The desktop app
Which installer to choose, and how to roll it out and update it as a managed app on Windows and macOS.
Two platforms, each with its own package. Choose the installer first (that applies to both), then roll out per platform.
First: which installer
There are two Windows installers for the same app, and the choice determines the rest of this page.
| The app updates itself | IT decides the version | |
|---|---|---|
| File | the regular installer | the enterprise installer, as a Win32 package |
| Where | in the employee's profile | machine-wide, under Program Files |
| Installation | in user context | silent as system, even with nobody signed in |
| Updating | on its own | you publish a new version |
| Detection rule | per user | fixed key, machine-wide |
If you want self-updating clients, choose the regular installer and roll it out through Intune in user context. No supersedence is needed: the app fetches new versions itself, so you publish the package once.
If you want version control in your own hands, choose the enterprise installer. The rest of this page describes that route.
The rollout console lets you make that choice and then shows only the package and the values that belong to it.
Windows
Deploying the enterprise installer
For Intune, BeeSensible provides a ready-made Win32 package (.intunewin) containing the enterprise installer. Packaging with IntuneWinAppUtil yourself is not needed.
Download the Intune package
The checksum proves the download is complete and undamaged, nothing more. Where the file comes from is shown by the digital signature on the installer. The .intunewin package contains that signed .exe; check it on the standalone installer from the console, under Properties → Digital Signatures, with Venturo Media B.V. as the signer. Or on the command line:
signtool verify /pa BeeSensible-Enterprise-Setup-<version>.exe
Next to the checksum list, BeeSensible publishes a signature over that list (SHA256SUMS.sig); the deployment console verifies it before it shows a checksum. Not yet validated
Create the Win32 app
Intune: Apps → Windows → Add → Windows app (Win32). Upload the .intunewin package.
App information
| Intune field | Enter |
|---|---|
| Name | BeeSensible Desktop |
| Description | for example Highlights sensitive data while you type and cleans documents before you share them. |
| Publisher | BeeSensible |
The remaining fields on this screen can stay empty.
Program
| Intune field | Enter |
|---|---|
| Install command | see below |
| Installer type | Command line (directly under the install command) |
| Uninstall command | see below |
| Installation time required | leave the default |
| Allow available uninstall | No |
| Install behavior | System |
| Device restart behavior | No specific action |
| Return codes | leave the defaults |
Install command; the console shows it with the real version number:
BeeSensible-Enterprise-Setup-<version>.exe /S
Uninstall command:
"C:\Program Files\BeeSensible\Uninstall BeeSensible.exe" /S
Requirements
| Intune field | Enter |
|---|---|
| Operating system architecture | 64-bit |
| Minimum operating system | the lowest Windows 10 version your organisation still uses |
| Disk space, memory, processors | leave empty |
| Additional requirement rules | none |
Detection rules
Choose Manually configure detection rules and add one rule. The panel is called Detection rule and shows the fields in this order:
| Intune field | Enter |
|---|---|
| Rule type | Registry |
| Key path | see below |
| Value name | DisplayVersion |
| Detection method | Version comparison |
| Operator | Greater than or equal to |
| Value | the version number the console shows next to the package |
| Associated with a 32-bit app on 64-bit clients | No |
Key path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7181cf82-0fd7-4079-86fa-1d55be2016d3
Dependencies
Supersedence
Assignments
| Intune field | Enter |
|---|---|
| Required | Add group → your target group |
| Available for enrolled devices | none |
| Uninstall | none |
Uninstall stays empty for now; that assignment is later the way to remove the app from the devices again (see Rolling back).
Review + create
Check the summary and click Create. Intune uploads the package and starts distributing.
Verify
Installation can take a while. The status is in Intune under Apps → BeeSensible Desktop → Device install status.
With the sign-in script from step 1 on the device, the app knows the employee's work address. Since5.5.18 the app starts the work sign-in with it by itself; on older versions the employee signs in once themselves with that address. Not yet validated
The app shows Pending in Intune
The device has not processed the assignment yet: the management extension has not checked in, a requirement (64-bit, minimum operating system) is not met, or the download is still running. Sync as in step 1 and look at the error code in Intune under Device install status. On the device, the management extension logs the installation in this file:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log
Intune assigned the app, but I do not see BeeSensible
Check the device install status in Intune, sign in again or restart the device, and look among the installed apps. If it stays absent, AppWorkload.log (path above) shows what happened to the installation.
Intune keeps showing Installing or Failed while the app is there
Then the detection rule does not match what is installed. Check on the device which version is in the registry:
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7181cf82-0fd7-4079-86fa-1d55be2016d3" /v DisplayVersion
Compare with the value in the rule: with Greater than or equal to, the rule must not be higher than the installed version. If the 32-bit question is set to Yes, Intune looks in the wrong part of the registry; set it to No.
macOS
Alongside the DMG an employee installs themselves, there is a PKG for a managed rollout. It installs silently, as root, without anyone needing to be signed in.
| DMG | PKG | |
|---|---|---|
| For whom | the employee installing it themselves | IT, through Intune or another MDM |
| Installation | drag to Applications | silent, no screen, no choice |
| Autostart | the app arranges it on first launch | correct straight away, for every user of the device |
| Updates | the app updates itself | you roll out a new version |
| Where to get it | the download page | the rollout console |
Both are for Apple Silicon. Intel Macs are not supported yet.
Download the package and verify it
The console shows the package with its version number and checksum.
Verify the checksum: shasum -a 256 <filename>
Verify who signed it: pkgutil --check-signature <filename>
Expect: Venturo Media, with a Developer ID Installer certificate. The package is also separately notarized with Apple, so a Mac accepts it without a warning.
Add it as a macOS app (PKG)
Intune: Apps → macOS → Add → macOS app (PKG), and upload the package.
For the detection rule, enter the app bundle ID and the version from the console:
eu.beesensible.desktopAssign it
Assign the app as Required to your target group. There is nothing to choose during installation: the package installs into Applications and nowhere else.
Rolling out a new version
Upload the new package as a new version of the same app and supersede the previous one. Thanks to the version comparison, Intune installs the new version and leaves devices that are already higher alone. If the app is running, the installer closes it first.
Removing it
The console shows the cleanup script under Rolling back. It removes the startup entry and the app, and reports what deliberately stays: the employee's settings and the shared model cache. Removing those two is a separate, explicit action; the script ends with the commands that do it.
