the entire workflowβfrom downloading apps to uploading them to Intune with proper metadata and icons.
This project uses publicly available metadata from Homebrewβs JSON API. Homebrew is a registered trademark of its respective owners and is not affiliated with or endorsing this project.
- Watch the full walkthrough of the tool:
- Table of Contents
- οΏ½ Latest Updates
- β¨ Features
- π Getting Started
- π Usage
- π§ Configuration
- π Version Management
- π οΈ Error Handling
- π€ Troubleshooting
- π€ Contributing
- π License
- π Acknowledgments
- π Support
Last checked: 2025-05-22 00:30 UTC
Application | Previous Version | New Version |
---|---|---|
ProcessSpy | 1.7.0 | 1.7.1 |
NVIDIA GeForce NOW | 2.0.73.149 | 2.0.74.160 |
DockDoor | 1.10 | 1.11 |
Yaak | 2025.2.0 | 2025.2.2 |
6.9.72 | 6.9.73 | |
iMazing | 3.2.0 | 3.2.1 |
Raycast | 1.98.5 | 1.99.0 |
Zed | 0.186.12 | 0.187.4 |
Amazon Chime | 5.23.22318 | 5.23.22356 |
Malwarebytes for Mac | 5.14.1.3074 | 5.14.2.3077 |
- π Automated app uploads to Microsoft Intune
- π¦ Supports both .dmg and .pkg files
- π Automatic version checking and updates
- πΌοΈ Automatic app icon integration
- π Progress tracking for large file uploads
- π Secure authentication with Microsoft Graph API
- π― Smart duplicate detection
- π« Bulk upload support
- π Automatic retry mechanism for failed uploads
- π Secure file encryption for uploads
- π Real-time progress monitoring
- PowerShell 7.0 or higher
- Administrator rights (script must be installed as administrator, specially if you use "Install-Script IntuneBrew -Force")
- Microsoft.Graph.Authentication Module must be installed
- Azure App Registration with appropriate permissions OR Manual Connection via Interactive Sign-In
- Windows or macOS operating system
Download the script: IntuneBrew.ps1
Run the script:
.\IntuneBrew.ps1
Follow the interactive prompts to:
- Select which apps to upload
- Authenticate with Microsoft Graph
- Monitor the upload progress
- View the results in Intune
Note
Missing an app? Feel free to request additional app support by creating an issue!
First decide which authentication method you would like to use. There are currently the following methods implemented:
- System Managed Identity
- User Managed Identity
- ClientSecret & ClientID using App Registration
- Certificate based authentication
- Open your Automation Account and select Account Settings -> Identity.
- Turn Status on tab "System assigned" to "On".
- Add the following API permissions to your System Managed Identity using this PowerShell script: Microsoft Tech Community
- DeviceManagementApps.ReadWrite.All
- Open Entra admin center -> Applications -> Enterprise Applications. Change Filter "Application type" to "Managed Identities" and search for your Automation Account name. Open the entity.
- Verify that the right permissions are set to the Managed Identity in the Security -> Permissions tab.
- Create a new Variable in your Automation Account with the name "AuthenticationMethod" and value "SystemManagedIdentity" to use the System Managed Identity.
- Open Azure Portal and search for "Managed Identities".
- Click "Create" and select your Azure Subscription & Resource group. Choose your region and set a name for the identity.
- Open your Automation Account and select Account Settings -> Identity.
- Switch to tab "User assigned" and click "Add". Choose the previously created Managed Identity.
- Add the following API permissions to your System Managed Identity using this PowerShell script: Microsoft Tech Community
- DeviceManagementApps.ReadWrite.All
- Open Entra admin center -> Applications -> Enterprise Applications. Change Filter "Application type" to "Managed Identities" and search for your Automation Account name. Open the entity.
- Verify that the right permissions are set to the Managed Identity in the Security -> Permissions tab.
- Create a new Variable in your Automation Account with the name "AuthenticationMethod" and value "UserAssignedManagedIdentity" to use the User Assigned Managed Identity.
- Create a new App Registration in Azure
- Add the following API permissions:
- DeviceManagementApps.ReadWrite.All
- Update the parameters in the script with your Azure details.
