Make Intune macOS shell scripts safe for parallel and repeated execution

Source facts

Intune runs macOS shell scripts as separate parallel processes. A script configured for signed-in users runs for every currently signed-in account, while the default setting runs as root. Certain conditions can trigger runs more frequently than the selected frequency. Scripts exceeding 60 minutes are stopped and reported failed. Microsoft requires direct internet connectivity; proxy connections are unsupported. Microsoft Learn.

Applicability

Confirm supported macOS, the installed management agent, and the required shell interpreter. Determine whether the proposed action belongs to the device or to each signed-in user before choosing execution context.

DSE recommendation

Review the script for repeated side effects, shared temporary paths, and assumptions that another script has already finished. Require an explicit reason for root execution. Design state checks so an already-correct device needs no further change, and define a clear exit result when a prerequisite is absent. Avoid making one independent assignment a hidden prerequisite for another.

Verification

Rehearse the script on a test Mac with representative account and sign-in conditions. Run the intended operation again and check for duplicate configuration, unintended file changes, or conflicting concurrent activity. Compare the script’s exit result with the actual requested state; a zero exit code alone should not be the team’s acceptance criterion. Keep sanitized local evidence and the reviewed script version with the deployment record.

Official references

Microsoft Learn: Use Shell Scripts on macOS Devices in Microsoft Intune.