Deploying the F1E Endpoint for macOS using Microsoft Intune

This section describes the process for installing the macOS F1E Endpoint using Microsoft Intune.

1. Open the terminal application and create a folder to place the package. You can choose a location of your preference.
   
   
   
2. Copy the installer files.

   Copy the contents from the client package file from Forcepoint and paste the Endpoint Installer folder into the newly created folder at /private/var/tmp/FORCEPOINT-ONE-ENDPOINT-Mac.

   
   
   

   For information on generating the key.pem and server.pem files, see How to Create the Endpoint SSL Identity.

3. Use a packaging tool like JAMF Pro Composer (or any other packaging tool) to build the package with the following payload structure.
4. Create a postinstall script to automate the installation process. Following is an example script that you can modify as per your requirements:
   
   
   

   #!/bin/sh
   ## postinstall
   
   pathToScript=$0
   pathToPackage=$1
   targetLocation=$2
   targetVolume=$3
   
   tritonClassifier="/private/var/tmp/F1EDLP/Forcepoint_installer_V_22.12AZURE/EndpointInstaller/WebsenseEndpoint.pkg"
   tritonEndpoint="/private/var/tmp/F1EDLP/Forcepoint_installer_V_22.12AZURE/EndpointInstaller/WebsenseEPClassifier.pkg"
   
   # Install WebsenseEPClassifier.pkg
   sudo installer -pkg $tritonClassifier -target / -allowUntrusted
   
   # Install WebsenseEndpoint.pkg
   sudo installer -pkg $tritonEndpoint -target / -allowUntrusted
   
   # Wait for 5 seconds and delete local installation files
   sleep 5
   # sudo rm -rfv /private/tmp/F1EDLP
   
   exit 0 ## Success

   The following screenshot is an example of the folder structure using Composer.

   
   
   

   Ensure the package is signed with your developer ID. Double-click the package and click the padlock in the top right corner. Verify that it is properly signed before proceeding.

   
   
   
5. Navigate to Intune and upload the newly created package. Intune allows a .pkg file to be uploaded without the need for the Microsoft Intune wrapping tool.
   1. Upload the client app package (.pkg) to the Intune admin console (intune.microsoft.com) as a Line-of-business (LOB) app.
      
      
      
   2. In the Installed Apps section, remove all entries except for com.websense.endpoint 23.04.0377. Ensure that this configuration is set correctly, but do not assign it yet.
      
      
      
6. Configure the System Extensions profile:

   Forcepoint One uses a Network System Extension on macOS 11 or later, bundled into an application named Forcepoint Neo, which is installed under /Applications/fpneone catalog.

   1. In Intune, go to Settings Catalog > System Configuration > System Extensions.
   2. Add the following Allowed System Extensions (or Allowed System Extension Types - Network):
      
      
      

      • Extensions: com.forcepoint.ne-app, com.forcepoint.ne.
      • Team Identifier: C489D5E8E8.

   This configuration prevents users from receiving the prompt saying the system extension is blocked, as shown below.

   
   
   
7. Create a Web Content Filter profile:
   
   
   
   1. In Intune, create a new Settings Catalog profile and select Web Content Filter.
   2. Configure the following settings for the Web Content Filter profile:
      • Filter Data Provider Bundle Identifier: com.forcepoint.ne-app
      • Plugin Bundle ID: com.forcepoint.ne-app
      • User Defined Name: Forcepoint Neo Web Content Filtering
      • Filter Grade: firewall
      • Filter Data Provider Designated Requirement: identifier "com.forcepoint.ne-app" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = C489D5E8E8
      • Filter Sockets: Enabled
      • Filter Packets: Disabled

   After the Web Content Filter profile is installed on a device, users no longer see the pop-up message, and the content filtered by Forcepoint Neo is automatically allowed.

   Note: After you complete the preceding steps, your configuration should look like this.

   
   
   

   When the Web Content Filter profile is installed on a device, it prevents users from seeing this pop-up (the content is automatically allowed).