Configure Versa SASE with Microsoft Intune for IOS and MacOS

Create a PLIST File

Create a file that contains the key-value pairs for your configuration. Use a plain text editor or a dedicated .plist editor to create this file. Save it with a .plist extension (for example, versa_sase_config.plist).

For each configuration parameter, enter a key and corresponding value, as shown in the example below. Replace the variables with values with your actual environment.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>device_id</key>
    <string>{{deviceid}}</string>
    <key>device_name</key>
    <string>{{devicename}}</string>
    <key>user_id</key>
    <string>{{mail}}</string>
    <key>fqdn</key>
    <string>vpn.versa-networks.com</string>
    <key>enterprise_name</key>
    <string>Versa Networks</string>
    <key>managed_device</key>
    <true/>
    <key>default_browser</key>
    <false/>
    <key>is_versa_root_ca_required</key>
    <false/>
    <key>skip_onboarding_screens</key>
    <true/>
    <key>disable_dns_proxy</key>
    <false/>
    <key>log_level</key>
    <string>Verbose</string>
    <key>fail_close_allowed_ips</key>
    <array>
        <string>192.124.249.120/32</string>
    </array>
</dict>
</plist>

Upload a PLIST File for System Preferences (MacOS Custom Settings)

For macOS, you upload the .plist file in the Preference File template to deploy custom settings to a specific app bundle ID.

1. Log in to the Microsoft Intune admin center.
2. Navigate to Devices > macOS > Configuration.
3. Click Create, and then select New Policy.
4. In the Platform field, select macOS, and in the Profile type field, select Templates.
5. In Template name, select Preference file.
6. Click Create.
7. In the Basics Tab, enter a name for the policy (for example, Versa SASE Agent Config).
8. In the Preference domain field, enter com.versa.versasase (or the specific bundle ID provided by Versa).
9. In the Property list file field, upload the .plist file you created earlier.
10. In the Assignments tab, assign the policy to the required macOS device groups.
11. In the Review+Create tab, click Create.

iOS (App Configuration Policy)

1. Log in to the Microsoft Intune admin center.
2. Navigate to Apps > App configuration policies > Add > Managed devices.
3. In the Basics tab, enter a name for the policy (for example, “Versa SASE iOS Config”).
4. In Platform, select iOS/iPadOS.
5. In the Targeted app, select the Versa SASE app from your catalog.
6. In the Settings tab, in Configuration settings format, select Enter XML data.
7. In the XML Property list, add the required keys (for example, fqdn, user_id) and map them to the corresponding token (for example,{{mail}}).
   Note: Ensure your XML uses the Microsoft Intune tokens like {{mail}}. Microsoft Intune validates the XML structure automatically.
8. In Assignments, assign the policy to the required iOS user or device groups.

Create VPN Profile (IOS/IPadOS)

To create a VPN Profile for iOS/iPadOS:

1. In the Microsoft Intune admin center, click Devices > iOS/iPadOS > Configuration.
2. Click Create > New Policy.
3. In the Profile type field, select VPN, and then click Create.
4. In the Basics tab, enter a name for the profile — for example, Versa SASE VPN - iOS.
5. In Configuration settings, enter information for the following fields:
    

   Field	Description
   Connection type	Select Custom VPN
   Connection name	Enter the following value: Versa SASE
   VPN server address	Enter your Versa gateway FQDN. For example, acme.poc.versanow.net.
   Authentication method	Select Username and password, or Certificates (if using SCEP or PKCS)
   VPN identifier	Enter the following value: com.versa.saseclientcatalyst
   Custom attributes	(Optional) Select any key-value pairs required by Versa for the tunnel.

6. In Assignments, select the required device or user groups.
7. Review the configuration, and then click Create.

Create VPN Profile (MacOS)

To create a VPN Profile for macOS:

1. In the Microsoft Intune admin center, click Devices > macOS > Configuration.
2. Click Create > New Policy.
3. In the Profile type field, select VPN, and then click Create.
4. In Configuration settings, enter information for the following fields:
   
   
    

   Field	Description
   Deployment channel	Select Device channel
   Connection Name	Enter a name for the connection. For example, Versa MAC VPN IPSEC_SSL.
   VPN Server address	Enter your Versa gateway FQDN. For example, acme.poc.versanow.net.
   Authentication method	Select Username and password.
   Connection type	Select Custom VPN.
   VPN identifier	Enter the following value: com.versa.systemextension
   Enter key and value pairs for the custom VPN attributes	Add the following key-value pairs: Default browser=True SingleSignOn=True
   Split tunneling	Select Enable.

