Skip to main content
Deploy PMG with a JumpCloud Command that runs as root, on macOS or Linux devices. Use the multi-file MDM scripts and ship the shared lib with the install or uninstall script for your platform.
A SafeDep subscription is required to sync PMG events with SafeDep Cloud.
You need a SafeDep Cloud API key and Tenant ID from app.safedep.io/settings/api-keys. Installs sync to Package Guard.

​
Install

1

Create a Command

In the JumpCloud Admin Console, create a Command and set Run As to root.
2

Attach the scripts

Upload lib_macos.sh and pmg_setup_install_macos.sh from scripts/mdm/macos/.
You can also upload a config.yml alongside the scripts for a machine-wide config. Set cloud.enabled: true in it if you do. Set the File Destination to /tmp/pmg-mdm/ for every file.
3

Set the timeout

Set Timeout After to at least 900 seconds so a slow download is not killed mid-run.
4

Add Cloud variables

Define the Command Variables safedep_api_key and safedep_tenant_id. Mark the API key as a Secret variable.
5

Set the Command body

6

Assign and run

Assign the Command to a device group and run it.

​
Uninstall

1

Create a second Command

Set Run As to root.
Upload lib_macos.sh and pmg_uninstall_macos.sh from scripts/mdm/macos/, with File Destination /tmp/pmg-mdm/.
2

Set the Command body

3

Assign and run

Assign the Command to the same device group and run it. Do not run the install and uninstall Commands on the same devices at the same time.

​
Run cloud sync only

Create another Command to repeat cloud sync without installing or configuring PMG again. Set it up the same way as the install Command, with the same shared library and script and Run As set to root. Use this Command body:
Assign it to the same device group on a recurring schedule. Use it only for users who already have PMG and cloud sync enabled. Run the normal install Command to configure new users.

Other MDMs

Jamf, Intune, and the script layout.

MDM scripts README

Source of truth in the PMG repo.