Skip to main content

Admin Dashboard

Intune - macOS Configuration Guide

The following contains procedures for deploying Blocksi URL Filtering OSX using Intune. The solution consists of two components:

  • Proxy - A system-level service that intercepts and filters web traffic.

  • Agent - A menu bar application that communicates with Blocksi servers to enforce filtering policies.

Prerequisites

Ensure the following prerequisites are in place before proceeding with deployment:

  • Administrator access to the Microsoft Intune Admin Center at intune.microsoft.com.

  • Your Blocksi Super-Admin account email address.

  • Devices are enrolled in Intune and their local account name matches the part of their Blocksi licensed email address before the @ - for example, for student123@blocksi.net the local account name is student123.

  • Download the following files provided by Blocksi:

    • Blocksi_Filter.pkg - Installer which installs the proxy and agent.

    • Blocksi_Settings.mobileconfig

    • Blocksi_Proxy.mobileconfig

    • blocksi_uninstall.sh - (Optional) Uninstaller script for the Blocksi Filter agent. Click here to download.

Downloads

Download the Blocksi Filter agent and configuration files from the Admin Dashboard.

  1. Click on your profile icon in the top right of the dashboard.

  2. Click Downloads.

  3. Select the Apple tab and download the appropriate package for your MDM.

Warning

After completing each step, wait a few minutes for the configuration to be pushed to the target devices before proceeding to the next step.

Uploading the Blocksi Settings Configuration Profile
To upload the Blocksi Settings profile:

  1. Sign in to the Microsoft Intune Admin Center at intune.microsoft.com.

  2. Navigate to Devices > Manage Devices > Configuration and select + Create > New Policy. A new panel appears on the right side of the page.

  3. Enter the following properties:

    • Platform - macOS

    • Profile Type - Templates > Custom

  4. Click Create.

  5. On the Basics tab, enter the following properties:

    • Name - Enter a name for the profile (e.g., Blocksi Filter - Settings).

    • Description - Enter a description for the policy. This setting is optional but recommended.

    Note

    The Platform and Profile Type should already be filled out.

    Basics Tab

  6. Click Next.

  7. On the Configuration Settings tab, enter a name for the configuration profile in the name field (e.g., Blocksi Settings), set the Deployment channel to Device channel, then upload the Blocksi_Settings.mobileconfig file under the Configuration profile file section.

    Configuration Settings

  8. Search for the organizationId key and replace admin@blocksi.net with your Blocksi Super Admin account (CompanyId) within the <string></string> fields.

    Replace organizationId

  9. Review the imported file and click Next.

  10. In the Assignments tab, assign the profile to your device groups and click Next.

  11. On the Review + Create tab click Create. Your changes are saved, the profile is assigned, and the policy appears in the profiles list.

Note

The bundle_id key is used to configure which apps are filtered by the Blocksi agent. The provided .mobileconfig file is configured to filter the most commonly used web browsers: Chrome, Safari, Edge, Brave, Firefox, and Opera. You can filter additional apps by adding <string>package_name</string> lines to the configuration.

Configuring the Application Package Deployment
To create the Blocksi Filter app:

  1. Sign in to the Microsoft Intune Admin Center at intune.microsoft.com.

  2. Navigate to Apps > macOS and select + Create.

  3. For App type, select macOS app (PKG), then click Select.

  4. Click Select app package file, browse to Blocksi_Filter.pkg, and click OK.

    Add_App.png

  5. On the App information tab, enter the following properties, then click Next:

    • Name - The name of the app as it appears in the Microsoft Intune Admin Center (e.g., Blocksi for OSX).

    • Description - A description of the app.

    • Publisher - Blocksi.

    App_information.png

  6. On the Program tab, click Next.

  7. On the Requirements tab, set Minimum operating system to macOS Monterey 12.0. Click Next.

  8. On the Detection rules tab, the included app's bundle ID is detected automatically:

    • Included app bundle ID - com.blocksi.filter

    • Set Ignore app version to Yes so reinstalls aren't forced on every version. Click Next.

    Detection_Rules.png

  9. On the Assignments tab, add the same target device group as Required. Click Next.

  10. On the Review + Create tab, confirm the settings and click Create.

Uploading the Blocksi Proxy Configuration Profile
To upload the Proxy Configuration Profile:

  1. Sign in to the Microsoft Intune Admin Center at intune.microsoft.com.

  2. Navigate to Devices > Manage Devices > Configuration and select + Create > New Policy. A new panel appears on the right side of the page.

  3. Enter the following properties:

    • Platform - macOS

    • Profile Type - Templates > Custom

    Create a Profile Tab

  4. Click Create.

  5. On the Basics tab, enter the following properties:

    • Name - Enter a name for the profile (e.g., Blocksi Filter - Proxy).

    • Description - Enter a description for the policy. This setting is optional but recommended.

    Note

    The Platform and Profile Type should already be filled out.

    Basics Tab - Custom Configuration Profile

  6. Click Next.

  7. On the Configuration Settings tab, enter a name for the configuration profile in the name field (e.g., Blocksi Proxy), set the Deployment channel to Device channel, then upload the previously downloaded Blocksi_Proxy.mobileconfig file under the Configuration profile file section.

