> ## Documentation Index > Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt > Use this file to discover all available pages before exploring further. # Roll out with MDM > Make an install package in the dashboard, push its two profiles and the installer to a managed Mac fleet in the right order, and verify each machine. At the end of this page every scoped Mac has Quint installed, both system extensions approved without a prompt, and is joined to your organisation. You need an MDM that can push configuration profiles and a package, and the **Admin** or **Owner** role in the dashboard to make the package in [Add machines](https://docs.quintai.dev/install/add-machines.md). Step-by-step guides: [Microsoft Intune](https://docs.quintai.dev/install/mdm-intune.md), [Jamf Pro](https://docs.quintai.dev/install/mdm-jamf.md) and [Mosyle](https://docs.quintai.dev/install/mdm-mosyle.md). ## Before you start * Every targeted Mac on macOS 14 or later; the profiles need it. If the fleet also runs another vendor's content filter, macOS 15 or later is the safer floor. * Devices enrolled in your MDM with user approval. Automated Device Enrollment is not required, but read [the one remaining bypass](#the-one-remaining-bypass). ## What your MDM pushes | File | What it does | | - | - | | `quint-approvals.mobileconfig`, shown on the Mac as "Quint approvals" | Grants what the installer cannot grant itself: approval of both system extensions, Full Disk Access for the endpoint extension, authorization for the transparent proxy and network filter, and a lock on the login item. The same for every organisation; it holds no secret. | | `quint-enrollment-….mobileconfig`, shown as a "Quint enrollment" profile | Connects each Mac to your organisation. Holds the package's join code and your license. One enrollment profile per Mac. | | `quint-v1.1.29.pkg` | Installs **QuintAgent.app** with its two system extensions and the background service, then starts the service. Also writes a machine-wide Claude Code setting for every user on the Mac. The same for every organisation. | The profiles have to land first. On Quint 1.1.29, a Mac that gets the installer before its enrollment profile does not start Quint; install the package on that Mac again once the profile is there. Where your MDM cannot order them, run two deliberate passes: assign both profiles, confirm they landed, then assign the installer. > [!WARNING] > > macOS makes the enrollment profile's settings readable by every local user of the Mac, so the join code is readable on each Mac it reaches. It can only add computers to your organisation, up to the package's limit. If a copy leaks, stop the package in [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md). **1. Make the package** Open **Add machines**. Choose **Mac**, then **A device management tool (MDM)**, then your MDM, and name the package. Click **Make my files** and download every file; they can be downloaded once. The wizard's **Upload** step names where each goes in your MDM, as a checklist. **2. Upload the approvals profile** Upload `quint-approvals.mobileconfig` as a custom configuration profile at device level, and assign it to the group. **3. Upload the enrollment profile** Upload the `quint-enrollment-….mobileconfig` file the same way, to the same group. If your MDM takes custom settings for a preference domain instead of a profile, use the domain `com.quint.security` and upload `com.quint.security.plist`. Use one or the other, not both. **4. Confirm the profiles landed** On one target Mac, **System Settings › General › Device Management** (on macOS 14, **Privacy & Security › Profiles**) lists "Quint approvals" and "Quint enrollment". **5. Assign the installer** Add the installer to your MDM as a package and assign it to the same group. **6. Verify each machine** The wizard's **First computer** step shows the first Mac's checks. Then open **Data Sources**: each Mac appears under **Telemetry by host** with its **Capture layers** and **Last seen**. [Verify a machine](https://docs.quintai.dev/install/verify-and-troubleshoot.md) explains each state. **7. Stop the package when the group is done** On [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md), click **Stop new computers joining** on the package. Macs that already joined keep running. Make a new package for the next group. Do not revoke the package's token under **Settings › API tokens**: that disconnects every Mac it enrolled. ## Where each MDM puts the files Mosyle is partly tested: the approvals profile and the installer have been pushed through Mosyle with no click on the Mac. Every other MDM is early access. For Jamf Pro, Intune and Mosyle, see [Jamf Pro](https://docs.quintai.dev/install/mdm-jamf.md), [Microsoft Intune](https://docs.quintai.dev/install/mdm-intune.md) and [Mosyle](https://docs.quintai.dev/install/mdm-mosyle.md). | MDM | Profiles | Installer | | - | - | - | | Iru (formerly Kandji) | **Library › Add new › Custom Profile**, once for each profile, assigned to your Blueprint | **Library › Add new › Custom App**, **Installation**: install once per device, the same Blueprint | | Mosyle | **Management › Custom Profiles › Add new profile**, once for each profile | **Management › Install PKG**, added by its public link; see [Mosyle](https://docs.quintai.dev/install/mdm-mosyle.md) | | Another MDM | Its custom configuration profiles, at device level | Its package or app deployment, the same computers | ## The one remaining bypass A user can unenroll the Mac from MDM, which removes every profile and approval at once. Only Automated Device Enrollment can make enrollment non-removable, and only when your MDM's option to prevent unenrollment is switched on: **Locked enrollment** in [Intune](https://docs.quintai.dev/install/mdm-intune.md), or **Prevent users from removing MDM profile** in [Jamf Pro](https://docs.quintai.dev/install/mdm-jamf.md). On user-approved enrollment that door stays open. Quint records and detects; it does not stop a user with local administrator rights. ## Uninstall on an MDM-managed Mac Order is the whole procedure: the endpoint is removed first, while both Quint profiles are still assigned, and the profiles are unassigned last. See [Remove a machine](https://docs.quintai.dev/install/remove-a-machine.md). ## If this fails | What you see | What it means | What to do | | - | - | - | | macOS prompts to allow a system extension | The installer landed before the approvals profile | Confirm "Quint approvals" is listed under **System Settings › General › Device Management** (on macOS 14, **Privacy & Security › Profiles**), then log out and back in to retry activation. | | A Mac installs but never appears in **Data Sources** | The installer landed before the enrollment profile, or the package is no longer **Active** | Confirm "Quint enrollment" is listed on the Mac, then install the package again. Check the package's status in [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md). | | The Mac is not under **Data Sources** | Events are not reaching Quint | Check outbound HTTPS from the Mac. | ## Next * [Verify a machine](https://docs.quintai.dev/install/verify-and-troubleshoot.md) * [Remove a machine](https://docs.quintai.dev/install/remove-a-machine.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.