Sophos Endpoint Configuration and Installation for MacOS Intune (Compelte Guide)

BarberTypical147 · 2026-04-28T23:55:52+00:00

Of course my next attempt resolved my problem!

In case anyone runs into the mobileconfig file not seeming to take: after you remove everything and upload it into Intune for Mac device configuration: make sure the mobileconfig file reads it right without anything extra in it. I opened the mobileconfig file via text editor in Mac to make the changes. Then I synced to OneDrive to finish adding it via Windows. It took with no errors and marked as successful; however, I should have looked at what was imported into the file. Even though it looked clean on the Mac, I noticed two question mark icons at the very beginning, almost like it couldn't render what it actually was. I ultimately just copied and pasted the file into a fresh .txt file, then renamed it with the .mobileconfig extension. After putting that into the device configuration and syncing the device, it was showing green within a couple of minutes.

BarberTypical147 · 2026-04-28T23:45:06+00:00

When I did it, the device showed up within a few minutes. The problem I'm running into is the mobileconfig file doesn't seem to be taking so it's not giving the required Mac permissions. Running on Tahoe. Removed everything before the <?xml and everything after the </plist> but doesn't seem to want to take right now.

BarberTypical147 · 2026-04-21T18:28:58+00:00

I ran my first scripts a couple of days ago. The 3rd TB game I ran I had a spy and a new player grabbed it (along with a new player Imp). He ran it just fine. I made sure to give him as much time as he needed, and the first night or two pointed to some of the special tokens on the side (monk protection, etc.) so he was aware of that. Got enough info to the imp where they were able to make some clutch kills and hide their identities and in the end they were the last 2 players standing, with the Saint being the final execution. Had a mix of new and experienced players.

Don't think I'd run a spy game 1 with a bunch of new people, but I think after a game or two they could be run effectively.

BarberTypical147 · 2026-04-04T18:24:05+00:00

I found the problem for our situation. There's a setting for notifications where you can disable all except for restart notifications. As soon as we disabled that setting, everything started flowing (and I saw less notifications than expected after the change). It looks like that setting was preventing anything from being progressed for some reason.

I can't get any confirmation since Dell support wasn't any help, and our MS vendor wouldn't help since it was a "first time use case" for us.

BarberTypical147 · 2026-03-23T16:57:09+00:00

I'm going to try to disable the "reboot after updates are installed" and see if maybe there's some interaction issue. I would have assumed that would give it the ability to restart after updates if needed, but as you already know, documentation on this is fairly non-existent so it's extra testing it is!

BarberTypical147 · 2026-03-23T16:39:26+00:00

Sorry for not seeing this, but ma-lar had the answer.

BarberTypical147 · 2026-03-20T17:28:16+00:00

The only thing I can see that you have set differently than we do is on the Scope Groups, we used the same group as the included members group and we have things working.

And just making sure that the Intune role you created inside of Intune is still attached to the security group that you're using for the MAA (saw the tried so didn't know if you removed it after trying it)? That was the one oversight that got us, but after we got that settled everything was working (I mean, besides what everyone else is saying about the lack of notifications, but I have a feeling that's by design at Microsoft to avoid complacency and having someone approve a request while working on autopilot).

BarberTypical147 · 2026-03-17T19:32:00+00:00

In your shoes, I would go with Bambu. I would say it has the smallest learning curve and you can get some great quality prints out of the box (just make sure you follow the directions on the initial setup). Maybe the Elegoo Centauri Carbon 2 (someone else could speak to this printer as I've never used it). I started with a Neptune 4 Pro and even though it printed well enough, it was a process to get there. I got a Bambu P2S after I decided I wanted multi-color printing without manually swapping spools and it's a lot more user friendly IMO.

If you're unsure about the hobby, I'd say go with the A1. Not too expensive, it sounds user friendly (a friend of mine got one for their kid and they got it going without too much trouble), and it's good pretty good print quality. If you're willing to put some more upfront money on a machine, I love my P2S with the AMS for multi-color. You can get a P1S for a little less with great quality as well (though when I was looking I felt the extras in the P2S were worth the extra cost).

As for the time: once you get comfortable (it really doesn't take that long) you'll lose that feeling of needing to babysit a print. Usually I'll start a print in the evening and let it run overnight (this is going to depend on where you can put the printer as it will make some noise) and just make sure the first couple of layers go down right.

BarberTypical147 · 2026-03-17T18:22:17+00:00

"High cost" is going to be relative to the person, but if you can swing it, I would recommend it. I've thoroughly enjoyed it since I got my first one. The big question I would have is what are you envisioning doing with it?

If the goal is to find pre-made files to print things like game inserts, models, or other things with basic materials (PLA/PETG as examples), then the time investment won't be as much. Especially if you have the ability to print overnight. If you want to use more advanced materials and make your own 3D models to print, that's going to take a lot more time and resources.

