Support Tip: Install Rosetta 2 on new Apple Silicon (M1) Macs to run apps built for Intel Macs

Published 01-22-2021 09:37 AM 18.1K Views

3/30 Update: In the March (2103) service release, when you deploy shell scripts or custom attributes for macOS devices from Microsoft Endpoint Manager, it will deploy the new universal version of the Intune management agent app that runs natively on Apple Silicon Mac machines. To learn more see: Intune management agent for macOS devices is now a universal app.

 

Apple recently announced Apple Silicon Macs. These devices run on 64-bit ARM (RISC) CPUs relative to the previous generation of Macs that ran on Intel CPUs. Apple also announced a translation layer called Rosetta 2 that allows apps built for Intel Macs to run on the new Apple Silicon Macs.

 

Intune apps on macOS such as Intune Company Portal and the Intune MDM agent depend on the Rosetta 2 translation layer for managing Apple Silicon Macs. If you purchase a new Apple Silicon Mac running macOS 11.x (Big Sur), Rosetta 2 does not come pre-installed and the end-user is prompted by macOS to install it on first launch of an Intel-based application.

 

macOS installation prompt for RosettamacOS installation prompt for Rosetta

 

If you are upgrading to macOS 11 on Intel Macs, this is not an issue.

 

Additional scenario to consider - Apple Silicon (M1) Macs fail to run shell scripts when enrolled via Apple Automated Device Enrollment (ADE)

In this scenario, the device gets enrolled into Intune using macOS Setup Assistant. If you have configured shell scripts for these Macs, the Intune MDM agent is automatically installed on the Mac. However, the Intune MDM agent cannot start because Rosetta 2 is not installed. macOS 11 does not prompt the end user to install Rosetta 2 in this case.

 

If you are enrolling your Apple Silicon Macs using Company Portal, you will be prompted to install Rosetta 2 on first launch of Company Portal.

 

Recommendation

Install Rosetta 2 on Apple Silicon Macs to ensure app compatibility with Intel-based apps using one of the following steps:

  • Recommend users to install Rosetta 2 manually by launching any installed Intel-based app on the Apple Silicon Mac.

  • Recommend users to open Terminal and run the following command or provide a script that runs this command to users:

    • /usr/sbin/softwareupdate --install-rosetta (root permission not required)
    • /usr/sbin/softwareupdate --install-rosetta --agree-to-license (root permission required)

 

Let us know if you have any additional questions on this by replying back to this post or tagging @IntuneSuppTeam out on Twitter.

 

Blog post updates:

3/3: We appreciate all the customer feedback and are excited to announce that the Intune management agent for macOS devices will be a universal app.

3/30: With the March (2103) service release - The Intune management agent for macOS devices is now a universal app.

13 Comments
Senior Member

Dear @Intune Support Team ,

 

your post unfortunately describes the chicken-and-egg situation at it's best.

 

The problem on ADE enrolled devices is the worst one for those who rely on it (as I do).

As you mentioned, not even scripts are executed because the Intune MDM Agent is still as intel binary only available (may I ask why?).

 

So, what I'm currently trying to do is to develop an App which does just call a script which executes your already mentioned

/usr/sbin/softwareupdate --install-rosetta --agree-to-license 

command. 

I created an app few weeks ago, signed it (with an apple developer id) and also notarized it to make it compliant with gatekeeper. In a test locally it worked as expected: But on a freshly enrolled device it does not get installed due to some weird certificate resolving issues. I have to dig deeper into it.

Is there any release plan for the Intune MDM Agent as an universal binary at least? This would make administrator life with the new M1 so much easier.

 

Senior Member

Dear @Intune Support Team 

 

another idea:

Why don't you just provide an officially signed app which just calls the Rosetta install script? At least as an interims solution.

This would make a lot of people happy.

 

Senior Member

Dear @Intune Support Team,

 

What is the ETA for the native Intune agent?

This situation makes ADE unusable for these devices.

 

Senior Member

@Geert-Jan Schroot just to be precise: you mean the universal binary (not native) we need. Which runs native on both, Intel and Silicon

Senior Member

Exactly. So ADE will work right out of the box.

Occasional Visitor

I agree, @Intune Support Team please help us with a solution for this one.

Hi @matwa@Geert-Jan Schroot@tobiassandberg, thank you all for the feedback! We are actively working on a solution, though no dates to currently share. Stay tuned to this post and our In development docs for future updates.

Senior Member

@Intune Support Team 

Sorry, it‘s a shame. Again 3 weeks passed by. Nothing new.  Nearly 4 month since release of silicon macs and still no native support in enrollment. This is becoming a no go. 
We‘ll switch to Jamf. The only ones who really provide zero day support. 

