2. Policy management
Owner: IT Prerequisite: Step 1 (Entra app registration) is complete. You also need the captures-endpoint URL and publishable key from Cloud Ops Step 5 - Handoff. Order: complete this step before Step 3. The agent reads its config from these profiles on start; if the PKG lands first, the agent boots with missing configuration, logs an error, and retries until the profiles arrive.
Two Configuration Profiles get uploaded to Jamf in this step. Both are mobileconfig files; the managed-prefs one carries six values you fill in, the PPPC one is pre-built.
Pilot device group
Section titled “Pilot device group”Use whatever scoping mechanism your Jamf fleet already uses — Smart Group by department, asset tag, Extension Attribute, named pilot ring. Name the target Arbium macOS Pilot (or your equivalent). Everything in Steps 2 and 3 scopes to this group.
Managed preferences profile
Section titled “Managed preferences profile”File: managed-preferences.mobileconfig.template (from the Arbium team).
Fill in six placeholders:
| Placeholder | Source |
|---|---|
__CapturesEndpoint__ |
Cloud Ops handoff — full URL, e.g. https://arbium.<customer-domain>/functions/v1/captures-batch-direct |
__PublishableKey__ |
Cloud Ops handoff — public anon key |
__EntraTenantId__ |
Step 1 — Directory (tenant) ID |
__EntraClientId__ |
Step 1 — Application (client) ID |
__EntraApiScope__ |
Step 1 — Application ID URI, typically api://<client-id> |
__EntraClientSecret__ |
Step 1 — Client secret Value (the 40-char string with tildes, not the Secret ID GUID) |
EntraCloudHost defaults to login.microsoftonline.com — change to login.microsoftonline.us only on sovereign clouds (GCC High, DoD).
Optional Sentry telemetry keys: leave SentryDsn blank for off, or paste the DSN from your Sentry project’s Settings → Client Keys (DSN). One Sentry project covers Mac + Windows.
Privacy rules
Section titled “Privacy rules”No additional profile key is required for privacy rules. The agent fetches the customer’s current blocked-app and blocked-site rules from the backend and enforces them on the Mac before a capture can leave the device. It caches the last successful rules response and holds captures until it has either current rules or a cache to apply.
BlocklistEndpoint and BlocklistRefreshSeconds are optional advanced
overrides. Leave them unset for the standard endpoint and ten-minute refresh
cycle. Do not use these settings to bypass a customer privacy rule.
Upload to Jamf: Computers → Configuration Profiles → Upload. Pick the filled-in .mobileconfig. On the Scope tab, target the pilot group. Save.
Accessibility PPPC profile
Section titled “Accessibility PPPC profile”File: pppc-accessibility.mobileconfig (from the Arbium team, pre-built — Code Requirement is anchored on Arbium’s Team ID and stable across PKG versions).
Upload to Jamf: Computers → Configuration Profiles → Upload. Pick the file. Scope tab: pilot group. Save.
The profile pre-grants Accessibility to bundle com.trycaret.arbor.agent. Screen Recording is intentionally not requested.
Apple marks MDM-granted Accessibility as deprecated in macOS 26.2 and targeted for removal in macOS 27. Plan a separate macOS 27 validation pass closer to that release.
Definition of done
Section titled “Definition of done”In Jamf, both profiles appear under Computers → Configuration Profiles with the pilot group on their Scope tab. On a pilot Mac, both show as Installed under System Settings → General → Device Management after the next MDM check-in.