Skip to main content
At the end of this page every scoped Mac has Quint installed, both system extensions approved without a prompt, and is joined to your organisation. You need an MDM that can push configuration profiles and a package, and the Admin or Owner role in the dashboard to make the package in Add machines. Step-by-step guides: Microsoft Intune, Jamf Pro and Mosyle.

​
Before you start

  • Every targeted Mac on macOS 14 or later; the profiles need it. If the fleet also runs another vendor’s content filter, macOS 15 or later is the safer floor.
  • Devices enrolled in your MDM with user approval. Automated Device Enrollment is not required, but read the one remaining bypass.

​
What your MDM pushes

The profiles have to land first. On Quint 1.1.29, a Mac that gets the installer before its enrollment profile does not start Quint; install the package on that Mac again once the profile is there. Where your MDM cannot order them, run two deliberate passes: assign both profiles, confirm they landed, then assign the installer.
macOS makes the enrollment profile’s settings readable by every local user of the Mac, so the join code is readable on each Mac it reaches. It can only add computers to your organisation, up to the package’s limit. If a copy leaks, stop the package in Machines & licensing.
1

Make the package

Open Add machines. Choose Mac, then A device management tool (MDM), then your MDM, and name the package. Click Make my files and download every file; they can be downloaded once. The wizard’s Upload step names where each goes in your MDM, as a checklist.
2

Upload the approvals profile

Upload quint-approvals.mobileconfig as a custom configuration profile at device level, and assign it to the group.
3

Upload the enrollment profile

Upload the quint-enrollment-….mobileconfig file the same way, to the same group. If your MDM takes custom settings for a preference domain instead of a profile, use the domain com.quint.security and upload com.quint.security.plist. Use one or the other, not both.
4

Confirm the profiles landed

On one target Mac, System Settings › General › Device Management (on macOS 14, Privacy & Security › Profiles) lists “Quint approvals” and “Quint enrollment”.
5

Assign the installer

Add the installer to your MDM as a package and assign it to the same group.
6

Verify each machine

The wizard’s First computer step shows the first Mac’s checks. Then open Data Sources: each Mac appears under Telemetry by host with its Capture layers and Last seen. Verify a machine explains each state.
7

Stop the package when the group is done

On Machines & licensing, click Stop new computers joining on the package. Macs that already joined keep running. Make a new package for the next group. Do not revoke the package’s token under Settings › API tokens: that disconnects every Mac it enrolled.

​
Where each MDM puts the files

Mosyle is partly tested: the approvals profile and the installer have been pushed through Mosyle with no click on the Mac. Every other MDM is early access. For Jamf Pro, Intune and Mosyle, see Jamf Pro, Microsoft Intune and Mosyle.

​
The one remaining bypass

A user can unenroll the Mac from MDM, which removes every profile and approval at once. Only Automated Device Enrollment can make enrollment non-removable, and only when your MDM’s option to prevent unenrollment is switched on: Locked enrollment in Intune, or Prevent users from removing MDM profile in Jamf Pro. On user-approved enrollment that door stays open. Quint records and detects; it does not stop a user with local administrator rights.

​
Uninstall on an MDM-managed Mac

Order is the whole procedure: the endpoint is removed first, while both Quint profiles are still assigned, and the profiles are unassigned last. See Remove a machine.

​
If this fails

​
Next