Hi @matwa, thanks for your feedback and sharing your experience. We're excited to announce that coming in the March (2103) service release, when you deploy shell scripts or custom attributes for macOS devices from Microsoft Endpoint Manager, it will deploy the new universal version of the Intune management agent app that runs natively on Apple Silicon Mac machines. For more information, see our In development doc here. We'll also keep this post updated once the feature is available across all tenants.

 

CC: @Geert-Jan Schroot@tobiassandberg.

 

Thanks again for the feedback!

Senior Member

Ouhhh! Wow. Great news. I'll do a table dance if this becomes reality. 

Occasional Visitor

Do we think this will still be completed in March @Intune Support Team?

Occasional Visitor

@Intune Support Team since the feature didn't release in March (2103) service release, will it be available in the next one, or what it the status?

Hi @matwa@Geert-Jan Schroot@tobiassandberg@Zorty - Thanks for your patience. We're excited to announce that the Intune management agent for macOS devices is now a universal app is now available with the March (2103) release! See our What's new in Microsoft Intune | Week of March 29, 2021 (Service release 2103) and Microsoft Intune management agent for macOS docs to learn more.

%3CLINGO-SUB%20id%3D%22lingo-sub-2087631%22%20slang%3D%22en-US%22%3ESupport%20Tip%3A%20Install%20Rosetta%202%20on%20new%20Apple%20Silicon%20(M1)%20Macs%20to%20run%20apps%20built%20for%20Intel%20Macs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2087631%22%20slang%3D%22en-US%22%3E%3CP%3EApple%20recently%20announced%20Apple%20Silicon%20Macs.%20These%20devices%20run%20on%2064-bit%20ARM%20(RISC)%20CPUs%20relative%20to%20the%20previous%20generation%20of%20Macs%20that%20ran%20on%20Intel%20CPUs.%20Apple%20also%20announced%20a%20translation%20layer%20called%20Rosetta%202%20that%20allows%20apps%20built%20for%20Intel%20Macs%20to%20run%20on%20the%20new%20Apple%20Silicon%20Macs.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIntune%20apps%20on%20macOS%20such%20as%20Intune%20Company%20Portal%20and%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fmem%2Fintune%2Fapps%2Fmacos-shell-scripts%23microsoft-intune-management-agent-for-macos%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EIntune%20MDM%20agent%3C%2FA%3E%20depend%20on%20the%20Rosetta%202%20translation%20layer%20for%20managing%20Apple%20Silicon%20Macs.%20If%20you%20purchase%20a%20new%20Apple%20Silicon%20Mac%20running%20macOS%2011.x%20(Big%20Sur)%2C%20Rosetta%202%20does%20not%20come%20pre-installed%20and%20the%20end-user%20is%20prompted%20by%20macOS%20to%20install%20it%20on%20first%20launch%20of%20an%20Intel-based%20application.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Rosetta-macOS.png%22%20style%3D%22width%3A%20480px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F248569i367C0410918F6654%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Rosetta-macOS.png%22%20alt%3D%22macOS%20installation%20prompt%20for%20Rosetta%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EmacOS%20installation%20prompt%20for%20Rosetta%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20are%20upgrading%20to%20macOS%2011%20on%20Intel%20Macs%2C%20this%20is%20not%20an%20issue.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--549989096%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549987363%22%20id%3D%22toc-hId--549989289%22%3E%3CFONT%20size%3D%223%22%3EAdditional%20scenario%20to%20consider%20-%20Apple%20Silicon%20(M1)%20Macs%20fail%20to%20run%20shell%20scripts%20when%20enrolled%20via%26nbsp%3BApple%20Automated%20Device%20Enrollment%20(ADE)%3C%2FFONT%3E%3C%2FH2%3E%0A%3CP%3EIn%20this%20scenario%2C%20the%20device%20gets%20enrolled%20into%20Intune%20using%20macOS%20Setup%20Assistant.%20If%20you%20have%20configured%20shell%20scripts%20for%20these%20Macs%2C%20the%20Intune%20MDM%20agent%20is%20automatically%20installed%20on%20the%20Mac.%20However%2C%20the%20Intune%20MDM%20agent%20cannot%20start%20because%20Rosetta%202%20is%20not%20installed.%20macOS%2011%20does%20not%20prompt%20the%20end%20user%20to%20install%20Rosetta%202%20in%20this%20case.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20are%20enrolling%20your%20Apple%20Silicon%20Macs%20using%20Company%20Portal%2C%20you%20will%20be%20prompted%20to%20install%20Rosetta%202%20on%20first%20launch%20of%20Company%20Portal.