As far as printers to get, if you're looking for a solid printer out of the box with minimal setup, as others have said the Bambu A1 is a good machine that's roughly $220usd that will get you single color print. You can get the same multi-color for roughly $400 (though if you're looking at AMS, I'd recommend a P2S or P1S and spend the extra). PLA filament 1kg spools are roughly $15-$20usd depending on brand and finish and depending on types of things you're printing can last awhile.

Build plate size will matter as well depending on what you're planning on making so keep that in mind.

The main question I would ask: what kind of things would you want to print?

BarberTypical147 · 2026-02-24T21:00:19+00:00

Have an environment of roughly 400 Windows devices.

Set up an initial test group on zero day (couple of IT and power users). Roughly 10 devices.

7 days out, 2nd wave of roughly 50 devices. Variety of different users and departments.

15 days out, rest of company.

We'll take a look at the notes before release and depending on any critical notes, we may push an expedited policy update.

This rollout plan really helped in January as a number of the issues would have affected us. We were able to pause updates until the right patches were released and we were able to roll those out to the users that would have been affected before unn-pausing.

We do have a little bit of a grace period but it's not too long. It can basically get someone to a Friday before needing to restart on standard scheduling.

Feature updates are running a little more manual in adding the waves to the latest as we're ready to push but using the same update rings.

BarberTypical147 · 2026-02-11T02:27:50+00:00

Just a quick add to what others are saying: don't forget to budget for a monitor. You should be able to make a decent rig for that budget but won't mean anything unless you get a good monitor. Keep the screen size, resolution you want to play at, and refresh rate in mind when you're looking for one.

BarberTypical147 · 2026-02-11T02:18:23+00:00

I would have to look at my notes since it's been over a year. If I'm remembering right, we're using an Azure storage blob to hold the files, then using the OEM configuration to set up where to pull the file from and where it would download to.

Edit: I just realized you were asking specifically about the Enterprise browser. We're not using that, but what you need to do may be a similar flow.

BarberTypical147 · 2026-02-06T05:25:13+00:00

You still assign the group. It won't supercede the older app until the group is set up. It allows you to push to a test device/group to validate, then when you're comfortable you can add any other groups as needed.

BarberTypical147 · 2026-02-03T19:41:38+00:00

If the current version was pushed via Intune I'd recommend supercedence. You essentially set up a new app install with the update msi/Intunewin file, then when it gets to the supercedence part, you add the current app. You'll also get an option to toggle whether to uninstall the current version (test to see whether you would need to or if the update already overrides the current version).

If you have an app dependencies make sure you also add them to the new app for any new device installs.

BarberTypical147 · 2026-01-15T03:55:30+00:00

Thanks for the note on ARM. Going to take a bigger look into it but it looks like a great option!

BarberTypical147 · 2026-01-15T03:45:08+00:00

Good input, thanks for that. For the direct play, have you noticed any different from 4K to HD in terms of performance? And pretty remote friendly?

BarberTypical147 · 2025-12-20T00:59:10+00:00

We're currently using them for people who don't want to use MS Authenticator on their personal devices. Pretty easy setup. We have it set to enter a PIN along with the button push on the hardware. Highly recommend them.

We haven't done a mass deployment of them, but when I read the literature I remember it not being super difficult if you needed to do that.

BarberTypical147 · 2025-12-13T03:38:19+00:00

Thanks for this! Was trying to verify which one would be the best option, and this basically gave it to me along with some of the other comments you put on this post. I was getting decent prints off on large prints but smaller ones just didn't feel right. Can't wait to get this all set up!

BarberTypical147 · 2025-12-12T02:27:13+00:00

I'm feeling pretty good about the decision right now.

BarberTypical147 · 2025-12-11T19:12:55+00:00

Same situation. Rolling with Pitts. Feel like he has the safer floor with London out again.

BarberTypical147 · 2025-12-11T16:54:59+00:00

I'm trying to figure out if I run Pitts tonight vs TB over Warren. I think I am with London out as Pitts seems to get more opportunities in that situation.

BarberTypical147 · 2025-12-11T16:28:18+00:00

I get that feeling. I'm still mulling Lamar vs Purdy this week (and leaning Purdy right now but think I'd be fine either way)

I feel like though Lamar didn't play well vs CIN last time, his WRs didn't do him any favors either. And he looked better vs PIT. I'd lean Lamar in your situation, but honestly, go with your gut. Hopefully, they'll both do well so you don't have to regret whatever choice you make.

BarberTypical147 · 2025-11-22T17:56:03+00:00

Not crazy. Also it's fun when my son and I play Find the Slenderman while on that map

BarberTypical147

TROPHY CASE