5. Click Next.
6. Review the configuration, and then click Create.

MacOS LOB-Based MDM Distribution (MacOS)

You can use Microsoft Intune to distribute the Versa SASE client to macOS devices as an LOB application.

To deploy a SASE client, you do the following:

1. Log in to the Microsoft Intune admin center.
2. In the Microsoft Intune admin center, select Apps > macOS, and then click + Create
3. In App type, select Line-of-business app, and then click Select.
   
   
4. Click Select app package file.
5. Select the package ( .pkg) file provided by Versa Networks, and then click OK.
   
   
6. In App information, enter information for the following fields. 
    

   Field	Description
   Select file	Displays the name of the uploaded .pkg file.
   Name	Enter a name for the application.
   Description	Enter a short description of the application.
   Publisher	Enter the publisher name, for example, Versa Networks.
   Minimum operating system	Select the minimum macOS version required to install the application.
   Ignore app version	Select one of the following: Yes—To ignore the application version during detection No—To enforce version checking.
   Install as managed	Select one of the following: Yes—To install the application as a managed application No—To install it as unmanaged.
   Included apps	Displays the list of applications included in the uploaded .pkg file. Review the list and ensure that only the required bundle identifier is listed. Remove any additional bundle identifiers if present.

7. Click Next twice to skip Scope tags and go to Assignments.
8. In Assignments, select the required device or user groups.
9. In Assignment type, select one of the following:
   • Required—Automatically installs the application.
   • Available—Makes the application available in Company Portal.
   • Uninstall—Removes the application from assigned devices.
10. Click Next.
11. Review the configuration, and then click Create.

Microsoft AutoUpdate MDM Distribution (MacOS)

You follow a structured approach based on the installer type to distribute the SASE client to macOS devices using Microsoft Intune (MDM). The SASE vendor can provide a .pkg installer or required configuration profiles.

To deploy a SASE client, you do the following:

1. Log in to the Microsoft Intune admin center.
2. In the Microsoft Intune admin center, select Apps > macOS, and then click + Create.
3. In App type, select macOS app (PKG), and then click Select.
4. Click Select app package file.
5. Select the package (.pkg) file provided by Versa Networks, and then click OK.
6. In App Information, enter information for the following fields.
   
   

   Field	Description
   Select file	Displays the name of the uploaded .pkg file.
   Name	Enter a name for the application.
   Description	Enter a short description of the application.
   Publisher	Enter the publisher name, for example, Versa Networks.
   Category	Select a category for the application, for example, Other Apps.
   Information URL	Enter a valid URL for a page that contains information about the application.
   Privacy URL	Enter a valid URL for a page that contains privacy information for the application.
   Developer	Enter the name of the developer.
   Owner	Enter the name of the owner.
   Notes	Enter any additional notes about the application.
   Logo	Click Select image to upload a logo for the application.

7. Click Next.
8. In Program, enter the pre-install and post-install scripts.
   • Pre-install script—Copy and paste the following script into the Pre-install script field. This script removes any existing Versa SASE installation before the new package is installed.

     #!/bin/sh
     echo "Cleanup Log: Removing Sase Main App"
     VersaApp='/Applications/Versa SASE Client.app'
     if [ -d "$VersaApp" ]; then
     rm -rf '/Applications/Versa SASE Client.app'
     fi
     echo "Cleanup Log: Removing versa.conf file"
     rm -rf /private/var/conf/versa/*
     
     echo "Cleanup Log: Removing from /etc/versa.conf file"
     rm -rf /private/var/conf/
     
     echo "Cleanup Log: Removing versa Log files"
     rm -rf /private/var/log/versa/
     
     echo "Cleanup Log: Removing versa Software files"
     rm -rf /private/var/versa/
     
     echo "Cleanup Log: Removing NewSyslog Software files"
     grep -v "private/var/log/versa/" /etc/newsyslog.conf > /tmp/tnewsyslog
     mv /tmp/tnewsyslog /etc/newsyslog.conf
     
     echo "Cleanup Log: Removing Files from /Users/Shared Folder"
     rm -rf /Users/Shared/EIP/
     rm -rf /Users/Shared/TrustedConnection.png
     rm -rf /Users/Shared/versa.png
     rm -rf /Users/Shared/sentinelOne.sh
     rm -rf waDiagnose*
     
     echo "Cleanup Log: Unloading LaunchDaemeons Files"
     launchctl unload /Library/LaunchDaemons/com.versa.*
     rm -rf /Library/LaunchDaemons/com.versa.*
     
     echo "Cleanup Log: Unloading LaunchAgents Files"
     launchctl unload /Library/LaunchAgents/com.versa.*
     rm -rf /Library/LaunchAgents/com.versa.*
     
     echo "Cleanup Log: Unloading preferences Files"
     rm -rf ~/Library/Preferences/com.versa.*
     
     echo "Cleanup Log: Killing Versa Sase Client related process."
     kill -9 $(pgrep SaseClientWebsockets)
     kill -9 $(pgrep VSATrayApp)
     kill -9 $(pgrep Versa Sase Client)

   • Post-install script—Copy and paste the following script into the Post-install script field. This script sets the required permissions after installation.

