--- title: Deploying the Endpoint Controller on macOS with Jamf Pro description: Deploy the Endpoint Controller to managed macOS computers with Jamf Pro for silent installation and automated onboarding. component: privilege page_id: privilege:getting-started:deploying-controller-jamf canonical_url: https://docs.pingidentity.com/privilege/getting-started/deploying-controller-jamf.html llms_txt: https://docs.pingidentity.com/privilege/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: October 22, 2026 section_ids: before-you-begin: Before you begin deployment-overview: Deployment overview create-configuration-profiles: Create configuration profiles create-the-system-extensions-profile: Create the System Extensions profile create-the-content-filter-profile: Create the Content Filter profile create-the-privacy-preferences-policy-control-profile: Create the Privacy Preferences Policy Control profile create-the-onboard-preference-plist: Create the Onboard preference plist create-the-policies: Create the policies create-the-agent-installation-policy: Create the agent installation policy create-the-configuration-creation-policy: Create the configuration-creation policy enroll-devices-and-deploy: Enroll devices and deploy verify-mdm-onboarding-in-pingone-privilege: Verify MDM onboarding in PingOne Privilege verify-the-deployment: Verify the deployment --- # Deploying the Endpoint Controller on macOS with Jamf Pro Deploy the Endpoint Controller to managed macOS computers with Jamf Pro to install and configure the Endpoint Controller centrally instead of sending download links to individual users. The Jamf Pro deployment: * Installs the PingOne Privilege Endpoint Controller. * Preapproves the macOS system extensions and full disk access. * Generates the client configuration that the Endpoint Controller needs to register the device with PingOne Privilege. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | This guide only applies to [Endpoint Controller-based deployments](choosing-deployment-model.html). After deployment, users open their onboarding link to complete registration and access the PingOne Privilege user console. Learn more in [Onboarding users](onboarding-users.html). | ## Before you begin Ensure the following: * You can access the Jamf Pro admin console, and the target computers are enrolled in Jamf Pro. * You've installed the Endpoint Controller. You need its **Controller URL** and **Tenant ID**. * You've generated a key pair *(tooltip: \
\

The private key and public key represented by a certificate.\

\
)* for MDM onboarding: * You've uploaded the public key *(tooltip: \
\

In public key cryptography, a public key is the part of an asymmetric key pair that the owner shares with others to allow them to decrypt digital signatures or encrypted data.\

\
)* to your PingOne Privilege tenant under **Settings > MDM Onboarding**. Learn more in [Verifying MDM onboarding in PingOne Privilege](#verify-mdm-onboarding). * You've added the private key *(tooltip: \
\

In public key cryptography, a private key is the secret part of an asymmetric key pair that is typically used to digitally sign or decrypt data. The private key is kept secret by its owner, similar to a password.\

