Skip to main content

Jamf Pro rollout

Roll out pavri-endpointd to a macOS fleet via Jamf Pro using a Configuration Profile + signed .pkg + postinstall script.

1. Prerequisites​

  • Pavri tenant + admin role.
  • Jamf Pro admin access; permission to create Configuration Profiles and Policies.
  • Signed pavri-endpointd.pkg (Developer ID + Notarization). Signing is gated on CAP-3.8 — see the CAP-3.8 row in docs/05-PHASED-ROADMAP.md (internal).

2. Token mint​

In the Pavri dashboard, navigate to Settings → Endpoints → Add Endpoint → Mint enrollment token. Tokens are single-use per endpoint, 24-hour TTL. Mint one token per Jamf scope (smart group or static group) — re-use across endpoints within the scope is supported because the gateway tracks per-endpoint enrollment state.

3. Substitution markers​

Edit infra/mdm/jamf/pavri-endpointd.mobileconfig before upload to Jamf:

MarkerReplace with
${GATEWAY_URL}Your tenant's gateway URL (e.g. https://gateway.your-org.pavri.ai)
${ENROLLMENT_TOKEN}The token you minted in step 2
${ORG_ID}Your pavri org_id (visible at /admin/tenant in the dashboard)

For the full list of supported environment variables and command-line flags, see Sensor deployment reference.

4. Package signing​

Jamf delivers your .pkg. The package itself must be Developer-ID-signed and Apple-notarized (Apple's Gatekeeper enforces this). Until CAP-3.8 ships the ES entitlement build, the sensor runs in observe-mode-only (Tier 2 kauth/FSEvents fallback). See macOS observer tiers.

5. Staged rollout​

  1. Create a Jamf smart group pavri-pilot (5% of fleet, criterion: user email).
  2. Scope the Configuration Profile and Policy to pavri-pilot.
  3. Set the tenant default protection-profile to observe mode at /admin/protection-profiles.
  4. After 1 week of clean telemetry: expand the smart group to 25%, switch tenant default to soft_enforce.
  5. After 1 further week: expand to 100% and switch to enforce.

6. Rollback​

  • Per-endpoint emergency: at /admin/endpoints/{endpoint_id} → Set protection mode → observe — takes effect immediately, no MDM touch required.
  • Fleet-wide emergency: at /admin/protection-profiles → set tenant default to observe.
  • Full uninstall via Jamf: scope an uninstall policy that runs /usr/local/bin/endpointctl uninstall-nm-manifests --browser=all and then pkgutil --forget com.pavri.endpointd, followed by rm /usr/local/bin/pavri-endpointd.

7. Post-install verification​

On any enrolled endpoint:

# Verify the binary is present.
ls -l /usr/local/bin/pavri-endpointd

# Verify the LaunchDaemon is loaded and running.
sudo launchctl print system/com.pavri.endpointd | grep -E 'state|pid'

# Verify native-messaging manifests are healthy for any browsers in scope.
/usr/local/bin/endpointctl status-nm-manifests --browser=all

Confirm the endpoint shows up at /admin/endpoints in the dashboard within 60 seconds of the heartbeat interval.

Files in this rollout​

  • infra/mdm/jamf/pavri-endpointd.mobileconfig — Configuration Profile (env vars).
  • infra/mdm/jamf/install.sh — postinstall (validates plist, loads LaunchDaemon, installs NM manifests).
  • infra/mdm/jamf/README.md — short on-disk reference for Jamf operators.