SafeDep Documentation

Deploy PMG with a Jamf policy that runs the multi-file MDM scripts as root. Ship lib_macos.sh with the install or uninstall script.

A SafeDep subscription is required to sync PMG events with SafeDep Cloud.

You need a SafeDep Cloud API key and Tenant ID from app.safedep.io/settings/api-keys. Installs sync to Package Guard.

Install

Download lib_macos.sh and pmg_setup_install_macos.sh from scripts/mdm/. You can optionally add a sibling config.yml for a machine-wide config. If you do, set cloud.enabled: true in it. A global config prevents the installer from changing that flag.
Upload the folder as a script payload, or as a package that drops the files together at a fixed path.
Create a policy that runs as root and invokes the installer. Pass the Cloud credentials as Jamf script parameters $4 and $5:
#!/bin/sh cd "$(dirname "$0")" SAFEDEP_API_KEY="$4" SAFEDEP_TENANT_ID="$5" ./pmg_setup_install_macos.sh
Renumber $4 and $5 if your parameter slots differ.
Assign the policy to a computer group and run it.

Create a second policy with lib_macos.sh and pmg_uninstall_macos.sh:

#!/bin/sh
cd "$(dirname "$0")"
./pmg_uninstall_macos.sh

Assign it to the same computer group. Do not run the install and uninstall policies on the same devices at the same time.

JumpCloud, Intune, and the script layout.

Source of truth in the PMG repo.