Deploy PMG with MDM

Install or remove PMG on macOS fleets through your MDM. The scripts install the pmg binary on the machine, then configure each local user so npm install and pip install go through PMG. The scripts are macOS only and should run as root (the usual MDM default). For Linux images and shared VMs, use system install. MDM deploys enable SafeDep Cloud sync so installs show up in Package Guard. You need an API key and Tenant ID from app.safedep.io/settings/api-keys. Credentials are stored for the logged-in user, so use a recurring policy to cover people who sign in later.

​

Supported MDMs

Mosyle, Kandji, and other MDMs that run a shell script as root on macOS use the same scripts. Follow Jamf or JumpCloud when your MDM can ship more than one file. Follow Intune when it accepts one script per policy.

​

Scripts

• Multi-file (Jamf, JumpCloud): deploy lib_macos.sh with pmg_setup_install_macos.sh or pmg_uninstall_macos.sh. The entry scripts source lib_macos.sh at runtime and fail without it.
• Standalone (Intune): generate an installer with Cloud credentials embedded, then upload that one script.

Do not assign an install policy and an uninstall policy to the same devices at the same time. The MITM CA trust step (pmg setup cert install) cannot run through MDM. Adding a trusted root to the login Keychain needs interactive authorization in the user’s GUI session. Have each user run it in their own session when needed (only for tools that ignore the proxy CA environment variables, such as Go on macOS). You can optionally ship a config.yml next to the scripts (or pass --config when generating a standalone installer) for a machine-wide config. If you do, set cloud.enabled: true in it. A global config prevents the installer from changing that flag. See Globally Managed Configuration.

​

Next steps