The desktop app
Which installer to choose, and how to roll it out and update it as a managed app on Windows and macOS.
Two platforms, each with its own package. Choose the installer first (that choice applies to both), then roll out platform by platform.
First, choose the installer
There are two Windows installers for the same app, and your choice determines the rest of this page.
| The app updates itself | IT decides the version | |
|---|---|---|
| File | the regular installer | the enterprise installer, as a Win32 package |
| Where | in the employee's profile | machine-wide, under Program Files |
| Installation | in the user context | silent in the system context, even when nobody is signed in |
| Updating | automatic | you publish a new version |
| Detection rule | per user | fixed key, machine-wide |
If you want self-updating clients, choose the regular installer and roll it out through Intune in the user context. No supersedence is needed: the app fetches new versions itself, so you publish the package once.
If you want to control the version yourself, choose the enterprise installer. The rest of this page covers that route.
The rollout console lets you make that choice and then shows only the package and the values that go with it.
Windows
Deploying the enterprise installer
For Intune, BeeSensible provides a ready-made Win32 package (.intunewin) containing the enterprise installer. You do not need to package it yourself with IntuneWinAppUtil.
Download the Intune package
The checksum proves the download is complete and intact, nothing more. The digital signature on the installer shows who the file comes from. The .intunewin package contains that signed .exe; check the signature on the standalone installer from the console, under Properties → Digital Signatures, with Venturo Media B.V. as the signer. Or use the command line:
signtool verify /pa BeeSensible-Enterprise-Setup-<version>.exe
Alongside the checksum list, BeeSensible publishes a signature over that list (SHA256SUMS.sig); the rollout console verifies it before showing a checksum. Not yet validated
Create the Win32 app
Intune: Apps → Windows → Add → Windows app (Win32). Upload the .intunewin package.
App information
| Intune field | Enter |
|---|---|
| Name | BeeSensible Desktop |
| Description | for example Highlights sensitive data while you type and cleans documents before you share them. |
| Publisher | BeeSensible |
You can leave the other fields on this screen empty.
Program
| Intune field | Enter |
|---|---|
| Install command | see below |
| Installer type | Command line (directly under the install command) |
| Uninstall command | see below |
| Installation time required | leave the default |
| Allow available uninstall | No |
| Install behavior | System |
| Device restart behavior | No specific action |
| Return codes | leave the defaults |
Install command (the console shows it with the actual version number):
BeeSensible-Enterprise-Setup-<version>.exe /S
Uninstall command:
"C:\Program Files\BeeSensible\Uninstall BeeSensible.exe" /S
Requirements
| Intune field | Enter |
|---|---|
| Operating system architecture | 64-bit |
| Minimum operating system | the lowest Windows 10 version your organisation still uses |
| Disk space, memory, processors | leave empty |
| Additional requirement rules | none |
Detection rules
Choose Manually configure detection rules and add one rule. The panel is called Detection rule and shows the fields in this order:
| Intune field | Enter |
|---|---|
| Rule type | Registry |
| Key path | see below |
| Value name | DisplayVersion |
| Detection method | Version comparison |
| Operator | Greater than or equal to |
| Value | the version number the console shows next to the package |
| Associated with a 32-bit app on 64-bit clients | No |
Key path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7181cf82-0fd7-4079-86fa-1d55be2016d3
Dependencies
Supersedence
Assignments
| Intune field | Enter |
|---|---|
| Required | Add group → your target group |
| Available for enrolled devices | none |
| Uninstall | none |
Leave Uninstall empty for now; later, you use that assignment to remove the app from the devices (see Rolling back).
Review + create
Check the summary and click Create. Intune uploads the package and starts distributing it.
Verify
Installation can take a while. You can follow the status in Intune under Apps → BeeSensible Desktop → Device install status.
With the sign-in script from step 1 on the device, the app knows the employee's work address. Since5.5.18 the app uses it to start the work sign-in automatically; on older versions the employee signs in once with that address themselves. Not yet validated
The app shows Pending in Intune
The device has not processed the assignment yet: the management extension has not checked in, a requirement (64-bit, minimum operating system) is not met or the download is still running. Sync as in step 1 and check the error code in Intune under Device install status. On the device, the management extension logs the installation in this file:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log
Intune assigned the app, but I do not see BeeSensible
Check the device install status in Intune, sign in again or restart the device, then look among the installed apps. If it is still missing, AppWorkload.log (path above) shows what happened to the installation.
Intune keeps showing Installing or Failed while the app is there
If so, the detection rule does not match what is installed. Check on the device which version is in the registry:
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7181cf82-0fd7-4079-86fa-1d55be2016d3" /v DisplayVersion
Compare it with the value in the rule: with Greater than or equal to, the value in the rule must not be higher than the installed version. If the 32-bit setting is Yes, Intune looks in the wrong part of the registry; set it to No.
macOS
Alongside the DMG an employee installs themselves, there is a PKG for a managed rollout. It installs silently, as root, without anyone needing to be signed in.
| DMG | PKG | |
|---|---|---|
| For whom | the employee installing it themselves | IT, through Intune or another MDM |
| Installation | drag to Applications | silent, no screen, no choice |
| Autostart | the app sets it up on first launch | set up straight away, for every user of the device |
| Updates | the app updates itself | you roll out a new version |
| Where to get it | the download page | the rollout console |
Both are for Apple Silicon. Intel Macs are not supported.
Download the package and verify it
The console shows the package with its version number and checksum.
Verify the checksum: shasum -a 256 <filename>
Verify who signed it: pkgutil --check-signature <filename>
Expected: Venturo Media, with a Developer ID Installer certificate. The package is also notarised by Apple, so macOS accepts it without a warning.
Add it as a macOS app (PKG)
Intune: Apps → macOS → Add → macOS app (PKG), and upload the package.
For the detection rule, enter the app bundle ID and the version from the console:
eu.beesensible.desktopAssign it
Assign the app as Required to your target group. There is nothing to choose during installation: the package installs into Applications and nowhere else.
Rolling out a new version
Upload the new package as a new version of the same app and supersede the previous one. Thanks to the version comparison, Intune installs the new version and leaves devices that already have a higher version alone. If the app is running, the installer closes it first.
Removing it
The console shows the cleanup script under Rolling back. It removes the startup entry and the app, and reports what is deliberately left behind: the employee's settings and the shared model cache. Removing those two is a separate, explicit step; the script ends with the commands for it.
