Roll out with Jamf Pro

Deploy a Quint install package to Jamf Pro-managed Macs: two uploaded configuration profiles, the installer delivered by a policy, and the order that keeps the system extensions prompt-free.

At the end of this page every Mac in your Jamf Pro scope has Quint installed, both system extensions approved without a prompt, and is joined to your organisation. For what each file does, see Roll out with MDM.

Jamf Pro is early access. If any step needed a click on the Mac, tell Quint support.

​

Before you start

• Macs on macOS 14 or later, enrolled in Jamf Pro, with user-approved MDM or Automated Device Enrollment.
• If the fleet also runs another vendor’s content filter, macOS 15 or later is the safer floor.
• A Jamf Pro account that can upload configuration profiles and packages and create policies. Uploading packages needs a cloud distribution point.
• The Admin or Owner role in the Quint dashboard, to make the package.

1. Make the package

   In Quint, open Add machines. Choose Mac, then A device management tool (MDM), then Jamf Pro, and name the package for the group. Click Make my files and download every file: quint-approvals.mobileconfig, the quint-enrollment-….mobileconfig file and the Mac installer. See Add machines.

2. Upload the approvals profile

   Open Computers › Configuration Profiles, select Upload, and choose quint-approvals.mobileconfig. Scope it to the computers you are adding, then Save.

3. Upload the enrollment profile

   Upload the quint-enrollment-….mobileconfig file the same way, with the same scope, then Save.

4. Confirm the profiles landed

   On one Mac in scope, open System Settings › General › Device Management (on macOS 14, Privacy & Security › Profiles). “Quint approvals” and “Quint enrollment” are listed. Wait for this before the installer reaches Macs that are already enrolled.

5. Upload the installer

   Open Settings › Computer management › Packages, select New, and upload quint-v1.1.29.pkg.

6. Deliver the installer with a policy

   Open Computers › Policies and create a policy:

   • General: name it “Install Quint”, with the triggers Enrollment Complete and Recurring Check-in, and the execution frequency Once per computer.
   • Packages: add the Quint package with the action Install.
   • Scope: the same computers as the profiles.

   To make sure the installer goes only to Macs that already have the profiles, scope the policy to a smart computer group with the criterion Profile Name set to the enrollment profile’s name as Jamf Pro lists it. A Mac joins the group when Jamf Pro records the profile in its inventory; if a Mac with the profile is missing from the group, update its inventory.

7. Verify each machine

   The wizard’s First computer step shows the first Mac’s checks. Then open Data Sources: each Mac appears under Telemetry by host with its Capture layers and Last seen. Verify a machine explains each state.

​

New Macs: PreStage enrollment

For Macs enrolled through Automated Device Enrollment, also add both Quint profiles to the PreStage enrollment, under Computers › PreStage enrollments and its Configuration profiles. The profiles’ scope must include the PreStage’s computers. The policy above then installs the package once the profiles are on the Mac.

A package admits new computers for one year from the day it is made, up to its limit. Machines & licensing shows both. When it is full, expired or stopped, make a new package, and put its enrollment profile in the PreStage and the policy’s scope in place of the old one. Each package’s enrollment profile has its own identifier, shown under Details in Machines & licensing.

​

Prevent unenrollment

In the PreStage enrollment’s General settings, turn on Make MDM profile mandatory and Prevent users from removing MDM profile. A Mac enrolled that way keeps its MDM profile, and with it the Quint approvals. These apply when a Mac enrolls. On user-approved enrollment, see the one remaining bypass.

​

If this fails

What you see	What it means	What to do
macOS prompts to allow a system extension	The installer landed before the approvals profile	Confirm “Quint approvals” is under System Settings › General › Device Management (on macOS 14, Privacy & Security › Profiles), then log out and back in.
Jamf Pro shows an alert about unknown keys on upload	Jamf Pro does not recognize some keys in an unsigned profile, and may drop them	Before any Mac in scope has the installer, delete the profile, sign the file, for example with your organization’s signing certificate, and upload it again. A signed profile is deployed unmodified.
The policy reports a failed install	The package could not be installed on that Mac	Open the policy’s logs for that computer, and confirm the package uploaded completely.
A Mac installs but never appears in Data Sources	The installer landed before the enrollment profile, or the package is no longer Active	Confirm “Quint enrollment” is on the Mac, then flush the policy for that computer so it installs again. Check the package in Machines & licensing.

​

Remove the endpoint

Remove the endpoint first, while both Quint profiles are still scoped, and remove the profiles from scope last. See Remove a machine.