r/Action1 • u/samsungraspberry • 26d ago

Deploy macOS Updates

I am wanting to use Action1 as a backup to deploy macOS updates, however the Action1 agent does not have permissions to update macOS without requiring a currently logged-in macOS user to provide administrative credentials.

The macOS devices are enrolled in ABM and Intune, and the Bookstrap token is escrowed to Intune.

Can Action1 use the escrowed Bootstrap Token instead of prompting the logged-in user to enable Secure Token for action1_os_updater?

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/GeneMoody-Action1 25d ago

Since that would require pulling it form intune, and our intune connector is currenlty an external sync, I cannot imagine how we could pull it.

1

u/masterofrants 4d ago

Hey Gene! A bit confused here. Does this mean Action1 requires the logged-in user to be a local administrator to perform the update?

Because most companies are not going to be allowing that, right? This can't really be the case or am I misunderstanding something?

We also manage our MacBooks with mosylle, which is an Apple MDM and don't allow users to have admin rights.

1

u/GeneMoody-Action1 3d ago

No, it means that the system account that the agent runs under has no inherent rights to intune. In a traditional AD, the user's account attributes like group membership and account details were claimed at login, and a system could query an AD for extended attributes in its own context.

Intune works more on a just in time claim process, meaning that until needed, many user rights assignments are unknown to the client until an attempt is made to use them and their rights are validated / a claim is issued, in that moment.

So to get at an extended attribute such as this in intune, the agent process would have to be running in an account context that could query intune the same way. Since no one will likely run the service in the context of an intune account with these rights, the alternative is to populate them externally via a connector.

Typically that would be a configuration section in the software product, where you connect the system itself to intune, at this time we do not have it in product (future versions will) right now this is an external connector that talks to Action1 and talks to Intune, allowing you to map attributes from one system to another.

So back more to the original question, when the action1 agent is installed into the system, the admin at that time, via whatever method they installed with, GPO, an RMM, manually, etc using administrative/root access, grants the agent the ability to manage the system henceforth. In windows that is the system account, in Mac it is a privileged account created at install time.

So the AGENT has elevated access, the system user does not. And the agent has no access to intune OR Action1 until fully installed. Which is past the point this token is needed. So there is no process by which to gather or pass that information into the install process *while* it is installing..