The desktop app
Which installer to choose, and how to roll it out and update it as a managed app on Windows and macOS.
The desktop app highlights sensitive data while employees type in supported desktop apps, and cleans documents before they are shared. You roll it out as a managed app through Intune. Before you start, choose which installer to use, because that determines where the app is installed and who updates it. Then follow the steps for Windows or for macOS.
First, choose the installer
| The app updates itself | IT decides the version | |
|---|---|---|
| File | the regular installer | the enterprise installer, as a Win32 package |
| Where | in the employee's profile | machine-wide, under Program Files |
| Installation | in the user context | silent in the system context, even when nobody is signed in |
| Updating | automatic | you publish a new version |
| Detection rule | per user | fixed key, machine-wide |
If you choose the regular installer, you roll it out once in the user context, without supersedence. From then on the app fetches new versions itself, and there is nothing more to update in Intune. The enterprise installer installs into Program Files, where standard users cannot write. That is why it has no update mechanism of its own, and why the policy for automatic updates has no effect on it: you publish every new version yourself. The rest of this page covers the enterprise installer.
Windows
For Windows, BeeSensible supplies the enterprise installer as a ready-made Win32 package (.intunewin) that you upload straight into Intune. You do not need to wrap the installer yourself with IntuneWinAppUtil.
Download the Intune package
A matching checksum only proves that the download is complete and undamaged, not who it comes from. You check the sender through the digital signature of the standalone installer (.exe) from the console. In File Explorer, open Properties → Digital Signatures, which shows Venturo Media B.V. as the signer. You can also check the signature on the command line:
signtool verify /pa BeeSensible-Enterprise-Setup-<version>.exe
The console itself verifies the signature over the checksum list (SHA256SUMS.sig) before it shows a checksum. Not yet validated
Create the Win32 app
In Intune, choose Apps → Windows → Add → Windows app (Win32) and upload the .intunewin package.
App information
| Intune field | Enter |
|---|---|
| Name | BeeSensible Desktop |
| Description | for example Highlights sensitive data while you type and cleans documents before you share them. |
| Publisher | BeeSensible |
The other fields on this screen are not needed for the app to work and can stay empty.
Program
| Intune field | Enter |
|---|---|
| Install command | see below |
| Installer type | Command line (directly under the install command) |
| Uninstall command | see below |
| Installation time required | leave the default |
| Allow available uninstall | No |
| Install behavior | System |
| Device restart behavior | No specific action |
| Return codes | leave the defaults |
Use the line below as the install command. The console shows it with the version number already filled in:
BeeSensible-Enterprise-Setup-<version>.exe /S
Use the line below as the uninstall command. This path is the same for every version:
"C:\Program Files\BeeSensible\Uninstall BeeSensible.exe" /S
Requirements
| Intune field | Enter |
|---|---|
| Operating system architecture | 64-bit |
| Minimum operating system | the lowest Windows 10 version your organisation still uses |
| Disk space, memory, processors | leave empty |
| Additional requirement rules | none |
Detection rules
Choose Manually configure detection rules and add one rule in the Detection rule panel:
| Intune field | Enter |
|---|---|
| Rule type | Registry |
| Key path | see below |
| Value name | DisplayVersion |
| Detection method | Version comparison |
| Operator | Greater than or equal to |
| Value | the version number the console shows next to the package |
| Associated with a 32-bit app on 64-bit clients | No |
For Key path, enter the app's uninstall key. This path is the same for every version:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7181cf82-0fd7-4079-86fa-1d55be2016d3
Dependencies
The app has no dependencies, so click Next here.
Supersedence
Leave this screen empty for the first rollout. For a later upgrade you select the previous version here, as described under Updates below.
Assignments
| Intune field | Enter |
|---|---|
| Required | Add group → your target group |
| Available for enrolled devices | none |
| Uninstall | none |
You only use the Uninstall assignment if you later want to remove the app from the devices; see Rolling back.
Review + create
Check the summary and click Create. Intune uploads the package and starts distributing it to the devices in your target group.
Verify
In Intune you follow the installation per device under Apps → BeeSensible Desktop → Device install status.
If the sign-in script has run on the device, the app knows the employee's work address. Since5.5.18 it uses it to start the work sign-in itself; on older versions the employee signs in once. Not yet validated
The app shows Pending, or I do not see BeeSensible
Usually the Intune management extension on the device has not checked in yet, the device does not meet a requirement (64-bit or the minimum operating system), or the download is still running. Sync the device or restart it. If that does not help, check the error code under Device install status and the log on the device:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log
Intune keeps showing Installing or Failed while the app is there
In that case the detection rule does not match what is on the device. Check which version is installed:
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7181cf82-0fd7-4079-86fa-1d55be2016d3" /v DisplayVersion
The version number in the detection rule must not be higher than this value. If Associated with a 32-bit app on 64-bit clients is set to Yes, Intune looks in the 32-bit part of the registry and does not find the key; set it to No.
macOS
There are two installers for macOS, following the same distinction as on Windows. Employees install the DMG from the download page themselves, and that version updates itself. For Intune or another MDM solution there is the PKG from the rollout console. It installs silently and as root, even when nobody is signed in, and makes the app start automatically for every user. You roll out new versions of the PKG yourself. Both installers are for Macs with Apple Silicon; BeeSensible does not support Intel Macs.
Download the package and verify it
After downloading, check that the file is intact and who it comes from. Calculate the checksum with shasum -a 256 <filename> and compare the result with the value in the console. Then check the signature with pkgutil --check-signature <filename>.
Expected: the signer is Venturo Media, with a Developer ID Installer certificate. Apple has notarised the package, so macOS accepts it without a warning.
Add it as a macOS app (PKG)
In Intune, choose Apps → macOS → Add → macOS app (PKG) and upload the package. For the detection rule, enter the bundle ID below with the version number the console shows next to the package:
eu.beesensible.desktopAssign it
Assign the app as Required to your target group. The package always installs the app into the Applications folder.
Rolling out a new version. Upload the new package in Intune as a new version of the same app, so that it supersedes the previous one. Intune leaves devices that already have a higher version alone. If the app is running at the time of the update, the installer closes it first.
Removing the app. The cleanup script for macOS is in the console under Rolling back. It removes the startup entry and the app itself. The script deliberately leaves the employee's settings and the shared model cache in place; it ends with the commands you can use to remove those as well.
