Skip to main content
At the end of this page every Mac in your Jamf Pro scope has Quint installed, both system extensions approved without a prompt, and is joined to your organisation. For what each file does, see Roll out with MDM.
Jamf Pro is early access. If any step needed a click on the Mac, tell Quint support.

​
Before you start

  • Macs on macOS 14 or later, enrolled in Jamf Pro, with user-approved MDM or Automated Device Enrollment.
  • If the fleet also runs another vendor’s content filter, macOS 15 or later is the safer floor.
  • A Jamf Pro account that can upload configuration profiles and packages and create policies. Uploading packages needs a cloud distribution point.
  • The Admin or Owner role in the Quint dashboard, to make the package.
1

Make the package

In Quint, open Add machines. Choose Mac, then A device management tool (MDM), then Jamf Pro, and name the package for the group. Click Make my files and download every file: quint-approvals.mobileconfig, the quint-enrollment-….mobileconfig file and the Mac installer. See Add machines.
2

Upload the approvals profile

Open Computers › Configuration Profiles, select Upload, and choose quint-approvals.mobileconfig. Scope it to the computers you are adding, then Save.
3

Upload the enrollment profile

Upload the quint-enrollment-….mobileconfig file the same way, with the same scope, then Save.
4

Confirm the profiles landed

On one Mac in scope, open System Settings › General › Device Management (on macOS 14, Privacy & Security › Profiles). “Quint approvals” and “Quint enrollment” are listed. Wait for this before the installer reaches Macs that are already enrolled.
5

Upload the installer

Open Settings › Computer management › Packages, select New, and upload quint-v1.1.29.pkg.
6

Deliver the installer with a policy

Open Computers › Policies and create a policy:
  • General: name it “Install Quint”, with the triggers Enrollment Complete and Recurring Check-in, and the execution frequency Once per computer.
  • Packages: add the Quint package with the action Install.
  • Scope: the same computers as the profiles.
To make sure the installer goes only to Macs that already have the profiles, scope the policy to a smart computer group with the criterion Profile Name set to the enrollment profile’s name as Jamf Pro lists it. A Mac joins the group when Jamf Pro records the profile in its inventory; if a Mac with the profile is missing from the group, update its inventory.
7

Verify each machine

The wizard’s First computer step shows the first Mac’s checks. Then open Data Sources: each Mac appears under Telemetry by host with its Capture layers and Last seen. Verify a machine explains each state.

​
New Macs: PreStage enrollment

For Macs enrolled through Automated Device Enrollment, also add both Quint profiles to the PreStage enrollment, under Computers › PreStage enrollments and its Configuration profiles. The profiles’ scope must include the PreStage’s computers. The policy above then installs the package once the profiles are on the Mac. A package admits new computers for one year from the day it is made, up to its limit. Machines & licensing shows both. When it is full, expired or stopped, make a new package, and put its enrollment profile in the PreStage and the policy’s scope in place of the old one. Each package’s enrollment profile has its own identifier, shown under Details in Machines & licensing.

​
Prevent unenrollment

In the PreStage enrollment’s General settings, turn on Make MDM profile mandatory and Prevent users from removing MDM profile. A Mac enrolled that way keeps its MDM profile, and with it the Quint approvals. These apply when a Mac enrolls. On user-approved enrollment, see the one remaining bypass.

​
If this fails

​
Remove the endpoint

Remove the endpoint first, while both Quint profiles are still scoped, and remove the profiles from scope last. See Remove a machine.