\
)* in Base64 format to your Jamf portal, typically through an extension attribute. | | | | - | ------------------------------------------------------------------ | | | PingOne Privilege supports the RSA, ECDSA, and Ed25519 algorithms. | | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | MDM deployment doesn't replace PingOne group access. A computer can be successfully managed by Jamf Pro and still require its user to belong to a group with access to the PingOne Privilege application. Confirm group access in [Setting up your environment in PingOne](setting-up-environment.html) before you deploy. | ## Deployment overview You perform most of this deployment in the Jamf Pro admin console. The enrollment and Endpoint Controller verification steps take place on each target Mac, and the MDM onboarding verification takes place in the PingOne Privilege admin console. Deployment consists of the following tasks: 1. [Create configuration profiles](#create-profiles) to preapprove system extensions, activate the network extension, grant full disk access, and push the onboarding configuration. 2. [Create the policies](#create-policies) for installing the Endpoint Controller and generate the client configuration. 3. [Enroll devices and deploy](#enroll-and-deploy) to trigger automated deployment of the Endpoint Controller. 4. [Verify the deployment](#verify-deployment) of the Endpoint Controller. ## Create configuration profiles[]() Create the following configuration profiles in Jamf Pro. Each profile uses **Computer Level** as the level and **Install Automatically** as the distribution method. ### Create the System Extensions profile This profile preapproves the PingOne Privilege system extensions so users aren't prompted in **System Settings**. 1. In Jamf Pro, go to **Computers > Configuration Profiles**. 2. Click **New**. 3. In the **General** section: 1. Enter a **Name** for the profile, such as `PingOne Privilege System Extensions`. 2. Set **Level** to **Computer Level**. 3. Set **Distribution Method** to **Install Automatically**. 4. In the left sidebar, click **System Extensions**, then click **Configure**. 5. Clear the **Allow users to approve system extensions** checkbox. 6. In the **Allowed System Extensions and Teams IDs** section: 1. Enter a **Display name** for the entry. 2. In the **System extension types** list, select **Non-removable system extensions**. 3. In the **Team identifier** field, enter `6U3RF4C84N`. 4. Under **Non-removable system extensions**, click **Add** and paste `com.pingidentity.AgentLauncher.EndpointSecurity`. 5. Click **Add** again and paste `com.pingidentity.AgentLauncher.NetworkFilter`. 7. Click **Save**. ### Create the Content Filter profile This profile activates the network extension. 1. In Jamf Pro, go to **Computers > Configuration Profiles**. 2. Click **New**. 3. In the **General** section: 1. Enter a **Name** for the profile, such as `PingOne Privilege Content Filter`. 2. Set **Level** to **Computer Level**. 3. Set **Distribution Method** to **Install Automatically**. 4. In the left sidebar, click **Content Filter**, then click **Configure**. 1. Enter a **Filter name**, such as `PingOne Privilege`. 2. For **Identifier**, enter `com.procyon.ai` 3. Under **Filter type**, select **Plug-in**. 4. Under **Socket Filter**, select the **Enabled** checkbox. 5. For **Socket filter bundle identifier**, enter `com.pingidentity.AgentLauncher.NetworkFilter` 6. In **Socket filter designated requirement**, paste the following string: ``` identifier "com.pingidentity.AgentLauncher.NetworkFilter" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "6U3RF4C84N" ``` 5. Click **Save**. ### Create the Privacy Preferences Policy Control profile This profile grants full disk access to the endpoint security extension, which the Endpoint Controller needs to discover personal agents. 1. In Jamf Pro, go to **Computers > Configuration Profiles**. 2. Click **New**. 3. In the **General** section: 1. Enter a **Name** for the profile, such as `PingOne Privilege PPPC`. 2. Set **Level** to **Computer Level**. 3. Set **Distribution Method** to **Install Automatically**. 4. In the left sidebar, click **Privacy Preferences Policy Control**, then click **Configure**. 5. Under **App Access**, click **Add**. 1. For **Identifier**, enter `com.pingidentity.AgentLauncher.EndpointSecurity` 2. Under **Identifier type**, select **Bundle ID**. 3. In **Code requirement**, paste the following string: ``` identifier "com.pingidentity.AgentLauncher.EndpointSecurity" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "6U3RF4C84N" ``` 6. In the **App or Service** list, find **SystemPolicyAllFiles** and change the list to **Allow**. 7. Click **Save**. ### Create the Onboard preference plist This profile pushes the custom configuration variables, such as the tenant ID and user information, to the Mac. 1. In Jamf Pro, go to **Computers > Configuration Profiles**. 2. Click **New**. 3. In the **General** section: 1. Enter a **Name** for the profile, such as `PingOne Privilege Onboard`. 2. Set **Level** to **Computer Level**. 3. Set **Distribution Method** to **Install Automatically**. 4. In the left sidebar, click **Application & Custom Settings**, then click **Configure**. 5. Choose the option to enter Extensible Markup Language (XML) *(tooltip: \
\

A structured, hierarchical text format, based on SGML, for the flexible and organized exchange of data.\

