Skip to main content
Deploy PMG with a Jamf policy that runs the multi-file MDM scripts as root. Ship lib_macos.sh with the install or uninstall script. Jamf manages Apple devices only. For a Linux fleet, use JumpCloud or Intune instead.
A SafeDep subscription is required to sync PMG events with SafeDep Cloud.
You need a SafeDep Cloud API key and Tenant ID from app.safedep.io/settings/api-keys. Installs sync to Package Guard.

​
Install

  1. Download lib_macos.sh and pmg_setup_install_macos.sh from scripts/mdm/macos/. You can optionally add a sibling config.yml for a machine-wide config. If you do, set cloud.enabled: true in it. A global config prevents the installer from changing that flag.
  2. Upload the folder as a script payload, or as a package that drops the files together at a fixed path.
  3. Create a policy that runs as root and invokes the installer. Pass the Cloud credentials as Jamf script parameters $4 and $5:
    Renumber $4 and $5 if your parameter slots differ.
  4. Assign the policy to a computer group and run it.

​
Uninstall

Create a second policy with lib_macos.sh and pmg_uninstall_macos.sh:
Assign it to the same computer group. Do not run the install and uninstall policies on the same devices at the same time.

​
Run cloud sync only

Create a separate policy to repeat cloud sync without installing or configuring PMG again. Reuse the install script and parameters, and add --cloud-sync-only:
Assign this policy to the same computer group with a recurring trigger. Use it only for users who already have PMG and cloud sync enabled. Run the normal install policy to configure new users.

Other MDMs

JumpCloud, Intune, and the script layout.

MDM scripts README

Source of truth in the PMG repo.