Purpose

This guide explains how to deploy Cisco Secure Client (AnyConnect) to macOS devices using Microsoft Intune, including the required configuration profiles for system extensions, managed login items, and kernel/network extensions.

Cisco Secure Client requires additional configuration compared to standard macOS PKG or DMG apps due to:

System extension approval
Code‑signing requirements
Background services (login items)

Without these configurations, the client may install but not function correctly.

Scope

Applies to

macOS devices managed by Microsoft Intune
Cisco Secure Client (AnyConnect) 5.x

Out of scope

VPN profile configuration
Certificates / authentication
Post‑connect compliance or posture

Prerequisites

You need:

A file extraction tool
- Windows: 7‑Zip
- macOS: Built‑in Archive Utility or unzip (Cisco WebDeploy PKG is a ZIP file)
Access to Microsoft Intune
Permission to create macOS apps and configuration profiles
Access to Cisco downloads

Cisco Secure Client 5 for macOS

Step 1 – Download Cisco Secure Client

Sign in to https://cisco.com.

Navigate to:

Support → Products and Downloads → Secure Client → Secure Client 5

Select macOS

Download:

cisco-secure-client-macos-{latest version}-webdeploy-k9.pkg

Accept the terms and save the file.

Step 2 – Extract the Core VPN Installer

Cisco’s WebDeploy package contains multiple components.
Only the Core VPN PKG is required.

Windows (7‑Zip)

Right‑click the downloaded PKG → Extract
Navigate to:

/binaries/

Open:

Cisco Secure Client macOS <version> Core VPN WebDeploy.dmg

Open:

Cisco Secure Client AnyConnect VPN <version>

Locate the PKG file
Move it to a known location (for example Documents)

This PKG will be uploaded to Intune later.

macOS (Optional – if extracting on a Mac)

Note: Cisco “WebDeploy” .pkg files are ZIP archives on macOS and cannot be opened with pkgutil.

Option A – Finder (GUI)

Right‑click the downloaded PKG
Select Open With → Archive Utility
A folder will be created next to the file

Option B – Terminal (recommended)

Shell

unzip Cisco_Secure_Client_macOS_<version>_WebDeploy

Show more lines

Then:

Navigate to:

/binaries/

Open:

Cisco Secure Client macOS <version> Core VPN WebDeploy.dmg

Open:

Cisco Secure Client AnyConnect VPN <version>

Locate the PKG file
Move it to a known location (for example Documents)

This PKG will be uploaded to Intune later.

Step 3 – Configuration Profile: System Extensions

Intune path

Devices → macOS → Configuration → Create profile
Profile type: Settings catalog

Profile name

Cisco VPN – System Extensions

Settings

Allowed system extension types

Type: Network Extensions
Team Identifier: D8Y96K9QP

Allowed system extensions

Bundle Identifier: com.cisco.anyconnect.macos.acsockext
Team Identifier: DE8Y96K9QP

Assignments

Assign to a macOS pilot group.

Intune path

Devices → macOS → Configuration → Create profile
Profile type: Settings catalog

Profile name

Cisco VPN – Managed Login Items

Settings path

Service Management → Login Items → Managed Login Items

Rule

Comment: Cisco Secure Client
Rule type: Team Identifier
Rule value: DE8Y96K9QP

Assign to the same pilot group.

Step 5 – Configuration Profile: Kernel & System Extensions (Custom XML)

Open the Cisco Secure Client Administrator Guide
Copy the macOS system & kernel extension approval XML
Paste it into a text editor
Save as:

secure-client.mobileconfig

Upload to Intune

Devices → macOS → Configuration → Create profile
Profile type: Templates → Custom

Upload secure-client.mobileconfig and assign to the pilot group.

Step 6 – Deploy the Application

Intune path

Apps → macOS → Add → macOS PKG

App info

Name: Cisco Secure Client 5.x
Publisher: Cisco
Minimum OS: macOS Sonoma

Assignment

Required
Pilot group

Step 7 – Sync and Validate

Open Company Portal on the Mac
Trigger a sync

Confirm:

All three configuration profiles apply
Cisco Secure Client installs

Validation

System Settings shows Cisco extensions approved
Login items are managed
Cisco Secure Client connects successfully

Result

Cisco Secure Client is now:

Installed via Intune
System extensions pre‑approved
Login items managed
Fully MDM‑owned

potential visual indicators for the end user :

Defender on macos