macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes

Intune can deploy macOS software three ways: line-of-business (LOB) PKG, unmanaged PKG and DMG. Each has its own package rules, delivery channel and detection logic, and most failures come from mixing them up. In this post I'll map the documented error codes to fixes, show where the Intune management agent logs, and explain why an app that is clearly installed can still show as failed.

Symptoms#

• For a DMG or unmanaged PKG app, Device install status shows one of these (the report sometimes shows only the code; refresh the browser to get the text):

0x87D30137 The device doesn't meet the minimum OS requirement set by the admin.
2016214710 The preinstall script provided by the admin failed.
0x87D3013E The DMG file doesn't contain any supported app.
0x87D30139 The DMG file couldn't be mounted for installation.
0x87D3013B The app couldn't be installed to the Applications directory.
0x87D30131 The app couldn't be downloaded.
0x87D30135 The app couldn't be installed due to a device error.
0x87D3013A The physical resources of this disk have been exhausted.
0x87D3012F The app couldn't be installed due to an internal error.

• The app is in /Applications, but Intune reports a failure or keeps reinstalling it.
• Company Portal shows Pending after a successful install of an Available app (a known issue; the admin center report is correct).

Why it happens#

Three app types, three rule sets#

A payload-free package deployed as LOB keeps trying to reinstall for as long as it stays assigned, and a PKG that only installs interactively will fail under Intune. Microsoft's prerequisite for unmanaged PKGs is simple: the file must install with the installer command in Terminal.

Detection is the Included apps list#

Intune decides success from the bundle IDs and versions (CFBundleIdentifier, CFBundleShortVersionString) in Included apps. Every listed app must be found, so a helper or library that isn't a real app in the list means the install never reports success; the first entry is the one shown in reports. With Ignore app version set to No, an app that updates itself no longer matches the uploaded version, and Intune tries to install it again.

The agent has its own schedule#

DMG and unmanaged PKG apps depend on the Intune management agent at /Library/Intune/Microsoft Intune Agent.app. It checks in about every 8 hours, separately from MDM, and Sync in the admin center triggers only an MDM check-in. Failed installs are retried at the next agent check-in, up to three times.

How to fix it#

1. Match the code.

   Code	Fix
   0x87D30137	Update macOS, or lower the app's Minimum operating system if the vendor supports older versions.
   2016214710	The pre-install script returned non-zero, so the install was skipped. That can be intentional (waiting for a condition); otherwise run the script by hand. Scripts must stay under 15,360 characters and need agent 2309.007 or later.
   0x87D3013E	The DMG holds no .app. Repackage it, or deploy an installer package as a PKG app instead.
   0x87D30139	Mount it by hand. Anything interactive, such as a licence or password prompt, is a red flag for an unattended install.
   0x87D3013B, 0x87D30135, 0x87D3013A	Free disk space and make sure /Applications is writable. Updating or removing DMG apps needs the Full Disk Access permission, which Intune requests on macOS 13 and later. For 0x87D3013A, restart the agent, and re-upload in case the file is corrupt.
   0x87D30131, 0x87D30132	Download failed: check the network path for large files, then sync to retry.
   0x87D3012F and other internal errors	Install manually to rule out the package, then recreate the Intune app; contact support if it persists.

2. Check the agent and force a check-in. Ask the user to open Company Portal, select the Mac and choose Check status, or restart the agent, which checks in straight away:
   Bash

   ls -d "/Library/Intune/Microsoft Intune Agent.app"
   pgrep -l IntuneMdmAgent
   sudo killall IntuneMdmAgent
   tail -f /Library/Logs/Microsoft/Intune/IntuneMDMDaemon*.log /var/log/install.log

   Microsoft names two agent logs: IntuneMDMDaemon date--time.log in /Library/Logs/Microsoft/Intune and the per-user IntuneMDMAgent date--time.log in ~/Library/Logs/Microsoft/Intune. Admins usually find app install activity in the system-level daemon log, so search it for the app name or bundle ID first. /var/log/install.log carries the macOS installer's own messages. If the agent is missing, assigning any shell script to the Mac gets it installed (see macOS shell scripts not running).
3. Test the package outside Intune:
   Bash

   sudo installer -pkg ~/Downloads/App.pkg -target /
   pkgutil --check-signature ~/Downloads/App.pkg
   hdiutil attach ~/Downloads/App.dmg -nobrowse
   defaults read /Applications/App.app/Contents/Info CFBundleIdentifier
   defaults read /Applications/App.app/Contents/Info CFBundleShortVersionString

   For LOB, pkgutil --check-signature must show a Developer ID Installer certificate. Unsigned, payload-free or script-heavy packages belong in the unmanaged PKG type.
4. Fix detection. Edit Included apps so it lists only real apps with the values from defaults read, parent app first. Set Ignore app version to Yes for apps with their own updater.
5. Ship updates correctly. A new LOB version needs a higher CFBundleShortVersionString. A DMG update keeps the same bundle ID and needs agent 2304.039 or later; Available DMG apps update only when the user selects Reinstall in Company Portal, while a new unmanaged PKG version installs without user action.

Verify the fix#

• Device install status shows Installed for the Mac (if Company Portal still says Pending, have the user select Check status).
• defaults read returns the bundle ID and version you listed in Included apps.
• The daemon log shows the install completing, without a retry on the next agent check-in.

Prevent it next time#

• Run every package through installer and pkgutil --check-signature before uploading, and pick the app type from the rules above.
• Keep one app per DMG unless the apps depend on each other; one failure makes the whole DMG count as failed.
• Post-install script failures aren't reported, so log to a file from the script.
• Agent-deployed apps stay on the Mac after a retire; remove them first if that matters. For quick code lookups, see the app install error codes quick reference.

References#

• Add an unmanaged macOS PKG app to Microsoft Intune
• Add a macOS DMG app to Microsoft Intune
• How to add macOS line-of-business (LOB) apps to Microsoft Intune
• Microsoft Intune management agent for macOS