Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

MDM Deployment

Note: MDM deployment requires macOS Enterprise Edition.

Automated deployment of Aquilon DLP via Mobile Device Management (MDM) for enterprise macOS fleets.

Overview

MDM deployment enables:

  • Zero-touch provisioning of Full Disk Access permissions
  • Automated app installation across hundreds/thousands of Macs
  • Centralized configuration and compliance enforcement
  • Silent deployment without user interaction

Why MDM?

Aquilon DLP uses macOS Endpoint Security framework, which requires Full Disk Access (FDA). In enterprise environments:

  • Manual FDA grants don’t scale
  • Users may skip or misconfigure permissions
  • Compliance requires consistent deployment

MDM solves this by deploying PPPC (Privacy Preferences Policy Control) profiles that automatically grant FDA before app installation.

Prerequisites

  • MDM Platform: Jamf Pro, Microsoft Intune, Kandji, SimpleMDM, or compatible
  • macOS Version: 11.0 (Big Sur) or later
  • Signed App Bundle: Code-signed with Endpoint Security entitlement
  • Admin Access: MDM console with profile deployment permissions
  • Enrolled Devices: Target Macs enrolled in your MDM

Before You Begin

  1. Verify your signed app bundle has correct code requirement:

    ./scripts/extract_code_requirement.sh target/debug/aquilon-dlp.app

  2. Create a pilot group (10-50 devices) for initial testing

  3. Document your rollback plan in case of issues

Deployment Process

The deployment follows three phases, always in this order:

  1. Deploy PPPC Profile - Grants Full Disk Access permission
  2. Wait for Confirmation - Verify profile installation
  3. Deploy App - Install after FDA is granted

Critical: Deploy profile BEFORE app. macOS only applies PPPC grants during app installation.

Jamf Pro

Step 1: Upload PPPC Profile

  1. Navigate to: Computers > Configuration Profiles > + New

  2. Configure:

    • Display Name: Aquilon DLP - Full Disk Access
    • Category: Security
    • Distribution Method: Install Automatically

  3. Click Privacy Preferences Policy Control payload

  4. Click Upload and select deployment/mdm/pppc-jamf.mobileconfig

  5. Verify imported settings:

    • Identifier: dev.aquilon.dlp-plugin
    • System Policy All Files: Checked

Step 2: Scope and Deploy

  1. Click Scope tab
  2. Add target computer groups (start with pilot group)
  3. Click Save

Profile deploys on next check-in (typically 15-30 minutes).

Step 3: Verify Installation

On target Mac:

sudo profiles list | grep -i aquilon
# Expected: com.aquilonsecurity.dlp.pppc.jamf

Step 4: Package and Deploy App

  1. Create PKG installer:

    pkgbuild --root /path/to/aquilon-dlp.app \
         --identifier dev.aquilon.dlp-plugin \
         --version 0.1.0 \
         --install-location /Library/Application\ Support/aquilon-dlp.app \
         aquilon-dlp-0.1.0.pkg

  2. Upload to Jamf:

    • Settings > Computer Management > Packages > + New
    • Upload signed package

  3. Create installation policy:

    • Computers > Policies > + New
    • Add package with Install action
    • Scope to same groups as PPPC profile

Timeline

EventTiming
Profile propagates15-30 minutes
App installs15-30 minutes after profile
Total~60-90 minutes

Microsoft Intune

Step 1: Upload PPPC Profile

  1. Navigate to: Devices > macOS > Configuration profiles > + Create profile

  2. Select:

    • Platform: macOS
    • Profile type: Templates > Custom

  3. Configure:

    • Name: Aquilon DLP - Full Disk Access
    • Upload deployment/mdm/pppc-intune.mobileconfig
    • Deployment channel: Device channel

Step 2: Assign to Devices

  1. Click Assignments tab
  2. Add target Azure AD device groups
  3. Optionally add filter for macOS 11.0+

Step 3: Package App for Intune

Intune requires .intunemac format:

# Download Intune App Wrapping Tool from:
# https://github.com/msintuneappsdk/intune-app-wrapping-tool-mac

./IntuneAppUtil -c /path/to/aquilon-dlp.app \
                -o aquilon-dlp.intunemac \
                -n "0.1.0" \
                -v "0.1.0"

Step 4: Deploy App

  1. Navigate to: Apps > macOS > + Add
  2. App type: Line-of-business app
  3. Upload .intunemac file
  4. Configure app information
  5. Assign to same device groups as profile

Note: Wait 24 hours after profile deployment before deploying app, or use dynamic groups.

Timeline

EventTiming
Profile propagates1-8 hours
App installs1-8 hours after profile
Total~2-16 hours

Tip: Force sync via Company Portal > Settings > Sync to speed up check-ins.

