This document describes how to configure Microsoft Intune to distribute the SurePath AI proxy PAC URL and root CA certificate to macOS devices.
Supported platforms
macOS 13.0 and later
About this document
This document describes how to configure Microsoft Intune to distribute SurePath AI proxy settings to macOS devices using Custom configuration profiles. The configuration profiles provided by SurePath AI include both the proxy PAC URL and the trusted root CA certificate in a single deployment. This document does not cover how to enroll devices in Microsoft Intune or administer other aspects of the Microsoft Intune platform.
The SurePath AI PAC file
SurePath AI distributes its proxy information via a Proxy Auto-Config (PAC) file. This PAC file contains all the information needed to direct only generative AI traffic to the SurePath AI proxy service while sending other traffic via their normal route.
The use of a PAC file also allows SurePath AI to update the list of generative AI domains. Most operating systems and browsers will request the PAC file every 1-2 hours and if a new file can’t be retrieved the current one will continue to be used.
The SurePath AI root CA certificate
Just like other network security and SASE vendors, certificate trust allows SurePath AI to intercept and apply policy to connections to generative AI website. The SurePath AI root CA certificate needs to be trusted by all devices that need to be governed by SurePath AI.
All configuration in this section takes place within the Microsoft Endpoint Manager admin center located at https://endpoint.microsoft.com and unless otherwise stated, all instructions start from this URL.
Prerequisites
The SurePath AI configuration profiles for Intune are available from the Proxy Connector configuration page in the SurePath AI admin interface. These mobileconfig files contain both the proxy PAC URL and the trusted root CA certificate.
To download the configuration files:
Click Connectors in the CONFIGURE section
Select an existing Proxy connector or click ADD CONNECTOR to create a new one
If creating a new connector, provide a descriptive name (for example, "macOS - Intune") and select Proxy as the connector type, then click SAVE
From the connector details page, download the MDM files for your environment using the DOWNLOAD button in the MDM Files section
The downloaded ZIP file contains multiple deployment files for different platforms. For Intune macOS deployments, admins will use one of the following files:
surepath.ai.macos.intune.email.mobileconfig- Email-based user identificationsurepath.ai.macos.intune.udid.mobileconfig- UDID-based user identification
Choosing a configuration profile
SurePath AI provides two configuration profile variants for Intune macOS deployments. Organizations should choose between the email and UDID variants based on their security requirements and user experience preferences.
The email-based profile (surepath.ai.macos.intune.email.mobileconfig) never prompts for user authentication, providing a completely transparent user experience with no authentication page redirects. For email-based identification to work, the device must have a user assigned with an email address in Intune. This method is appropriate for organizations that prioritize seamless user experience.
The UDID-based profile (surepath.ai.macos.intune.udid.mobileconfig) requires user authentication before attributing traffic to a user. This method is appropriate for security-conscious organizations that prefer explicit authentication steps before user identification occurs.
Intune policy for macOS configuration
The configuration profiles provided by SurePath AI contain both the proxy PAC URL and the trusted root CA certificate, allowing admins to deploy both settings in a single policy.
Navigate to Devices > Configuration
Select Create > New Policy
For Platform select macOS
For Profile type select Templates
From the Template name menu select Custom and click Create
On the Basics tab, enter a Name (and optional Description) and click Next
On the Configuration settings tab:
Enter a Custom configuration profile name
For Deployment channel, select Device channel
For Configuration profile file, click the folder icon and browse to select either:
surepath.ai.macos.intune.email.mobileconfigfor email-based identificationsurepath.ai.macos.intune.udid.mobileconfigfor UDID-based identification
Click Next
On the Assignments tab, add the devices and/or groups of devices to which you want to apply the policy and click Next
This is a device-based policy, so assignments should be made to devices or device groups, not user groups
On the Review + create tab, confirm the configuration is correct and click Create
Verifying the SurePath AI integration
After completing the deployment, verify that the endpoint is properly integrated using the SurePath AI Ready tool.