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-140572378%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140574111%22%20id%3D%22toc-hId-140572185%22%3E%3CFONT%20size%3D%223%22%3E%3CSPAN%3ERecommendation%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FH3%3E%0A%3CP%3E%3CSPAN%3EInstall%20Rosetta%202%20on%20Apple%20Silicon%20Macs%20to%20ensure%20app%20compatibility%20with%20Intel-based%20apps%20using%20one%20of%20the%20following%20steps%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CP%3ERecommend%20users%20to%20install%20Rosetta%202%20manually%20by%20launching%20any%20installed%20Intel-based%20app%20on%20the%20Apple%20Silicon%20Mac.%3C%2FP%3E%0A%3C%2FLI%3E%0A%3CLI%3E%3CP%3ERecommend%20users%20to%20open%20Terminal%20and%20run%20the%20following%20command%20or%20provide%20a%20script%20that%20runs%20this%20command%20to%20users%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3E%2Fusr%2Fsbin%2Fsoftwareupdate%20--install-rosetta%20(root%20permission%20not%20required)%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3E%2Fusr%2Fsbin%2Fsoftwareupdate%20--install-rosetta%20--agree-to-license%20(root%20permission%20required)%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELet%20us%20know%20if%20you%20have%20any%20additional%20questions%20on%20this%20by%20replying%20back%20to%20this%20post%20or%20tagging%20%3CA%20href%3D%22https%3A%2F%2Faka.ms%2FIntuneSuppTeam%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%40IntuneSuppTeam%3C%2FA%3E%20out%20on%20Twitter.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2087631%22%20slang%3D%22en-US%22%3E%3CP%3ERead%20this%20post%20to%20learn%20more%20about%20installing%20Rosetta%202%26nbsp%3Bon%20new%20Apple%20Silicon%20(M1)%20Macs%20to%20run%20apps%20built%20for%20Intel%20Macs%20for%20Microsoft%20Endpoint%20Manager%20-%20Intune%20management.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2087631%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%20Support%20Tip%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ERosetta%202%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESupport%20Tip%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2091974%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%3A%20Install%20Rosetta%202%20on%20new%20Apple%20Silicon%20(M1)%20Macs%20to%20run%20apps%20built%20for%20Intel%20Macs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2091974%22%20slang%3D%22en-US%22%3E%3CP%3EDear%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F226779%22%20target%3D%22_blank%22%3E%40Intune%20Support%20Team%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eyour%20post%20unfortunately%20describes%20the%20chicken-and-egg%20situation%20at%20it's%20best.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20problem%20on%20ADE%20enrolled%20devices%20is%20the%20worst%20one%20for%20those%20who%20rely%20on%20it%20(as%20I%20do).%3C%2FP%3E%3CP%3EAs%20you%20mentioned%2C%20not%20even%20scripts%20are%20executed%20because%20the%20Intune%20MDM%20Agent%20is%20still%20as%20intel%20binary%20only%20available%20(may%20I%20ask%20why%3F).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%2C%20what%20I'm%20currently%20trying%20to%20do%20is%20to%20develop%20an%20App%20which%20does%20just%20call%20a%20script%20which%20executes%20your%20already%20mentioned%3C%2FP%3E%3CPRE%3E%2Fusr%2Fsbin%2Fsoftwareupdate%20--install-rosetta%20--agree-to-license%20%3C%2FPRE%3E%3CP%3Ecommand.%26nbsp%3B%3C%2FP%3E%3CP%3EI%20created%20an%20app%20few%20weeks%20ago%2C%20signed%20it%20(with%20an%20apple%20developer%20id)%20and%20also%20notarized%20it%20to%20make%20it%20compliant%20with%20gatekeeper.%20In%20a%20test%20locally%20it%20worked%20as%20expected%3A%20But%20on%20a%20freshly%20enrolled%20device%20it%20does%20not%20get%20installed%20due%20to%20some%20weird%20certificate%20resolving%20issues.%20I%20have%20to%20dig%20deeper%20into%20it.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CP%3EIs%20there%20any%20release%20plan%20for%20the%20Intune%20MDM%20Agent%20as%20an%20universal%20binary%20at%20least%3F%20This%20would%20make%20administrator%20life%20with%20the%20new%20M1%20so%20much%20easier.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2090760%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%3A%20Install%20Rosetta%202%20on%20new%20Apple%20Silicon%20(M1)%20Macs%20to%20run%20apps%20built%20for%20Intel%20Macs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2090760%22%20slang%3D%22en-US%22%3E%3CP%3E%3CDELETED%3E%3C%2FDELETED%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎Mar 30 2021 06:07 PM
Updated by: