Jamf Pro Deployment (macOS)

This guide deploys the Pult Agent on macOS through Jamf Pro. It uses the wrapper .pkg you build in Build the macOS MDM Package plus a version-detecting Extension Attribute, a Smart Computer Group, and a Policy that re-installs the agent whenever a Mac is missing it or running the wrong version.

Prerequisites

• A Jamf Pro instance with admin access.
• The Pult Agent wrapper .pkg, built per Build the macOS MDM Package.
• Macs already enrolled in Jamf Pro and reporting inventory.

Step 1: Upload the Package

1. In Jamf Pro, go to Settings → Computer management → Packages.
2. Click + New.
3. Upload your pult-agent-mdm.pkg. Jamf Pro reads the metadata and pre-fills the display name and category.
4. Set the Display Name to something like Pult Agent 0.2.10-beta1 (MDM) so version updates are easy to identify.
5. Click Save.

Step 2: Create the Version Detection Extension Attribute

The Extension Attribute (EA) is a script that runs on each Mac during inventory collection and reports the installed Pult Agent version, or not_installed when the app is missing. Optionally (REQUIRE_PKG_RECEIPT="true" at the top of the script) it reports no_pkg_receipt when the app is present but has no macOS package receipt (pkgutil --pkg-info com.pult.agent), which means it was installed manually from the .dmg, not through the .pkg. Those Macs never received the LaunchAgent or the bootstrap postinstall and must still get the package.

1. Go to Settings → Computer management → Extension Attributes.

2. Click + New.

3. Configure:

   • Display Name: Pult Agent Version
   • Description: Reports the installed Pult Agent version, "no_pkg_receipt", "pkg_version_mismatch", or "not_installed".
   • Data Type: String
   • Inventory Display: Extension attributes
   • Input Type: Script

4. Paste this script:

   #!/bin/bash
   APP_PATH="/Applications/Pult Agent.app"
   
   # Optional: report "no_pkg_receipt" for Macs that have the app but no macOS
   # package receipt for the Pult Agent .pkg (identifier com.pult.agent), i.e.
   # the agent was installed manually from the .dmg rather than through the .pkg.
   #
   #   "false" (default) Report the app bundle version regardless of how the
   #           agent was installed.
   #   "true"  Those Macs land in the Smart Group and still receive the .pkg
   #           (system-wide LaunchAgent + bootstrap postinstall).
   REQUIRE_PKG_RECEIPT="false"
   PKG_ID="com.pult.agent"
   
   # Optional, only used with REQUIRE_PKG_RECEIPT="true": report
   # "pkg_version_mismatch" unless the receipt carries exactly this package
   # version. Set it to the version stamped on the wrapper .pkg to force a
   # one-time reinstall on Macs that already run the right app version.
   REQUIRED_PKG_VERSION=""
   
   if [[ ! -d "${APP_PATH}" ]]; then
       echo "<result>not_installed</result>"
       exit 0
   fi
   if [[ "${REQUIRE_PKG_RECEIPT}" == "true" ]]; then
       # Read the "version:" line of the receipt. Empty when there is no receipt.
       PKG_VERSION=""
       while read -r key value; do
           if [[ "${key}" == "version:" ]]; then
               PKG_VERSION="${value}"
           fi
       done < <(/usr/sbin/pkgutil --pkg-info "${PKG_ID}" 2>/dev/null)
       if [[ -z "${PKG_VERSION}" ]]; then
           echo "<result>no_pkg_receipt</result>"
           exit 0
       fi
       if [[ -n "${REQUIRED_PKG_VERSION}" && "${PKG_VERSION}" != "${REQUIRED_PKG_VERSION}" ]]; then
           echo "<result>pkg_version_mismatch</result>"
           exit 0
       fi
   fi
   VERSION=$(/usr/bin/defaults read "${APP_PATH}/Contents/Info.plist" \
       CFBundleShortVersionString 2>/dev/null)
   echo "<result>${VERSION:-unknown}</result>"

5. Click Save.

The EA populates on each Mac at the next inventory check-in (or you can force a check-in with sudo jamf recon on a test Mac).

Step 3: Create the Smart Computer Group

The Smart Group selects every Mac that needs the package installed -- either because the agent is missing, or because the version doesn't match the one you're rolling out.

1. Go to Computers → Smart Computer Groups.
2. Click + New.
3. Display Name: Pult Agent: Needs Install.
4. On the Criteria tab, click + Add. The default list only shows commonly-used and recently-used criteria; since the Pult Agent Version EA is brand new, click Show Advanced Criteria to reveal the full list, then select it.
5. Configure the criterion:
   • Operator: is not
   • Value: the agent version you're rolling out, e.g. 0.2.10-beta1
6. Click Save.

A Mac is in this group whenever its Pult Agent Version EA returns anything other than 0.2.10-beta1. That covers not_installed (missing), older versions (out of date), and, with REQUIRE_PKG_RECEIPT="true", no_pkg_receipt (installed manually from the .dmg, never got the .pkg) and pkg_version_mismatch (receipt older than REQUIRED_PKG_VERSION). Once the package installs successfully, the EA flips to 0.2.10-beta1 and the Mac falls out of the group automatically.

Step 4: Create the Policy

The Policy installs the wrapper package on every Mac in the Smart Group.

1. Go to Computers → Policies.
2. Click + New.
3. General tab:
   • Display Name: Install Pult Agent
   • Trigger: check Recurring Check-in
   • Execution Frequency: Ongoing
4. Packages tab: click Configure, add your wrapper package, set Action to Install.
5. Scope tab: scope the policy to the Pult Agent: Needs Install Smart Group from Step 3.
6. Maintenance tab (recommended): check Update Inventory so the EA refreshes immediately after install and the Mac falls out of scope on the next check-in.
7. Click Save.

Why "Ongoing" frequency

Ongoing lets the policy run every time the Mac checks in and is in the Smart Group's scope. Because the Smart Group only contains Macs missing the right version, the policy only actually fires when remediation is needed. After install, the EA reports the new version, the Mac leaves the Smart Group, and no further installs happen until the next version drift.

Step 5: Configure Managed Login Items

The wrapper .pkg already sets up launch at login: it installs the LaunchAgent together with the agent and the bootstrap token. Push a separate Configuration Profile that adds Pult Agent as a managed login item, so users can't switch launch at login off.

See macOS Auto-Start for the Jamf Pro steps.

Step 6: Verify

1. On a test Mac, force a check-in:

   sudo jamf policy

2. Confirm the package installs:
   • /Applications/Pult Agent.app exists.
   • The Pult Agent tray icon appears in the menu bar.
3. Check the Mac's record in Jamf Pro -- the Pult Agent Version EA should show 0.2.10-beta1 after the next inventory update.
4. In the Pult Dashboard, go to Settings → Presence → Device Authentication. A Pending Device Request should appear for the Mac.
5. Approve the request to complete enrollment.

Troubleshooting