Install Level on Linux via Intune
If your Linux desktops are enrolled in Microsoft Intune, you can push the Level agent to them with a Bash platform script. This is the whole method: there's no package to upload and no profile to build.
Intune manages Linux differently from Windows and macOS. It has no app deployment for Linux and no configuration profiles, so the PKG app and PPPC steps from the macOS guide don't apply here. What Intune does give you on Linux is the ability to run a Bash script on a schedule, and Level installs from a single command, so the two line up cleanly.
ℹ️ NOTE: This method covers Intune-managed Linux desktops only. Intune doesn't manage Linux servers. For servers, use Level's one-line install directly or your configuration management tooling. See Linux Install.
⚙️ PREREQUISITES
Linux desktops enrolled in Intune. Intune supports Ubuntu Desktop 24.04 LTS or 26.04 LTS and Red Hat Enterprise Linux 8 or 9, on x86-64 hardware, as corporate-owned devices. For enrollment steps, see Microsoft's Enroll Linux desktop devices guide.
Access to the Microsoft Intune admin center
A Level account with permission to add devices
The Level install command for the group you want devices to land in (get it from Add new device → Linux in Level)
⚠️ WARNING: Intune-managed Linux is x86-64 only. Level runs on ARM64 Linux, but Intune won't enroll or manage those devices, so this method can't reach them. Install Level on ARM Linux directly instead.
Step 1: Get the Level install command
In Level, open the Device Listing and click Add new device.
Select Linux from the operating system dropdown.
On the One-line command tab, optionally select a device group so the install key includes the group ID.
Copy the generated command.
The command is a curl one-liner that downloads the agent, detects the architecture, and registers the device with your account. The install key in the command determines which account (and optionally which group) the device joins.
Step 2: Save the command as a Bash script
Paste the command into a new file and save it with a .sh extension. Intune only accepts .sh files for Linux platform scripts.
Add a guard so the script is a clean no-op once the agent is installed. Intune re-runs Linux scripts on a schedule (see Step 3), so you want repeat runs to exit quietly rather than reinstall:
#!/bin/bash
# Exit cleanly if Level is already installed
if [ -x /usr/local/bin/level ]; then
echo "Level already installed"
exit 0
fi
# Paste your Level install command below
# Get it from: Level → Add new device → Linux → One-line command
💡 TIP: Level's installer already exits if it detects an existing install, so re-runs are harmless even without the guard. The guard just keeps your logs clean and avoids the installer doing unnecessary work every cycle.
Step 3: Create the platform script in Intune
Sign in to the Microsoft Intune admin center.
Go to Devices → Linux → Scripts (or Devices → Manage devices → Scripts and remediations → Platform scripts), then click Add → Linux.
Give the script a Name (for example, "Install Level Agent") and click Next.
Under Configuration settings, set:
Execution context: Root. Level's install needs elevated privileges. Root runs the script at the device level whether or not a user is signed in. The User context only runs when someone logs in, which won't reliably reach unattended machines.
Execution frequency: the shortest useful interval. The default is every 15 minutes.
Execution retries: optional, for transient failures.
Use the file picker to upload your
.shfile. Click Next.
⚠️ WARNING: Intune has no true "run once" option for Linux scripts. The longest interval is weekly, and the default is every 15 minutes, so your script will run repeatedly. This is why the guard in Step 2 matters.
Step 4: Assign the script
On the Scope tags page, optionally add a tag, then click Next.
On the Assignments page, select the groups that should receive the agent. Click Next.
Review and click Create.
The script runs on the next sync for the assigned devices. First check-in timing varies, so allow some time before the devices appear in Level.
Step 5: Confirm enrollment
Wait for the assigned devices to sync (or trigger a sync from the Intune app on a test device).
Confirm the device appears in your Level Device Listing.
In the Intune admin center, the script's device status shows success or failure per device.
ℹ️ NOTE: If a device installs but never shows up in Level, check that the install key is current and that no security tooling blocked the agent. See Offline Troubleshooting and AV/EDR False Detections.
What you don't need on Linux
If you've seen the macOS guide, two of its steps have no Linux equivalent:
No privacy profile. Linux has nothing like macOS's TCC permissions, so there's no PPPC profile to deploy. The agent has what it needs once it's installed as root.
No service account. The macOS service account exists to unlock FileVault for patch management on Apple Silicon. Linux patching runs through the native package manager and systemd, so there's no equivalent account to create.
FAQ
Do I really have to run it as Root? Yes. Installing the agent needs elevated privileges, and the User context only runs when someone signs in, so it won't reach unattended or headless-login machines. Set the execution context to Root.
Won't this reinstall Level every 15 minutes? No. Level's installer exits if the agent is already present, and the guard in the sample script exits before the install command even runs. The script re-runs on schedule, but after the first successful install it does nothing but log a line and exit.
My root-context script isn't running at all. What's going on? There's a known issue where root-context Linux scripts fail to execute silently on some recent Ubuntu builds and Intune agent versions, while user-context scripts run fine. If your script never runs and produces no logs, check that your Intune Linux agent is current, test the same script manually on the device to confirm it works, and watch Microsoft's Linux platform script guidance for updates. This is on Microsoft's side, not Level's.
Which distros does this work on? Whatever Intune can enroll: Ubuntu Desktop 24.04/26.04 LTS and RHEL 8/9 on x86-64. Level itself runs on more Linux distributions than that, but this method is capped by what Intune manages.
Can I use this for Linux servers? No. Intune manages Linux desktops, not servers. For servers, run Level's one-line install directly or push it through your configuration management tooling.
Can I target specific groups instead of all devices? Yes. Assign the script to specific Entra ID groups on the Assignments page. To land devices in different Level groups, generate a separate install command per group and create a separate script per group.
The device enrolled in Intune but Level shows nothing. Where do I look first? Confirm the script actually executed (check its per-device status in Intune), then confirm the install key is current. If both look right, check whether an AV/EDR tool quarantined the agent.