Screenproof Admin KB

Deploy Screenproof with Microsoft Intune

The PKG goes out as a line-of-business app; the managed preferences go out as a Custom template profile. Deploy the profile first, then the PKG — the app is governed from its first launch.

1. Deploy the PKG

  1. Apps → macOS → Add → app type Line-of-business app → upload Screenproof-<version>.pkg (download the current build from https://updates.screenproof.app/Screenproof-latest.pkg).
  2. Set minimum OS: macOS 14. Assignment: Required, targeted at the device group.
  3. Intune's PKG installer runs installer -pkg ... -target /; no special handling needed — the PKG is a single flat component package.

The PKG installs /Applications/Screenproof.app and /Library/LaunchAgents/app.screenproof.agent.plist (per-user agent, RunAtLoad — starts at each user's next login, not at boot). The installer is signed Developer ID Installer, team S65X5KY399, and notarized.

2. Deploy the managed-preferences profile

  1. Build your profile: start from examples/managed-preferences.mobileconfig or the Profile Creator.
  2. Devices → Configuration profiles → Create → macOS → Templates → Custom → upload the .mobileconfig.
  3. Assign to the same group.

Deploy the optional restrictions profile the same way. For the PPPC denylist, use Intune's Privacy Preferences Policy Control template — or a Custom payload upload if the built-in UI doesn't expose Deny.

3. Verify on a target Mac

Confirm the profile landed:

sudo /usr/libexec/mdmclient QueryInstalledProfiles   # profile present
defaults read /Library/Managed\ Preferences/app.screenproof

Then confirm Screenproof sees it:

  1. Open Screenproof → Settings → Managed: the managed banner appears with your org's enforced values.
  2. In the Privacy / Export / License tabs, rows forced by the profile show lock icons and read "Managed by your organization".
  3. Open Policy Diagnostics: each forced key lists a MANAGED source.
Policy changes Screenproof reads managed keys at policy-resolution time — no daemon restart required in principle. Confirm in your trial deploy: change one key, re-push the profile, and check Policy Diagnostics picks up the new value without a relaunch.

Next steps