Documentation · MDM runbook

Jamf Pro runbook

Deploy BeProof app, PPPC profile, and org-policy overlay to a pilot smart group.

Prerequisites: Jamf Pro 11+, macOS 14+ Apple Silicon endpoints, signed BeProof PKG or DMG.

1. Build or obtain PKG

From a signed app bundle:

./scripts/build_mdm_pkg.sh \
  --app dist/app/BeProofApp.app \
  --version 1.0.5 \
  --output dist/app/BeProofApp-macos.pkg \
  --signing-identity "Developer ID Installer: Your Org (TEAMID)"

Or upload the notarized DMG and use Jamf's App Store & Volume Purchase / Package workflow with a post-install script equivalent.

2. Upload packages & profiles

Item	Jamf location	File
App PKG	Settings → Computer Management → Packages	`BeProofApp-macos.pkg`
PPPC	Settings → Configuration Profiles	Signed com.beproof.app.pppc.mobileconfig
Org overlay	Settings → Computer Management → Scripts or Files and Processes	org-policy-overlay.example.json (customize first)

3. Org-policy overlay (managed JSON)

Create a Policy (or Configuration Profile with script payload):

Script (run as root, frequency: ongoing / at enrollment):

#!/bin/bash
set -euo pipefail
ORG_DIR="/Library/Application Support/BeProof"
OVERLAY="/path/to/your/org-policy-overlay.json"  # host on Jamf CDN or bake into script
mkdir -p "$ORG_DIR"
cp "$OVERLAY" "$ORG_DIR/org-policy-overlay.json"
chmod 644 "$ORG_DIR/org-policy-overlay.json"

Target path (required by BeProof):

/Library/Application Support/BeProof/org-policy-overlay.json

Alternative: Jamf Extension Attributes + File Upload policy template if your tenant supports managed file delivery to fixed paths.

4. Policy scope (recommended order)

PPPC profile → Pilot smart group
PKG install → Same group, reboot not required
Org overlay script → After PKG
Optional CLI → Separate policy: install Homebrew tap or deploy beproof binary to /usr/local/bin

5. Verification

On a pilot Mac:

/Applications/BeProofApp.app/Contents/MacOS/BeProofApp &  # or open app
beproof verify-install --app /Applications/BeProofApp.app --format json
beproof scan --root ~/Projects
beproof evaluate-policy --format json | jq '{auditMode, scanScopeSource, orgPolicyId}'

Expected when overlay deployed: auditMode: "managed", scanScopeSource: "mdm_profile".

Jamf inventory: add Extension Attribute reading overlay presence:

[[ -f "/Library/Application Support/BeProof/org-policy-overlay.json" ]] && echo "present" || echo "missing"

6. Updates

Pin PKG version per pilot ring; promote after verify-install passes on sample devices.
In-app Sparkle updates are disabled automatically when managed mode is active; use MDM PKG for version promotion.

See also: PPPC.md · deploy README