Kandji

Step 1: Create Custom Profile

  1. Navigate to: Library > Custom Profiles > + Add Profile

  2. Configure:

    • Name: Aquilon DLP - Full Disk Access
    • Upload deployment/mdm/pppc-kandji.mobileconfig
    • Enforcement: Deploy Always

  3. Assign to target blueprints

Step 2: Create Custom App

  1. Navigate to: Library > Custom Apps > + Add App

  2. Upload PKG installer

  3. Configure:

    • Install Type: Package
    • Run as: System

  4. Set PPPC profile as dependency (optional but recommended)

  5. Assign to same blueprints

Timeline

EventTiming
Profile propagates15-60 minutes
App installs15-60 minutes after profile
Total~30-120 minutes

Generic MDM

For SimpleMDM, FileWave, Mosyle, or other platforms:

Profile Deployment

  1. Download deployment/mdm/pppc-generic.mobileconfig
  2. Upload to your MDM’s configuration profile section
  3. Assign to target devices/groups

App Deployment

  1. Package app as .pkg installer
  2. Upload to your MDM’s app distribution
  3. Deploy after confirming profile installation

Key Configuration

The profile must contain:

  • Bundle ID: dev.aquilon.dlp-plugin
  • Service: SystemPolicyAllFiles (Full Disk Access)
  • Code Requirement: Match your signed app

Verification

After deployment, verify on target Mac:

Check Profile Installation

sudo profiles list | grep -i aquilon
# Expected: com.aquilonsecurity.dlp.pppc.<mdm>
# Where <mdm> is: jamf, intune, or kandji

Check FDA Grant

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  "SELECT auth_value FROM access
   WHERE service = 'kTCCServiceSystemPolicyAllFiles'
   AND client = 'dev.aquilon.dlp-plugin';"
# Expected: 2

Check App Function

sudo /Library/Application\ Support/aquilon-dlp.app/Contents/MacOS/aquilon-dlp \
  --socket /tmp/osquery.sock

Expected output:

Attempting to initialize Endpoint Security monitoring...
Full Disk Access verified
Endpoint Security client created successfully
Endpoint Security monitoring active

Troubleshooting

FDA Not Granted After Installation

Cause: App installed before PPPC profile

Solution:

# 1. Verify profile is installed
sudo profiles list | grep aquilon

# 2. Remove app
sudo rm -rf /Library/Application\ Support/aquilon-dlp.app

# 3. Reinstall via MDM (triggers on next check-in)

System Settings Shows FDA Unchecked

Cause: Known macOS UI bug - checkbox doesn’t reflect TCC database

Solution: Trust the TCC database query. If auth_value = 2, FDA IS granted.

Warning: Do NOT manually toggle the checkbox - it may revoke the PPPC grant.

“Failed to create ES client” Error

Causes and solutions:

  1. FDA not granted: Check TCC database (see above)

  2. Not running as root: Use sudo

  3. ES entitlement missing: Check code signing

    codesign -d --entitlements - /Library/Application\ Support/aquilon-dlp.app

Code Requirement Mismatch

Symptom: Profile installed but TCC has no entry

Solution:

  1. Extract app’s actual code requirement:

    codesign -dr - /Library/Application\ Support/aquilon-dlp.app

  2. Update profile to match

  3. Redeploy profile and reinstall app

Profile Won’t Install

Solutions:

  1. Validate profile: plutil -lint deployment/mdm/pppc-*.mobileconfig

  2. Check device enrollment status

  3. Remove conflicting profiles:

    # Replace <mdm> with: jamf, intune, or kandji
sudo profiles remove -identifier com.aquilonsecurity.dlp.pppc.<mdm>

Diagnostic Script

Save and run this script on target Mac:

#!/bin/bash
# FDA Troubleshooting Diagnostic

echo "=== Aquilon DLP FDA Diagnostic ==="
echo

echo "1. Profile Installation:"
profiles list | grep -q "com.aquilonsecurity.dlp.pppc" && \
  echo "✓ Profile installed" || echo "✗ Profile NOT installed (check for .jamf/.intune/.kandji suffix)"

echo "2. TCC Database Entry:"
AUTH=$(sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  "SELECT auth_value FROM access WHERE service = 'kTCCServiceSystemPolicyAllFiles'
   AND client = 'dev.aquilon.dlp-plugin';" 2>/dev/null)
[ "$AUTH" = "2" ] && echo "✓ FDA granted" || echo "✗ FDA NOT granted"

echo "3. App Bundle:"
[ -d "/Library/Application Support/aquilon-dlp.app" ] && \
  echo "✓ App installed" || echo "✗ App NOT installed"

echo "4. Code Signature:"
codesign --verify /Library/Application\ Support/aquilon-dlp.app 2>/dev/null && \
  echo "✓ Valid signature" || echo "✗ Invalid signature"

echo "5. ES Entitlement:"
codesign -d --entitlements - /Library/Application\ Support/aquilon-dlp.app 2>&1 | \
  grep -q "endpoint-security" && \
  echo "✓ ES entitlement present" || echo "✗ ES entitlement missing"

echo "=== End Diagnostic ==="

Best Practices

Staged Rollout

  1. Pilot (Week 1): Deploy to IT/security team (10-50 devices)
  2. Early Adopters (Week 2): Expand to 100-500 devices
  3. Production (Week 3+): Roll out to all devices

Smart Groups

Create groups to track deployment status:

  • Profile Installed: Devices with PPPC profile
  • App Installed: Devices with app bundle
  • Needs Remediation: App installed but FDA not granted

Remediation Policy

Create automated remediation for FDA issues:

  1. Detect: App installed but FDA not in TCC
  2. Action: Remove app, trigger reinstall
  3. Monitor: Alert on repeated failures

Next Steps