Community

Articles in this section

Install Mac Agents with Jamf

  • Updated
Follow

Applies to Mac Agents
Article No: 28115273343767

If you use Jamf for Mac endpoint management, you can deploy the Veriato Mac Agent to endpoints via your Jamf console.

Note: For account-driven device enrollment method, Jamf requires endpoints to have Mac OS 14 (Sonoma) or later.

 

Set up the Jamf server and enroll devices

If you haven't already done so, set up your Jamf cloud server and enroll your Mac devices. For more help, see https://learn.jamf.com.

  1. Log into your Jamf cloud account. 
     Change the computer check-in time to a 5 minute interval to match the agent check-in interval. This ensures receiving Mac activity data as soon as possible.
  2. Use "Device Enrollment for Computers" to enroll Mac devices.
     Click Settings in the sidebar.
     In the Global section, click Edit and select the Devices tab.
     Check Enable for personally owned devices.
  3. Enroll a new computer.
     You can invite the user to initiate enrollment or log into the endpoint Mac with Admin credentials.
     Access the enrollment link yourself. For example:
    https://myaccount.jamfcloud.com.enroll
    a. Login to your Jamf account
       
    b. Leave "Assign to User" empty and press Enroll.
       
    c. To enroll a Mac in Jamf, install your MDM profile on the device. Press Continue.
       
    d. Select Allow to allow downloads from your account.
       
    e. Finally, run the downloaded package. A popup prompts you to continue in System Settings.
       
  4.  Open System Settings on the Mac to finish the profile installation.
     Open System Settings, select Privacy and Security in the left sidebar and Profiles on the right.
    a. Double click the MDM profile.
    b. Verify the signing certificate and press Install. You are prompted for the local admin password.
       
    c. Enter the local admin password to complete the installation.
  5. The MDM Profile now appears in the endpoint's profile lists.
     Eventually other installed Jamf profiles will appear.
  6. Log into your jamf cloud platform.
     For example: mycompany.jamfcloud.com
     The Mac device is now enrolled in Jamf and should appear in your Devices section.

Create a Configuration Profile for the Veriato Agent

The configuration profile will be used to install the Agent on devices. In your Jamf console:

  1. Navigate to Computers > Configuration Profiles. Press the New button.
  2. Add a name in the General options.
  3. Select Privacy Preferences Policy Control from the left menu.
  4. Click Configure.
     Identify, configure, and set the Mac Privacy permissions for each of the three following agent apps.
    a. Helpdesk.app
                      i.      Identifier: com.spsecure.Viewer
                      ii.     Code Requirement:  
                              identifier "com.spsecure.Viewer" and anchor apple generic and
                              certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and
                              certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */
                              and certificate leaf[subject.OU] = "94L7REHXB6"
                      iii.    Local System Permissions needed to run
                                      1.   Accessibility
                                      2.   Full Disk Access (System Policy All Files)
                                      3.   Screen Recording
                                      4.   Open at Login
                                      5.   Allow in the Background
    b. Agent.app
                      i.      Identifier: com.spsecure.useragent
                      ii.     Code Requirement:
                              identifier "com.spsecure.useragent" and anchor apple generic and
                              certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and
                              certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */
                              and certificate leaf[subject.OU] = "94L7REHXB6"
                      iii.     Local System Permissions needed to run: 
                                       1.   Accessibility
                                       2.   Full Disk Access (System Policy All Files)
                                       3.   Screen Recording
                                       4.   Open at Login
                                       5.   Allow in the Background
    c. spsecure
                    i.       Identifier: com.spectorsoft.Recorder
                    ii.      Code Requirement:
                             anchor apple generic and identifier "com.spectorsoft.Recorder" and
                             (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or
                             certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and
                             certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and
                             certificate leaf[subject.OU] = "94L7REHXB6")
                    iii.      Local System Permissions needed to run
                              1.  Full Disk Access (System Policy All Files)
    Configuration for the spsecure app
  5. Add the Team Identifier with the security certificate: 94L7REHXB6.

Note: Open at Login/Allow in the Background is beyond the scope of this document.

Create a New Smart Group

Make the Configuration Profiles known to other Jamf components.

Note: Screen Recording permissions need to be granted for the Agent and Helpdesk.

  1. Assign the Configuration Profile to a Mac computer.
    Click the Scope tab and configure the scope of the Profile. To distribute the profile during enrollment using a computer PreStage enrollment, ensure the scope of the profile contains the computers that are in the scope of the PreStage enrollment. Ensure the profile has been installed on the device by checking the device's System Settings > Privacy & Security > Profiles.
  2. Create and name a new Smart Computer Group.
     In the Jamf console, under Computers, select Smart Computer Groups.
  3. Assign the agent Configuration Profiles to the group.
     In Criteria, click Show Advanced Criteria.
     Select either Profile Name or Profile Identifier.
     Enter the agent's profile Name (e.g., spsecure) or its Identifier (com.spectorsoft.Recorder).

Note: This automatically adds computers to the group when they report that they have the policy.

Set up Distribution Point

  1. Settings > Global > Cloud Services Connection.
  2. Select Enable.
  3. Settings -> Server -> Cloud distribution point.
  4. Select Edit.
  5. Select Jamf Cloud.
  6. Save.

Create a package (PKG) to deliver the agent

To deliver the Veriato Mac Agent, you will need to create and run a script. You can use the JamfComposer to do this. Refer to this article for more help:
 https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/Scripts.html 

Note: During the download process, popups display stating an application downloaded from the internet and Managed Login Items Added:

  1. Download the Mac Agent from your Veriato app:
    a. Log on to the Veriato access Admin
    b. Select Download Agents section and then the Mac Platform icon.
    c. Follow the wizard steps to choose if installer reboots automatically or No Reboot after installation.

    Note: The auto-reboot is recommended, because whenever the installer runs the system reboots.

    d. Press Next and Download the installer zip file.
  2. Unzip the download containing two files:
    a. A1InstallerDataMac.zip
    b. Install.sh
  3. Download Jamf Composer.
    Install it on a Mac.
  4. In /private/tmp create a new folder, such as, ClientInstall.
  5. Unzip the Zip folder downloaded from the server, and copy the contents into the folder /private/tmp/ClientInstall.
  6. Launch Jamf Composer.
  7. Drag the folder ClientInstall into the sidebar of Composer:
  8. Expand the folders to display ClientInstall and its contents.
  9. For all three (the folder, Install.sh, and A1InstallDataMac.zip):
    a. Change the Owner to root.
    b. Check the boxes under X (execute) for Owner and Group.
  10. Expand the ClientInstall Source on the left.
  11. Right Click on Scripts.
  12. Select Add Shell Script -> postinstall.
  13. Add a call to the .sh file in the postintall script.
  14.  Save.
  15.  Click the ClientInstall Source.
  16.  Click Build as PKG.

Add the PKG file to Jamf

  1. Settings -> Computer Management -> Packages.
  2. Click + New button.
  3. Name the Package.
  4. Drag and drop the File into Filename.
  5. Save.

Create an Install Policy

  1. Navigate to Computer-> Policies.
  2. Click + New.
  3. Name the policy.
  4. Set your Triggers and other General options.
  5. Open Packages in the options section.
  6. Select the package you created.
  7. Select the appropriate Distribution Point. e.g., Cloud distribution point, based on the setup above.
  8. Ensure Install is selected.
  9. Choose Scope tab.
  10. Click Edit.
  11. With Specific Computers selected click + Add button.
  12. Click Computer Groups.
  13. Add the new smart group.
Powered by Zendesk