- $appid = '' # App ID of the App Registration
- $tenantid = '' # Tenant ID of your EntraID
- $certThumbprint = '' # Thumbprint of the certificate associated with the App Registration
- Generate a self-signed certificate:
$cert = New-SelfSignedCertificate -Subject "CN=IntuneBrew" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256 -NotAfter (Get-Date).AddYears(2)
- Export the certificate:
$pwd = ConvertTo-SecureString -String "YourPassword" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath "IntuneBrew.pfx" -Password $pwd
- Upload to Azure App Registration:
- Go to your App Registration in Azure Portal
- Navigate to "Certificates & secrets"
- Upload the public key portion of your certificate
Using the -CopyAssignments
switch with IntuneBrew.ps1
or creating a CopyAssignments
Variable with Boolean Value true
in your Azure Automation indicates that assignments from the existing app version should be copied to the new version.
Apps are defined in JSON files with the following structure:
{
"name": "Application Name",
"description": "Application Description",
"version": "1.0.0",
"url": "https://download.url/app.dmg",
"bundleId": "com.example.app",
"homepage": "https://app.homepage.com",
"fileName": "app.dmg"
}
IntuneBrew implements sophisticated version comparison logic:
- Handles various version formats (semantic versioning, build numbers)
- Supports complex version strings (e.g., "1.2.3,45678")
- Manages version-specific updates and rollbacks
- Provides clear version difference visualization
Version comparison rules:
- Main version numbers are compared first (1.2.3 vs 1.2.4)
- Build numbers are compared if main versions match
- Special handling for complex version strings with build identifiers
IntuneBrew includes robust error handling mechanisms:
-
Upload Retry Logic
- Automatic retry for failed uploads (up to 3 attempts)
- Exponential backoff between retries
- New SAS token generation for expired URLs
-
File Processing
- Temporary file cleanup
- Handle locked files
- Memory management for large files
-
Network Issues
- Connection timeout handling
- Bandwidth throttling
- Resume interrupted uploads
-
Authentication
- Token refresh handling
- Certificate expiration checks
- Fallback to interactive login
-
File Access Errors
- Ensure no other process is using the file
- Try deleting temporary files manually
- Restart the script
-
Upload Failures
- Check your internet connection
- Verify Azure AD permissions
- Ensure file sizes don't exceed Intune limits
-
Authentication Issues
- Verify your Azure AD credentials
- Check tenant ID configuration
- Ensure required permissions are granted
-
PowerShell 7 Command Not Found
If you're getting "IntuneBrew is not recognized as a name of a cmdlet, function, script file, or executable program" in PowerShell 7:
Step 1: Check your PATH environment variable
"Current PATH:" $env:PATH -split ';'
Step 2: Verify IntuneBrew installation location
$intuneBrewInfo = Get-InstalledScript -Name IntuneBrew -ErrorAction SilentlyContinue if ($intuneBrewInfo) { "Installed Location for IntuneBrew:" $intuneBrewInfo | Select-Object Name, Version, InstalledLocation } else { Write-Warning "IntuneBrew is not installed. Run: Install-Script IntuneBrew -Force" return }
Step 3: Add IntuneBrew to your PATH if needed
$scriptPath = $intuneBrewInfo.InstalledLocation if (-not ($env:PATH -split ';' | Where-Object { $_ -eq $scriptPath })) { Write-Host "`nπ Adding IntuneBrew script folder to PATH..." -ForegroundColor Yellow [Environment]::SetEnvironmentVariable("PATH", "$env:PATH;$scriptPath", [EnvironmentVariableTarget]::User) Write-Host "β Done. Restart PowerShell to use 'IntuneBrew' as a command." -ForegroundColor Green } else { Write-Host "β Script path is already in PATH." -ForegroundColor Green }
Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.
- Fork the Project
- Create your Feature Branch (
git checkout -b feature/AmazingFeature
) - Commit your Changes (
git commit -m 'Add some AmazingFeature'
) - Push to the Branch (
git push origin feature/AmazingFeature
) - Open a Pull Request
This project is licensed under the MIT License - see the LICENSE file for details.
- Thanks to all contributors who have helped shape IntuneBrew
- Microsoft Graph API documentation and community
- The PowerShell community for their invaluable resources
If you encounter any issues or have questions:
- Check the Issues page
- Review the troubleshooting guide
- Open a new issue if needed
Made with β€οΈ by Ugur Koc