Intune macOS Runbook
Step-by-step Intune deployment runbook for onboarding managed macOS endpoints to thoth governance.
Use this runbook to deploy governed Claude Desktop configuration to managed employee Macs through Intune.
1. Before you begin
Confirm:
- thoth onboarding values are available (
tenant_id,apex_domain) - Claude Desktop is already deployed on target Macs
- baseline dependencies (
thoth,node,npx) are available on targets
2. Deploy the thoth config file
Deploy this file before the setup script:
/Library/Application Support/Thoth/thoth-config.json
Recommended delivery methods:
- Intune macOS shell script assignment
- macOS profile delivering equivalent content
The setup script should treat this config file as source-of-truth, with optional environment fallback only for testing.
3. Upload macOS setup script
Upload your setup script (for example deploy/intune/macos/setup-claude-mcp.sh) in:
- Intune Admin Center → Devices → macOS → Shell scripts
Recommended settings:
- Run script as signed-in user: No
- Hide script notifications: Yes
- Number of times to retry if script fails: 3
4. Assignment order
Use this order for reliable onboarding:
- Baseline dependencies assignment
thoth-config.jsonassignment- Setup script assignment
Scope each stage to test, then pilot, then full production groups.
5. Validate on a test Mac
Run:
Then verify:
- config exists at
/Library/Application Support/Thoth/thoth-config.json - Claude config exists at
~/Library/Application Support/Claude/claude_desktop_config.json - setup log shows successful wrap and restart flow (
/var/log/thoth-setup.log)
6. Ongoing operations
- Keep setup script assignment recurring and idempotent.
- Rotate onboarding values by updating the config assignment, then re-running setup assignment.
- Use Incident Response and Rollback runbooks for production issues.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
thoth not found | Baseline dependency assignment missing | Confirm dependency assignment completed before setup assignment |
registration_ok=false | Wrong tenant_id/apex_domain or network controls | Validate deployed config values and outbound connectivity |
| MCP servers not governed | Managed Claude config was not written | Check setup log and resulting claude_desktop_config.json |
| Script exits non-zero repeatedly | Config missing or script context mismatch | Confirm config path and script runs as root/system context |
| Claude does not pick up new config | App restart not applied | Check restart lines in setup log, then relaunch Claude manually on test endpoint |