Intune macOS devices Scripts

Question

Hello!
Is there any information on how Intune macOS devices Scripts are stored on end clients? Is script code encripted or not?
From what I know, if a script is configured to execute at a specific frequency, it continues running even if the client loses internet connectivity after the first run. This seems to indicate that the script code is saved on the client rather than being pulled from Intune before each execution. My concern is whether a user with full admin access on the client device could access the script's code. Could you clarify this?

Answer 1

Hi @Artem Shaturskyi

The Microsoft Intune Agent.app is responsible for deploying and managing scripts. It runs in the background to ensure policies are executed as defined in the Intune portal.

You can view logs for the Intune Agent using the Console app:

1. Open Console:
   • Press CMD+Space, type Console, and press Enter.
   1. Navigate to:
      • Log Reports > IntuneMDMDaemon*.
2. Use the search bar at the top to filter logs:

• Enter the PolicyID obtained from the Intune portal (steps below).
  • This filters log entries relevant to the script or policy.

Or view the logs directly from the file system without using:

• /Library/Logs/Microsoft/Intune - if Run script as signed-in user - YES
• ~/Library/Logs/Microsoft/Intune - if Run script as signed-in user - NO

Finding PolicyID in Intune

To locate the PolicyID for filtering logs:

1. Open the Microsoft Intune portal.
2. Go to Devices > Scripts.
3. Find the specific script or policy.

Note the PolicyID (unique identifier) for that script.

Use filter the logs to show only the lines relevant to the specified policy or script.

But I am not sure where they are stored during deployment.

Best regards,

Aleksandr