macOS rollout
Owner: IT Audience: Jamf Pro admin deploying the Roots macOS agent to a managed fleet.
The Roots macOS agent is a signed .pkg package delivered via Jamf Pro alongside two Configuration Profiles (managed preferences + Accessibility PPPC). The agent authenticates to ChainDB with a Microsoft Entra ID JWT via OAuth 2.0 client_credentials — no interactive sign-in, no broker, no first-launch ceremony.
Per-user attribution is read from the local Open Directory record’s AltSecurityIdentities attribute. At enterprises running Microsoft 365, that attribute is already populated for users bound to Entra via Platform SSO, Workplace Join, or Jamf Connect. If your fleet doesn’t have any of those wired up, captures stamp the local Mac short name in the email field — pipeline still works, attribution is just less informative.
Inputs
Section titled “Inputs”| From | Values |
|---|---|
| Entra (Step 1) | Tenant ID, Client ID, Client secret, API scope, Cloud host |
| Cloud Ops handoff | Captures endpoint URL, Publishable key |
| Arbium team | RootsMac-<version>.pkg, managed-preferences.mobileconfig.template, pppc-accessibility.mobileconfig |
The five steps
Section titled “The five steps”- Entra app registration — produce the five Entra values.
- Policy management — upload the two Configuration Profiles, scope to the pilot group.
- Enroll apps — upload the PKG, create the install Policy, scope to the pilot group.
- Smoke test — confirm Jamf reports delivery, Cloud Ops confirms rows landed.
- Shipping updates — steady-state flow for new agent versions.
Start with 1. Entra app registration.