Skip to main content
Install or remove PMG on macOS and Linux fleets through your MDM. The scripts install the pmg binary on the machine, then configure each local user so npm install and pip install go through PMG.
The MDM scripts README in the PMG repo is the source of truth. Scripts and supported MDMs are updated there first.
The scripts run as root (the usual MDM default) and support both macOS and Linux fleets. For a single machine or golden image with no MDM agent, such as a shared VM, CI runner, or Docker image, use system install instead. MDM deploys can sync data to SafeDep Cloud. After setup, the install script runs pmg cloud sync for each target user. This adds the device to Endpoint Hub without waiting for a package manager event. You need an API key and Tenant ID from app.safedep.io/settings/api-keys. To repeat the sync without installing or configuring PMG again, pass --cloud-sync-only to the install script. Use this option only for users who already have PMG and cloud sync enabled. Run the normal installer to configure new users.

​
Supported MDMs

Mosyle, Kandji, and other MDMs that run a shell script as root manage macOS only, and use the same macOS scripts. JumpCloud and Intune also manage Linux fleets, with matching Linux scripts. Follow Jamf or JumpCloud when your MDM can ship more than one file. Follow Intune when it accepts one script per policy.

​
Scripts

  • Multi-file (Jamf, JumpCloud): deploy the shared lib for your platform alongside the install or uninstall script. The entry scripts source the shared lib at runtime and fail without it.
  • Standalone (Intune): generate an installer for your platform with Cloud credentials embedded, then upload that one script.
Do not assign an install policy and an uninstall policy to the same devices at the same time. You can optionally ship a config.yml next to the scripts (or pass --config when generating a standalone installer) for a machine-wide config. If you do, set cloud.enabled: true in it. A global config prevents the installer from changing that flag. See Globally Managed Configuration. The MDM scripts do not install a persistent MITM CA (pmg setup cert install). On macOS this needs interactive Keychain authorization, so it cannot run through MDM: have each user run it in their own session when needed. On Linux, PMG’s ephemeral CA is usually enough. Run sudo pmg setup cert install --system yourself only if a tool needs a persistent CA in the system trust store.

​
Next steps

Jamf

Multi-file scripts for macOS. Pass Cloud credentials as script parameters.

JumpCloud

Multi-file scripts for macOS or Linux, attached to a Command that runs as root.

Intune

Generate a standalone installer for macOS or Linux with Cloud credentials, then upload it.