Previously, we discussed how to use Microsoft Intune to install Veeam Agent for Mac. Now we will continue this series with how to configure Veeam Agent for Mac via Microsoft Intune.
The way that macOS centrally manages and configures various aspects of the operating system and applications is through “Configuration Profiles”. A Configuration Profile is an XML document (.mobileconfig) that contains settings to let you standardize various functions in macOS. For example, the administrator can set up a profile(s) to:
- Determine when to check and install updates
- Which Wi-Fi network to use
- Firewall settings
- Configure applications… including Veeam Agent for Mac
- And much, much more
You may be wondering, “Why do I need to go through the configuration process?” Quite simply, in order for Veeam Agent for Mac to know about the Veeam backup server, authenticate and make a connection, you must import configuration data that was generated/exported when creating the “Computers with pre-installed agents” protection group.
Much like the installation, Veeam offers two method to configure Veeam Agent for Mac:
- Manually
- A user will leverage the user interface “Import” function or “veeamconfig” command line utility
Typically used when configuring a small number of macOS systems that require protection
- Automated
- Configuration Profile deployment via Mobile Device Management (MDM)
Typically used when configuring a large number of macOS systems that require protection
One MDM solution that is growing in popularity is Microsoft Intune. This is a cloud-based service that provides MDM capabilities for laptops, phones, tablets and computers… including Macs! And if you were wondering how to leverage Microsoft Intune to automate the configuration of Veeam Agent for Mac, you have come to the right place!
This blog will be broken down into the following sections:
- Pre-requisites for a successful configuration
- The purpose of the XML and mobileconfig files
- Creation of the Configuration Profile template – Full Disk Access
- Creation of the Configuration Profile template – Veeam configuration
- Creation of the Configuration Profile in Microsoft Intune
- Verify that the Profile is deployed and functioning
Pre-requisites for a successful configuration:
To ensure that Veeam Agent for Mac can be deployed via Microsoft Intune, the following are prerequisites:
- Mac computer(s) are
enrolled in Intune
- Company Portal application is installed on each applicable Mac
- User signed-in to Company Portal Application on Mac
- Veeam Agent for Mac has been installed but not configured
The purpose of the XML and mobileconfig files:
Let’s dig into the various files that Veeam Agent for Mac and Microsoft Intune utilizes for configuration.
Veeam XML Configuration Files
There are two XML files generated as part of the “Computers with pre-installed agents” protection group creation process:
- <Name of Protection Group>.xml
- <Name of Protection Group>_escaped.xml
Both XML files contain the same information, only formatted differently. Each XML file contains information related (but not limited) to:
- Veeam backup server version, name and IP address
- Port to connect to the Veeam backup server on
- Certificate information
Why are there two XML files containing the same data but in different formats? Depending on the MDM solution, some support non-escaped and other support escaped formats. For example:
- Microsoft Intune and simpleMDM support escaped versions of the XML file
- JAMF supports non-escaped versions of the XML file
For the purposes of this blog, we will be using the file with “escaped” in the name as this is what Microsoft Intune requires.
mobileconfig (Configuration Profile)
A mobileconfig file (also XML) is used to configure devices and application running macOS.
This is also known as the “Configuration Profile”.
Creating the Configuration Profile templates – Full Disk Access
After installation, Veeam Agent for Mac requires permission to access all folders and files on the system. This is accomplished through the “Security and Privacy” setting “Full Disk Access” (FDA):
Users can manually configure this setting via “System Preferences” or use Microsoft Intune / Configuration Profile to grant this permission.
To create a Configuration Profile for FDA, simply copy the XML below and save it to a file with the extension “mobileconfig” — for example: “Veeam Agent for Mac Configuration Profile for FDA.mobileconfig”.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadIdentifier</key>
<string>com.veeam.Agent.fda-permissions</string>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>31294b70-d005-11ea-87d0-0242ac130003</string>
<key>PayloadOrganization</key>
<string>Veeam backup server</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadDisplayName</key>
<string>Full Disk Access for Veeam Agent for Mac</string>
<key>PayloadDescription</key>
<string>This profile allows Veeam Agent for Mac to obtain Full Disk Access</string>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadUUID</key>
<string>28afcd34-d005-11ea-87d0-0242ac130003</string>
<key>PayloadIdentifier</key>
<string>com.veeam.Agent.fda-permissions.28afcd34-d005-11ea-87d0-0242ac130003</string>
<key>PayloadEnabled</key>
<true />
<key>Services</key>
<dict>
<key>SystemPolicyAllFiles</key>
<array>
<dict>
<key>Allowed</key>
<true/>
<key>CodeRequirement</key>
<string>identifier "com.veeam.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = NX3JU8SRVL</string>
<key>Identifier</key>
<string>com.veeam.Agent</string>
<key>IdentifierType</key>
<string>bundleID</string>
</dict>
</array>
</dict>
</dict>
</array>
</dict>
</plist>Please note that FDA is only required for macOS version 10.14.x (Mojave) and above. If you are running 10.13.x (High Sierra), FDA is automatically enabled as part of the installation.
