# Intune macOS Runbook

> Step-by-step Intune deployment runbook for onboarding managed macOS endpoints to thoth governance.

Source: https://docs.atensecurity.com/docs/deployments/intune-macos

Use this runbook to deploy governed Claude Desktop configuration to managed employee Macs through Intune.

## 1. Before you begin

Confirm:

- thoth onboarding values are available (`tenant_id`, `apex_domain`)
- Claude Desktop is already deployed on target Macs
- baseline dependencies (`thoth`, `thothctl`, `node`, `npx`) are available on targets
- package source is approved from [Release Channels + Verification](https://docs.atensecurity.com/docs/deployments/release-channels)

## 2. Deploy the thoth config file

Deploy this file before the setup script:

`/Library/Application Support/Thoth/thoth-config.json`

Recommended delivery methods:

- Intune macOS shell script assignment
- macOS profile delivering equivalent content

The setup script should treat this config file as source-of-truth, with optional environment fallback only for testing.

## 3. Upload macOS setup script

Upload your setup script (for example `deploy/intune/macos/setup-claude-mcp.sh`) in:

- **Intune Admin Center → Devices → macOS → Shell scripts**

Recommended settings:

- Run script as signed-in user: **No**
- Hide script notifications: **Yes**
- Number of times to retry if script fails: **3**

## 4. Assignment order

Use this order for reliable onboarding:

1. Baseline dependencies assignment
2. `thoth-config.json` assignment
3. Setup script assignment

Scope each stage to test, then pilot, then full production groups.

## 5. Validate on a test Mac

Run:

```bash
thoth health --json
thoth status
```

Then verify:

- config exists at `/Library/Application Support/Thoth/thoth-config.json`
- Claude config exists at `~/Library/Application Support/Claude/claude_desktop_config.json`
- setup log shows successful wrap and restart flow (`/var/log/thoth-setup.log`)

## 6. Ongoing operations

- Keep setup script assignment recurring and idempotent.
- Rotate onboarding values by updating the config assignment, then re-running setup assignment.
- Use [Incident Response](https://docs.atensecurity.com/docs/operations/incidents) and [Rollback](https://docs.atensecurity.com/docs/operations/rollback) runbooks for production issues.

## Troubleshooting

| Symptom | Likely cause | What to check |
|---|---|---|
| `thoth` not found | Baseline dependency assignment missing | Confirm dependency assignment completed before setup assignment |
| `registration_ok=false` | Wrong `tenant_id`/`apex_domain` or network controls | Validate deployed config values and outbound connectivity |
| MCP servers not governed | Managed Claude config was not written | Check setup log and resulting `claude_desktop_config.json` |
| Script exits non-zero repeatedly | Config missing or script context mismatch | Confirm config path and script runs as root/system context |
| Claude does not pick up new config | App restart not applied | Check restart lines in setup log, then relaunch Claude manually on test endpoint |