     #!/bin/sh
     a=1
     while [ $a -le 5 ]
     do
     VersaApp='/Applications/Versa SASE Client.app'
     if [ -d "$VersaApp" ]; then
     kill -9 $(pgrep VSATrayApp) $(pgrep 'Versa SASE Client') $(pgrep 'SaseClientWebsockets') 2>/dev/null
     sleep 2
     open '/Applications/Versa SASE Client.app/Contents/VSATrayApp.app'
     echo "Restarted Versa SASE Client successfully."
     break # Exit the loop on success
     fi
     sleep $((a * 10))
     a=$((a + 1))
     done

9. In Requirements, select the minimum macOS version required in the Minimum operating system field.
   
   
10. In Detection rules, enter information for the following fields:
     

    Field	Description
    Ignore app version	Select No.
    App Bundle ID (CFBundleIdentifier)	Enter the following value: com.versa.systemextension
    App Version (CFBundleShortVersionString)	Select 7.67.

11. Click Next.
12. In Assignments, add the required groups.
13. In Review + create, review the settings.
14. Click Create to finalize.
15. Upload the profile to enable auto-download, or configure it manually using the following sample profile (save the file with a .mobileconfig extension, for example, settings.mobileconfig).

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
    "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadIdentifier</key>
        <string>com.versa.vpn.config.profile</string>
        <key>PayloadUUID</key>
        <string>11111111-2222-3333-4444-555555555555</string>
        <key>PayloadDisplayName</key>
        <string>Versa VPN Config Profile</string>
        <key>PayloadDescription</key>
        <string>Custom configuration for Versa VPN client</string>
        <key>PayloadOrganization</key>
        <string>Versa Networks</string>
        <key>PayloadRemovalDisallowed</key>
        <false/>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>PayloadType</key>
                <string>com.versa.vpn.profile</string>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>PayloadIdentifier</key>
                <string>com.versa.vpn.profile.config</string>
                <key>PayloadUUID</key>
                <string>66666666-7777-8888-9999-000000000000</string>
                <key>PayloadDisplayName</key>
                <string>Versa SaSe Config</string>
    
                <!-- Managed App Config Keys -->
                <key>device_id</key>
                <string>{{UDID}}</string>
                <key>device_name</key>
                <string>{{DeviceName}}</string>
                <key>fqdn</key>
                <string>vpn.versa-networks.com</string>
                <key>enterprise_name</key>
                <string>Versa Networks</string>
                <key>user_id</key>
                <string>{{UserPrincipalName}}</string>
            </dict>
    
            <dict>
                <key>PayloadType</key>
                <string>com.apple.security.generic</string>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>PayloadIdentifier</key>
                <string>com.versa.vpn.keychain.password</string>
                <key>PayloadUUID</key>
                <string>99999999-aaaa-bbbb-cccc-dddddddddddd</string>
                <key>PayloadDisplayName</key>
                <string>VPN Keychain Entry</string>
    
                <key>Account</key>
                <string>KEYCHAIN_PASSWORD_KEY</string>
                <key>Service</key>
                <string>com.versa.systemextension</string>
                <key>AccessControl</key>
                <array>
                <string>AllowAny</string> <!-- or AllowSigned, or UseDevicePasscode -->
                </array>
            </dict>
    
        </array>
    </dict>
    </plist>
    
    
    

Verification

After the deployment policies have run, you can verify a successful onboarding:

• In Microsoft Intune:
  • MacOS:
    • Go to Devices > macOS > Configuration profiles > [policy name] > Device and user check-in status.
    • Confirm that the status displays Succeeded.
  • IOS:
    • Go to Apps > App configuration policies > [policy name] > Monitor > Device install status.
    • Confirm that the status displays Succeeded.

• On the device:
  • MacOS:
    • Check /Library/Managed Preferences/com.versa.versasase.plist to verify that the tokens are replaced with actual values.
  • IOS:
    • Launch the app.
    • Confirm that the app bypasses the initial setup screen and that the Enterprise Name and User ID fields are pre-populated.
    • If the fields are not pre-populated, go to Settings > VPN & Device Management and confirm that the configuration profile is listed and installed.