Skip to main content
Velatir for Desktop is a standard MSI (Windows) and PKG (macOS), so any MDM that deploys those works. One ingest key configures everything: no per-feature flags, no per-customer builds.

​
Build your install command

Generate an ingest key on the Setup tab of the Velatir dashboard. The same key works for every device.

​
Deploy with your MDM

  1. Go to Apps → All apps → Add, choose Line-of-business app, and upload the MSI from the builder above.
  2. Under App information → Command-line arguments, paste the Intune arguments from the builder.
  3. Assign to your device groups in Required mode. Intune handles elevation.
To rotate the key later, update the command-line arguments and redeploy.
  1. Upload the PKG from the builder under Packages and deploy it with a policy scoped to your Macs (Recurring Check-in, Once per computer).
  2. Add a configuration profile, scoped to the same Macs, with two payloads:
    • Application & Custom Settings → preference domain com.velatir.agent, key ApiKey set to your ingest key. This is the macOS equivalent of the MSI’s INGEST_KEY; update it later to rotate the key with no reinstall.
    • System Extensions → allow Team Identifier AA7QLU3S4R (Network Extension), so the agent activates with no end-user prompt.
  3. Add the two profiles in macOS notification profiles below, so the install is quiet and Velatir’s own alerts reach people.
Use the macOS app (PKG) app type, not Line-of-business app. Velatir installs a background agent under /Library and lays down a stable stub bundle at /Applications/Velatir.app at install time (the host payload then self-updates underneath). The line-of-business type cannot deploy or detect a package of that shape.
  1. Go to Apps → All apps → Create, choose the macOS platform, select macOS app (PKG), and upload the PKG from the builder above.
  2. On Detection rules, replace what Intune fills in automatically. Delete the com.velatir.agent.bootstrap entry from Included apps, add a single entry with bundle ID com.velatir.desktopapp, and set Ignore app version to Yes. Both parts matter. com.velatir.agent.bootstrap is the package identifier rather than an application, so Intune can never find it on a device. And Velatir updates itself, so the version on disk moves ahead of the version in the package within days, which a version check reads as the wrong app. Either one leaves the app permanently undetected, and a Required assignment then reinstalls Velatir at every device check-in. Apply this to one Mac first and confirm Intune reports that device as Installed before you assign it more widely.
  3. On Requirements, set the minimum operating system to macOS 13.0.
  4. Assign to your device groups in Required mode.
  5. In Devices → Configuration, add a Preference file profile scoped to the same devices, with preference domain com.velatir.agent and this property list:
    The key must be named ApiKey. INGEST_KEY is the Windows MSI property and has no effect in a configuration profile. Update this value later to rotate the key with no reinstall.
  6. Add a profile with a System Extensions payload allowing Team Identifier AA7QLU3S4R, so the agent activates with no end-user prompt.
  7. Add the two profiles in macOS notification profiles below, so the install is quiet and Velatir’s own alerts reach people.
Two things to settle before you assign it:
  • The Microsoft Intune management agent for macOS (2308.006 or later) must be on the devices — it is what runs the installer. Configuration profiles arrive over a different channel, so a profile that applies cleanly is no evidence that the app can install.
  • Velatir ships one package per architecture and no universal build. Add the Apple Silicon and Intel packages as two apps, each assigned to a group of matching devices.
Confirm a rollout with velatir status on a device, or from the Devices view in the dashboard, rather than from the Intune console alone. /Applications/Velatir.app is a real stub bundle with identifier com.velatir.desktopapp and is present as soon as the package finishes — it does not wait for the first check-in. Its version does not move with OTA updates, which is why Ignore app version stays required. See Intune reports the app state is unknown.
Any tool that runs msiexec (Windows) or installer (macOS) works: use the command from the builder above. For a Windows detection rule, check for the VelatirAgent service or the install path C:\Program Files\Velatir\.
macOS never installs a certificate through MDM: Velatir generates a unique CA on each device, so there is no shared root to distribute.

​
macOS notification profiles

macOS decides two things on its own when a new app lands on a Mac, and both are worth taking out of the user’s hands. Neither is required for Velatir to work. Together they are the difference between a rollout nobody notices and a rollout that generates support tickets on day one. Scope both profiles to the same Macs as the package, and let them arrive first. A profile that lands after the package still applies, but the background-items alert has already been shown by then.

​
Values to use

Matching on Team Identifier covers both background items and stays correct if Velatir adds one later. Match on the labels instead if your policy is to approve services individually.

​
Jamf Pro

1

Managed Login Items profile

Computers → Configuration profiles → New, level Computer Level. Select the Managed Login Items payload and add one rule: rule type Team Identifier, value AA7QLU3S4R.
2

Notifications profile

In the same or a second profile, select the Notifications payload and add an app entry:
3

Scope and deploy

Scope to the same Macs as the package policy, and confirm the profiles are installed before the package runs.
Alert, not Banner. Banners disappear after a few seconds. Alerts stay on screen until the person acknowledges them. When Velatir blocks a request, a banner the user was away from their desk for is a message that never arrived. Critical Alerts bypass Do Not Disturb and Focus. Reach for it only if a blocked request has to interrupt whatever someone is doing.

​
Microsoft Intune

Intune has no built-in editor for either payload, so upload them under Devices → Configuration → Create → macOS → Templates → Custom as .mobileconfig files. Assign to the same device groups as the app.
Replace both PayloadUUID values with fresh ones from uuidgen before uploading.
AlertType is 2 for a persistent alert, 1 for a banner, 0 for none.
The Managed Login Items payload needs macOS 13 or later and has to come from your MDM. macOS refuses it in a profile a user installs by hand, so keep it in its own file rather than combining it with profiles you also hand out to unmanaged Macs.

​
Turning Velatir’s own notifications down

The profiles above control what macOS allows. To change what Velatir sends, set ShouldMuteSystemNotifications to true in the com.velatir.agent preference domain. That silences update and lifecycle messages. Blocked-request alerts still appear, since suppressing those would leave people with no explanation for a blocked action.

​
Removing Velatir from a fleet

Change the assignment first, on either platform. While the app is still assigned as Required, Intune reinstalls it behind the removal and the devices look unchanged. Windows. Set the app assignment to Uninstall. If devices do not come off — the assignment reports a failure, or the app stays listed — deploy the cleanup script in Uninstall cleanup as an Intune remediation script running as SYSTEM. It needs no detection rule, so a rule that never matches cannot block the removal, and it reports leftovers through its exit code. macOS. The macOS app (PKG) app type has no Uninstall assignment, so remove the assignment instead. That stops Intune reinstalling Velatir but does not take it off the devices — run the bundled uninstaller as a shell script under Devices → Scripts, as root:
Devices need a restart to finish removing the system extension.

​
Reference

Windows. Redeploy with the new key in the command-line arguments. The host restarts and picks it up.macOS. Update the ApiKey value in the com.velatir.agent managed preference in your MDM. Devices apply it on the next check-in, with no reinstall.
Run velatir status --json as a Microsoft Intune Remediation or a Jamf Pro extension attribute. It reports client state, version, and the last trace timestamp, so you can spot drift across the fleet from your dashboard.
Velatir auto-updates by default. To coordinate updates with your own change-management process, contact support to enable a per-tenant update channel.
Supply your own certificate authority instead of the Velatir-issued one. See Bring your own certificate for the format, distribution, and rotation.

​
Next steps

Permissions

What the installer asks for on each platform.

Health checks

Monitor agent and capture health across the fleet.

VPN compatibility

Behaviour alongside corporate VPNs.

Troubleshooting

Diagnose failures during scaled rollouts.