Roll out with MDM

Make an install package in the dashboard, push its two profiles and the installer to a managed Mac fleet in the right order, and verify each machine.

At the end of this page every scoped Mac has Quint installed, both system extensions approved without a prompt, and is joined to your organisation. You need an MDM that can push configuration profiles and a package, and the Admin or Owner role in the dashboard to make the package in Add machines. Step-by-step guides: Microsoft Intune, Jamf Pro and Mosyle.

​

Before you start

• Every targeted Mac on macOS 14 or later; the profiles need it. If the fleet also runs another vendor’s content filter, macOS 15 or later is the safer floor.
• Devices enrolled in your MDM with user approval. Automated Device Enrollment is not required, but read the one remaining bypass.

​

What your MDM pushes

File	What it does
quint-approvals.mobileconfig, shown on the Mac as “Quint approvals”	Grants what the installer cannot grant itself: approval of both system extensions, Full Disk Access for the endpoint extension, authorization for the transparent proxy and network filter, and a lock on the login item. The same for every organisation; it holds no secret.
quint-enrollment-….mobileconfig, shown as a “Quint enrollment” profile	Connects each Mac to your organisation. Holds the package’s join code and your license. One enrollment profile per Mac.
quint-v1.1.29.pkg	Installs QuintAgent.app with its two system extensions and the background service, then starts the service. Also writes a machine-wide Claude Code setting for every user on the Mac. The same for every organisation.

The profiles have to land first. On Quint 1.1.29, a Mac that gets the installer before its enrollment profile does not start Quint; install the package on that Mac again once the profile is there. Where your MDM cannot order them, run two deliberate passes: assign both profiles, confirm they landed, then assign the installer.

macOS makes the enrollment profile’s settings readable by every local user of the Mac, so the join code is readable on each Mac it reaches. It can only add computers to your organisation, up to the package’s limit. If a copy leaks, stop the package in Machines & licensing.

1. Make the package

   Open Add machines. Choose Mac, then A device management tool (MDM), then your MDM, and name the package. Click Make my files and download every file; they can be downloaded once. The wizard’s Upload step names where each goes in your MDM, as a checklist.

2. Upload the approvals profile

   Upload quint-approvals.mobileconfig as a custom configuration profile at device level, and assign it to the group.

3. Upload the enrollment profile

   Upload the quint-enrollment-….mobileconfig file the same way, to the same group. If your MDM takes custom settings for a preference domain instead of a profile, use the domain com.quint.security and upload com.quint.security.plist. Use one or the other, not both.

4. Confirm the profiles landed

   On one target Mac, System Settings › General › Device Management (on macOS 14, Privacy & Security › Profiles) lists “Quint approvals” and “Quint enrollment”.

5. Assign the installer

   Add the installer to your MDM as a package and assign it to the same group.

6. Verify each machine

   The wizard’s First computer step shows the first Mac’s checks. Then open Data Sources: each Mac appears under Telemetry by host with its Capture layers and Last seen. Verify a machine explains each state.

7. Stop the package when the group is done

   On Machines & licensing, click Stop new computers joining on the package. Macs that already joined keep running. Make a new package for the next group. Do not revoke the package’s token under Settings › API tokens: that disconnects every Mac it enrolled.

​

Where each MDM puts the files

Mosyle is partly tested: the approvals profile and the installer have been pushed through Mosyle with no click on the Mac. Every other MDM is early access. For Jamf Pro, Intune and Mosyle, see Jamf Pro, Microsoft Intune and Mosyle.

MDM	Profiles	Installer
Iru (formerly Kandji)	Library › Add new › Custom Profile, once for each profile, assigned to your Blueprint	Library › Add new › Custom App, Installation: install once per device, the same Blueprint
Mosyle	Management › Custom Profiles › Add new profile, once for each profile	Management › Install PKG, added by its public link; see Mosyle
Another MDM	Its custom configuration profiles, at device level	Its package or app deployment, the same computers

​

The one remaining bypass

A user can unenroll the Mac from MDM, which removes every profile and approval at once. Only Automated Device Enrollment can make enrollment non-removable, and only when your MDM’s option to prevent unenrollment is switched on: Locked enrollment in Intune, or Prevent users from removing MDM profile in Jamf Pro. On user-approved enrollment that door stays open. Quint records and detects; it does not stop a user with local administrator rights.

​

Uninstall on an MDM-managed Mac

Order is the whole procedure: the endpoint is removed first, while both Quint profiles are still assigned, and the profiles are unassigned last. See Remove a machine.

​

If this fails

What you see	What it means	What to do
macOS prompts to allow a system extension	The installer landed before the approvals profile	Confirm “Quint approvals” is listed under System Settings › General › Device Management (on macOS 14, Privacy & Security › Profiles), then log out and back in to retry activation.
A Mac installs but never appears in Data Sources	The installer landed before the enrollment profile, or the package is no longer Active	Confirm “Quint enrollment” is listed on the Mac, then install the package again. Check the package’s status in Machines & licensing.
The Mac is not under Data Sources	Events are not reaching Quint	Check outbound HTTPS from the Mac.

​

Next

• Verify a machine
• Remove a machine