\
)* manually, or upload a PLIST, and paste the following plist, replacing the placeholders with your environment values: ```xml tenant [Insert Tenant ID] macuser $USERNAME privuser $USERNAME expiryHours $EXTENSIONATTRIBUTE_4 privateKeyBase64 $EXTENSIONATTRIBUTE_2 controllerURL [Insert Controller URL] ``` | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | The $EXTENSIONATTRIBUTE\_\* placeholders refer to the Jamf extension attributes that hold the private key in Base64 format and the onboarding expiry, in hours. Adjust the attribute numbers to match the extension attributes in your Jamf Pro environment. | 6. Click **Save**. ## Create the policies[]() In the Jamf Pro admin console, create the policies that install the Endpoint Controller and build the user's client configuration. ### Create the agent installation policy This policy installs the Endpoint Controller. 1. In the Jamf Pro admin console, go to **Computers > Policies** and click **New**. 2. In the **General** section: 1. Enter a **Display name**, such as `PingOne Privilege Agent Install`. 2. Set **Trigger** to **Custom** and enter `procyon-agent-install` in the text box. 3. Set **Execution frequency** to **Once per computer**. 3. In the left sidebar, click **Packages**, then click **Configure**. 4. Find the PingOne Privilege `.pkg` file you uploaded to Jamf Pro and click **Add**. 5. Click **Save**. ### Create the configuration-creation policy This policy is the main deployment policy. It calls the installation policy, waits for the Endpoint Controller to install, and then builds the user's client configuration file. 1. In Jamf Pro, go to **Computers > Policies**. 2. Click **New**. 3. In the **General** section: 1. Enter a **Display name**, such as `procyon-onboard`. 2. Select the **Enabled** checkbox. 3. Set **Trigger** to **Recurring Check-in** (or your preferred deployment trigger). 4. Set **Execution frequency** to **Once per computer**. 4. In the left sidebar, click **Scripts**, then click **Configure**. 5. Add a new script, set the priority to **After**, and paste the following script: ```bash #!/bin/sh # PingOne Privilege config-creation policy # Triggers the agent install policy, then runs until config.json is created. LOG=/var/log/pingone-privilege-postinstall.log log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG"; } APP="/Applications/PingOne Privilege.app" APP_BIN="/usr/local/bin/cyononboard" PREFS="/Library/Managed Preferences/com.pingidentity.privilege.onboard.plist" # Trigger the installation policy log "config-policy: calling custom event procyon-agent-install..." /usr/local/bin/jamf policy -event procyon-agent-install if [ ! -d "$APP" ]; then log "config-policy: agent app not installed yet - exiting 1, will retry" exit 1 fi CONSOLE_USER=$(/usr/bin/stat -f%Su /dev/console 2>/dev/null) if [ -z "$CONSOLE_USER" ]; then TARGET_USER=$(/usr/libexec/PlistBuddy -c 'Print :macuser' "$PREFS" 2>/dev/null) else TARGET_USER=$CONSOLE_USER fi if [ -z "$TARGET_USER" ]; then log "config-policy: no console user and no macuser in profile - exiting 1, will retry" exit 1 fi CONFIG="/Users/$TARGET_USER/.config/procyon/config.json" if [ -s "$CONFIG" ]; then log "config-policy: $CONFIG exists - nothing to do" exit 0 fi ATTEMPTS=0 until "$APP_BIN" >> "$LOG" 2>&1; do ATTEMPTS=$((ATTEMPTS + 1)) log "config-policy: attempt $ATTEMPTS failed (MDM profile may not be installed yet)" if [ "$ATTEMPTS" -ge 20 ]; then log "config-policy: profile still missing after 20 attempts - exiting 1, Jamf will retry" exit 1 fi sleep 30 done if [ -s "$CONFIG" ]; then log "config-policy: created $CONFIG for $TARGET_USER" exit 0 fi log "config-policy: cyononboard exited 0 but $CONFIG missing - exiting 1, will retry" exit 1 ``` 6. Click **Save**. ## Enroll devices and deploy[]() To trigger the automated deployment on a user's Mac: 1. On the target Mac, go to `https://.jamfcloud.com/enroll/`. 2. Download and install the MDM profile onto the system. After the Mac is successfully enrolled, the entire process takes place automatically in the background: * The configuration profiles are applied. * The Endpoint Controller is installed. * The personalized configuration file is securely generated. On first launch, the Endpoint Controller opens, the extensions activate without prompting for manual approval in **System Settings**, and the users are registered when they open the application. ## Verify MDM onboarding in PingOne Privilege[]() 1. In the PingOne Privilege admin console, go to **Settings**. 2. In the **MDM Onboarding** section, confirm that it displays the public key from the key pair you generated. Computers use this key to enroll and verify with PingOne Privilege. ## Verify the deployment[]() After Jamf Pro deploys the profiles and policies: 1. In Jamf Pro, confirm that Jamf Pro installed the configuration profiles on the target computers. 2. On a target Mac, confirm that the Endpoint Controller created the client configuration file for the user at `~/.config/procyon/config.json`. 3. On the target Mac, open the Endpoint Controller and confirm the **Connection Status** reports **Connected**. | | | | - | --------------------------------------------------------------------- | | | The **General** page also displays the tenant and device information. | | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | If the Endpoint Controller displays a QR code, the device isn't registered. Verify that the configuration-creation policy completed successfully, then have the user open the onboarding link again. |