Creating the Configuration Profile templates – Veeam Configuration
You will also need to create a Configuration Profile / mobileconfig using the sample XML below or update an existing mobileconfig to include the Veeam Agent for Mac information.
Sample XML for mobileconfig file:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadIdentifier</key>
<string>dummy PayloadID</string>
<key>PayloadRemovalDisallowed</key>
<false />
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>dummy PayloadUUID</key>
<string>00000000-0000-0000-0000-000000000000</string>
<key>PayloadOrganization</key>
<string>dummy PayloadOrg</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadDisplayName</key>
<string>dummy PayloadDisplayName</string>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadType</key>
<string>com.apple.ManagedClient.preferences</string>
<key>PayloadUUID</key>
<string>00000000-0000-0000-0000-000000000000</string>
<key>PayloadIdentifier</key>
<string>dummy PayloadID inside PayloadContent</string>
<key>PayloadEnabled</key>
<true />
<key>Identifier</key>
<string>com.veeam.Agent</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>PayloadContent</key>
<dict>
<key>com.veeam.Agent</key>
<dict>
<key>Forced</key>
<array>
<dict>
<key>mcx_preference_settings</key>
<dict>
<key>CatchAllConfig</key>
<string>PASTE XML FROM THE CONFIG FILE HERE</string>
</dict>
</dict>
</array>
</dict>
</dict>
</dict>
</array>
</dict>
</plist>
After the mobileconfig file is saved (ie: Veeam Agent for Mac Configuration Profile.mobileconfig), we need to copy the contents from the exported “escaped” configuration file:
After the file is open, select all contents:
And copy the contents of the file to your clipboard:
Once copied, paste the entire contents of the file into the previously highlighted section of the mobileconfig. For example:
Creating the Configuration Profile in Microsoft Intune
To recap, we have created two mobileconfig files:
- Veeam Agent for Mac Configuration Profile for FDA.mobileconfig
- Veeam Agent for Mac Configuration Profile.mobileconfig
In the examples below, screen shots are provided referencing the “Veeam Agent for Mac Configuration Profile.mobileconfig”. However, the same steps / a separate profile will need to be created for the “Veeam Agent for Mac Configuration Profile for FDA.mobileconfig” configuration profile.
In order for the Configuration Profiles to be deployed, we need to make our way over to Microsoft’s Endpoint Manager and access the “Devices” blade:
Once you are in the “Devices” blade, select “Configuration Profiles” and then “Create Profile”:
When the “Create a profile” dialog is presented, select the following options:
Platform: macOS
Profile type: Templates
Template name: Custom
Then you will provide a name and description of the “Custom Profile”
Then you will provide a name and description of the “Configuration Profile”
Next you will configure the assignments (based on groups / users / devices) the Configuration Profile will include and exclude:
You are now ready to review and create the Configuration Profile:
Verify that the Configuration Profile is deployed
Once the Configuration Profiles are created and assigned in Microsoft Intune, they will be added to the device profiles of the applicable users / groups / devices under “System Preferences” in macOS:
If you review the “Custom Settings” for Veeam Agent for Mac “Configuration Profile”, you will see the Veeam backup server connection information.
Conclusion
As more organizations embrace the Apple platform, you are seeing business critical data reside on macOS systems. This can be through IT departments providing Mac based computers and laptops as well as organizations embracing the Bring Your Own Device (BYOD) model. This is why it is important to protect that data with Veeam Agent for Mac.
As the number of macOS devices in your organization increases, leveraging a Mobile Application Management and Mobile Device Management solution like Microsoft Intune to install and configure Veeam Agent for Mac will ensure your it scales quickly and easily.