> For the complete documentation index, see [llms.txt](https://boza.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://boza.gitbook.io/docs/browser-extension/deployment/safari-intune.md).

# Safari via Intune

This guide covers deploying the Boza **Safari** extension to macOS devices managed by **Microsoft Intune**. Safari extensions are distributed differently from Chrome and Edge — the extension is bundled inside a macOS app, so deployment has two parts: install the app, then push a configuration profile.

{% hint style="info" %}
**Using Jamf instead of Intune?** The [Jamf guide](/docs/browser-extension/deployment/jamf.md) is the simplest path for Apple devices and configures full per-user auto-login automatically. Jamf is the recommended MDM for Safari — see [Auto-login and the `$EMAIL` variable](#auto-login-and-the-email-variable) for why.
{% endhint %}

## How Safari Deployment Works

Unlike Chrome and Edge — which download the extension from a web store via policy — Safari extensions ship **inside a macOS app**. Deploying Boza on Safari therefore involves three things:

1. **Install the Boza app** (`Boza - Extension`, bundle ID `com.boza.safari`) from the Mac App Store. The Safari extension is bundled inside it.
2. **Push a configuration profile** that supplies each user's `userEmail` and `secretKey` to the extension (for auto-login).
3. **The user enables the extension once** in Safari settings.

| Aspect                 | Chrome / Edge               | Safari                                                |
| ---------------------- | --------------------------- | ----------------------------------------------------- |
| Extension distribution | Web store (policy download) | Bundled inside a macOS app                            |
| Installation method    | Registry / managed policy   | App install (App Store / VPP) + configuration profile |
| User identification    | Managed storage             | Managed preferences (`com.boza.safari.Extension`)     |
| First-run step         | None                        | User enables the extension once in Safari             |

## Prerequisites

* macOS devices enrolled in Microsoft Intune
* **Apple Business Manager (ABM)** with **Volume Purchase (Apps and Books / VPP)** configured in Intune — required to push the free Boza app silently
* The Boza Safari **configuration profile** (a `.mobileconfig` file) — request it from your Boza Account Executive
* Target devices running **macOS 12 (Monterey)** or later (Safari 16+)

{% hint style="warning" %}
The Boza app must be installed **before** the configuration profile can take effect. Until the app is installed, the profile has no extension to configure.
{% endhint %}

***

## Step 1 — Add the Boza App (VPP)

1. In Apple Business Manager, make sure the free **Boza - Extension** app is added to your organization's **Apps and Books** so the licenses sync into Intune.
2. In the Microsoft Intune admin center, go to **Apps > macOS**.
3. Click **+ Add** and choose **macOS app (Volume Purchase Program)** as the app type.
4. Select **Boza - Extension** (bundle ID `com.boza.safari`).
5. Set the **License type** to **Device licensing** for silent, user-independent installation.
6. Assign the app to your target device groups and choose **Required** so it installs automatically.

{% hint style="info" %}
Device-licensed VPP apps install silently without an Apple ID prompt. If you assign with user licensing instead, users may be prompted to confirm the install.
{% endhint %}

## Step 2 — Upload the Configuration Profile

Boza provides a ready-made `.mobileconfig` that configures the Safari extension's auto-login. You upload it to Intune as a **custom** profile.

1. In the Intune admin center, go to **Devices > macOS > Configuration profiles**.
2. Click **+ Create > New Policy**.
3. Select:
   * **Profile type:** Templates
   * **Template name:** Custom
4. Click **Create**.
5. In the **Basics** tab:
   * **Name:** `Boza Safari Extension`
   * **Description:** Configures the Boza Safari extension (auto-login)
   * Click **Next**
6. In the **Configuration settings** tab:
   * **Custom configuration profile name:** `Boza Safari Extension`
   * **Deployment channel:** Device channel
   * **Configuration profile file:** upload the `.mobileconfig` provided by Boza
7. Assign the profile to the **same device groups** as the app, then click **Next** and **Create**.