    Configuration Settings Tab - Custom Configuration Profile

  8. Review the imported file and click Next.

  9. In the Assignments tab, assign the profile to your device groups and click Next.

  10. On the Review + Create tab click Create. Your changes are saved, the profile is assigned, and the policy appears in the profiles list.

Validating the Deployment

To validate the deployment, verify that the profiles, services, and filtering agent are installed on the target device correctly.

To check whether the Blocksi services are running:

  • Open Terminal on the target Mac and run the following command:

    launchctl list | grep blocksi

The output should include com.blocksi.proxy.

To check whether the system extension is installed:

  • Open Terminal on the target Mac and run the following command:

    systemextensionsctl list

The output should include FNVRG3YPHU com.blocksi.filter.proxy (1.0/1) com.blocksi.filter.proxy [activated enabled].

To check whether the proxy is active:

  1. Navigate to System Settings.

  2. Click Network in the sidebar, then click Filters.

    The Blocksi Filter should show with a status of Enabled.

    Blocksi Filter Enabled
To check whether the agent is running:

  1. After login, verify that the Blocksi Filter icon appears in the menu bar.

  2. Click the icon. The status should show Connected.

    Blocksi Filter Connected
To check whether filtering is working:

  1. Log in to the Mac device with a licensed user that has a policy assigned.

  2. Navigate to some sites that should be blocked by your policy.

  3. Verify that the Blocksi Access Denied page appears:

    Blocksi Access Denied Page

  4. On the Blocksi Admin Dashboard, navigate to Insights from the Main Menu, click Web Analytics from its sub-menu, then switch to Logs.

  5. Verify that the browsing activity from the device appears in the logs.

Updating Blocksi Filter

Updating Blocksi Filter replaces the installed application package with a newer version. You can update Blocksi Filter on managed devices without re-enrolling them or re-creating the Blocksi Settings and Blocksi Proxy configuration profiles.

Note

Do not unassign the Blocksi Settings or Blocksi Proxy configuration profiles during an update. These profiles are not replaced by the new package, and removing them requires re-deploying them before filtering resumes.

To update Blocksi Filter:

  1. In your MDM, remove the target device groups from the scope of the Blocksi Filter application package so the package is not redeployed while the update is in progress.

  2. Deploy the uninstall script to the same device groups. The deployment procedure is the same one described in Uninstalling Blocksi Filter in this guide.

    Important

    Download the uninstall script using this direct link.

  3. Wait for the script to run on the target devices, then confirm that the Blocksi Filter icon no longer appears in the menu bar.

  4. Upload the new version of the Blocksi Filter package to your MDM, replacing the existing package. Refer to Configuring the Application Package Deployment in this guide.

    Note

    Download the Blocksi Filter agent package from the Admin Dashboard.

    1. Click on your profile icon in the top right of the dashboard.

    2. Click Downloads.

    3. Select the Apple tab and download the appropriate package for your MDM.

  5. Add the target device groups back to the scope of the Blocksi Filter package.

  6. Confirm that the new version is installed and filtering is active. Refer to Validating the Deployment in this guide.

Uninstalling the OSX Filtering Solution

Important

Unassign the Blocksi application package deployment and both Blocksi configuration profiles from the target devices before proceeding with deploying the uninstall script.

To deploy the uninstall script:

  1. Sign in to the Microsoft Intune Admin Center at intune.microsoft.com.

  2. Navigate to Devices > macOS > Manage Devices > Scripts and click + Add.

  3. On the Basics tab, enter the following properties:

    • Name: Blocksi Uninstall

    • Description: Enter a description for the script. This setting is optional but recommended.

      Basics Tab - Uninstall Script

  4. On the Script settings tab: upload the previously downloaded blocksi_uninstall.sh file under Upload script. The script is available for download here.

  5. Switch Run script as signed-in user to No.

    Script Settings

  6. Click Next.

  7. In the Assignments tab, assign the script to your device groups and click Next.

  8. On the Review + Add tab click Add.

Troubleshooting Uninstall Failure

If you are having issues with uninstalling Blocksi from OSX devices using Intune, create a new configuration profile that allows identified developers.

To create the Allow Identified Developers Configuration Profile:

  1. Navigate to Devices > Manage Devices > Configuration and select + Create > New Policy. A new panel appears on the right side of the page.

  2. Enter the following properties:

    • Platform: macOS

    • Profile type: Settings catalog

  3. On the Basic tab, enter the following properties:

    • Name: macOS - Allow Identified Developers

  4. On the Configuration settings tab, click + Add settings.

  5. Within the Settings picker, scroll down to System Policy Control > System Policy Control, and select Allow Identified Developers.

  6. Under System Policy Control, switch Allow Identified Developers to True.

  7. In the Assignments tab, assign the configuration profile to your device groups and click Next.

  8. On the Review + Create tab click Create.

Note

Wait for the new profile to push down to the devices, and then repeat the uninstalling procedure.