SafeDep Documentation

Deploy PMG with a JumpCloud Command that runs as root on macOS or Linux, or as SYSTEM on Windows. Use the multi-file MDM scripts and ship the shared lib with the install or uninstall script for your platform.

A SafeDep subscription is required to sync PMG events with SafeDep Cloud.

For optional Cloud sync, you need a SafeDep Cloud API key and Tenant ID from app.safedep.io/settings/api-keys. Installs sync to Package Guard.

Install

Create a Command

In the JumpCloud Admin Console, create a Command and set Run As to root for macOS or Linux. Windows Commands run as SYSTEM.

Attach the scripts

macOS
Linux
Windows

Upload lib_macos.sh and pmg_setup_install_macos.sh from scripts/mdm/macos/. Set File Destination to /tmp/pmg-mdm/.Optionally upload a config.yml to the same directory for managed config. Set cloud.enabled: true in it for Cloud sync.

Upload lib_linux.sh and pmg_setup_install_linux.sh from scripts/mdm/linux/. Set File Destination to /tmp/pmg-mdm/.Optionally upload a config.yml to the same directory for managed config. Set cloud.enabled: true in it for Cloud sync.

Upload lib_windows.ps1 and pmg_setup_install_windows.ps1 from scripts/mdm/windows/. Set File Destination to C:\Windows\Temp\pmg-mdm\.For the Cloud-enabled Command below, also upload config.yml with cloud.enabled: true to the same directory. Keep your other policy settings in this file because it replaces the managed config. Credentials alone do not enable sync.Optionally include pmg.exe from the release zip of v0.29.0 or later to avoid a download. The bundled binary must be owned by Administrators or SYSTEM.

Set the timeout

Set Timeout After to at least 900 seconds so a slow download is not killed mid-run.

Add Cloud variables

Define the Command Variables safedep_api_key and safedep_tenant_id. Mark the API key as a Secret variable. For local-only blocking, omit both variables and their assignments from the Command body.

Set the Command body

macOS
Linux
Windows

#!/bin/sh
set -eu
cd /tmp/pmg-mdm
chmod +x pmg_setup_install_macos.sh
SAFEDEP_API_KEY={{safedep_api_key}} SAFEDEP_TENANT_ID={{safedep_tenant_id}} ./pmg_setup_install_macos.sh
cd / && rm -rf /tmp/pmg-mdm

#!/bin/sh
set -eu
cd /tmp/pmg-mdm
chmod +x pmg_setup_install_linux.sh
SAFEDEP_API_KEY={{safedep_api_key}} SAFEDEP_TENANT_ID={{safedep_tenant_id}} ./pmg_setup_install_linux.sh
cd / && rm -rf /tmp/pmg-mdm

$env:SAFEDEP_API_KEY = '{{safedep_api_key}}'
$env:SAFEDEP_TENANT_ID = '{{safedep_tenant_id}}'
& C:\Windows\Temp\pmg-mdm\pmg_setup_install_windows.ps1

Windows requires PMG v0.29.0 or later. The installer downloads the latest stable release by default. To pin a version, optionally set $env:PMG_VERSION = 'v0.29.0' before running it.

Assign and run

Assign the Command to a device group and run it.

Uninstall

Create a second Command

Use root on macOS or Linux, or SYSTEM on Windows.

macOS
Linux
Windows

Upload lib_macos.sh and pmg_uninstall_macos.sh from scripts/mdm/macos/, with File Destination /tmp/pmg-mdm/.

Upload lib_linux.sh and pmg_uninstall_linux.sh from scripts/mdm/linux/, with File Destination /tmp/pmg-mdm/.

Upload lib_windows.ps1 and pmg_uninstall_windows.ps1 from scripts/mdm/windows/, with File Destination C:\Windows\Temp\pmg-mdm\.

Set the Command body

macOS
Linux
Windows

#!/bin/sh
set -eu
cd /tmp/pmg-mdm
chmod +x pmg_uninstall_macos.sh
./pmg_uninstall_macos.sh
cd / && rm -rf /tmp/pmg-mdm

#!/bin/sh
set -eu
cd /tmp/pmg-mdm
chmod +x pmg_uninstall_linux.sh
./pmg_uninstall_linux.sh
cd / && rm -rf /tmp/pmg-mdm

& C:\Windows\Temp\pmg-mdm\pmg_uninstall_windows.ps1

Assign and run

Assign the Command to the same device group and run it. Do not run the install and uninstall Commands on the same devices at the same time.

Run cloud sync only

Create another Command to repeat cloud sync without installing or configuring PMG again. Set it up the same way as the install Command, with the same shared library and script and root on macOS/Linux or SYSTEM on Windows. Use this Command body:

macOS
Linux
Windows

#!/bin/sh
set -eu
cd /tmp/pmg-mdm
chmod +x pmg_setup_install_macos.sh
SAFEDEP_API_KEY={{safedep_api_key}} SAFEDEP_TENANT_ID={{safedep_tenant_id}} ./pmg_setup_install_macos.sh --cloud-sync-only
cd / && rm -rf /tmp/pmg-mdm

#!/bin/sh
set -eu
cd /tmp/pmg-mdm
chmod +x pmg_setup_install_linux.sh
SAFEDEP_API_KEY={{safedep_api_key}} SAFEDEP_TENANT_ID={{safedep_tenant_id}} ./pmg_setup_install_linux.sh --cloud-sync-only
cd / && rm -rf /tmp/pmg-mdm

$env:SAFEDEP_API_KEY = '{{safedep_api_key}}'
$env:SAFEDEP_TENANT_ID = '{{safedep_tenant_id}}'
& C:\Windows\Temp\pmg-mdm\pmg_setup_install_windows.ps1 --cloud-sync-only

Only logged-on users are synced. This mode does not save credentials in Credential Manager. Rerun the normal installer to store them after users sign in.

Assign it to the same device group on a recurring schedule. Use it only for users who already have PMG and cloud sync enabled. Run the normal install Command to configure new users.

Other MDMs

Jamf, Intune, and the script layout.

MDM scripts README

Source of truth in the PMG repo.

​Install

​Uninstall

​Run cloud sync only

Other MDMs

MDM scripts README

Install

Uninstall

Run cloud sync only