The Boza profile delivers a managed-preferences payload to the extension's bundle identifier. For reference, its Safari payload looks like this:

```xml
<dict>
    <key>PayloadType</key>
    <string>com.boza.safari.Extension</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadIdentifier</key>
    <string>com.boza.profile.safari.YOUR_ORG</string>
    <key>PayloadUUID</key>
    <string>GENERATED-UUID</string>
    <key>PayloadDisplayName</key>
    <string>Boza - Safari Extension</string>
    <key>userEmail</key>
    <string>$EMAIL</string>
    <key>secretKey</key>
    <string>YOUR_SECRET_KEY</string>
</dict>
```

{% hint style="info" %}
You do not need to edit this file — Boza generates it for your organization. The `PayloadType` is the **extension's** bundle identifier (`com.boza.safari.Extension`), which is what the extension reads through `UserDefaults`.
{% endhint %}

## Auto-login and the `$EMAIL` variable

The profile identifies each user with the `$EMAIL` variable so that the extension logs them in automatically.

{% hint style="warning" %}
**`$EMAIL` is a Jamf substitution variable.** Jamf replaces it with each device's assigned email from inventory. **Microsoft Intune does not substitute `$EMAIL`** in a custom `.mobileconfig`, so it cannot resolve a per-user address from a single shared profile.

What this means for Intune-managed Macs:

* **For seamless per-user auto-login, use** [**Jamf**](/docs/browser-extension/deployment/jamf.md)**.** It is the only MDM that resolves the per-user email automatically with this profile.
* On Intune, the extension still installs and works, but users **sign in once via SSO** when they first open it (the secret key is shared; only the per-user email cannot be injected).

If automatic per-user identification on Intune is a hard requirement, contact your Boza Account Executive to discuss options.
{% endhint %}

## Step 3 — User Enables the Extension (One-Time)

After the app and profile are deployed, each user enables the extension once:

1. Open **Safari**.
2. Go to **Safari > Settings > Extensions**.
3. Find **Boza** and toggle it on.

{% hint style="info" %}
This one-time enable is required by Apple — Safari does not allow extensions to be force-enabled silently the way Chrome and Edge do.
{% endhint %}

***

## Validate the Deployment

**Verify the Boza app is installed:**

```bash
ls -la /Applications/Boza.app
```

**Verify the configuration profile is installed:**

Go to **System Settings > General > Device Management** and look for **Boza Safari Extension**. Or run:

```bash
sudo profiles list | grep -i boza
```

**Verify managed preferences:**

```bash
sudo cat "/Library/Managed Preferences/com.boza.safari.Extension.plist"
```

Should show `userEmail` and `secretKey` values.

{% hint style="info" %}
The managed-preferences domain must match the **extension's** bundle identifier (`com.boza.safari.Extension`) — that is the process that reads `userEmail` and `secretKey`. Writing them under the container app's domain (`com.boza.safari`) will not work.
{% endhint %}

**Verify the extension in Safari:**

Open **Safari > Settings > Extensions** and confirm the Boza extension is listed and enabled.

***

## Troubleshooting

**App not installing**

* Confirm the Boza app is added to Apple Business Manager **Apps and Books** and that licenses have synced into Intune (**Apps > macOS**).
* Confirm the app assignment is **Required** and **Device licensing** is selected.
* Force a sync from **Company Portal > Check Status** on the device.

**Extension not visible in Safari**

* Confirm the Boza app is installed: `ls /Applications/Boza.app`.
* Completely quit Safari (Cmd+Q) and reopen it.
* Confirm the user has enabled the extension under **Safari > Settings > Extensions**.

**User is prompted to log in (no auto-login)**

* This is expected on Intune — `$EMAIL` is not substituted (see [Auto-login and the `$EMAIL` variable](#auto-login-and-the-email-variable)). Users sign in once via SSO.
* For automatic per-user auto-login, deploy via [Jamf](/docs/browser-extension/deployment/jamf.md) instead.

**Managed preferences missing**

* Confirm the configuration profile is installed: `sudo profiles list | grep -i boza`.
* Confirm the profile was uploaded on the **Device channel**, not the user channel.

***

## Related

* [Deploy via Jamf](/docs/browser-extension/deployment/jamf.md) — recommended for Apple devices (full auto-login)
* [Deploy via Jamf (Profile)](/docs/browser-extension/deployment/jamf-via-profile.md) — manual `.mobileconfig` upload to Jamf
* [Deploy via Other MDM](/docs/browser-extension/deployment/other-mdm.md) — manual `.mobileconfig` upload for Mosyle, Kandji, and others

Need help? Contact the Boza team at **<support@getboza.io>**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://boza.gitbook.io/docs/browser-extension/deployment/safari-intune.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.