Create a Device Level macOS Managed Login Items Policy

Apple has made a change in macOS 13 Ventura that affects JumpCloud and IT Admins. In macOS 13 Ventura, end users have the ability to switch off persistent software, such as the JumpCloud agent. JumpCloud has implemented new processes to address this concern, which vary depending on the configuration of your organization. 

Prerequisites

• Apple Mobile Device Management (MDM) must be configured for your organization and Mac computers must be enrolled in JumpCloud MDM. See Set up Apple MDM. 
• Devices must have an active network connection for this policy to take effect.

Considerations

• The policy configuration settings are applied automatically and do not require a system restart.

Prepare Your Organization

Depending on how your organization manages its macOS devices, the actions you must take to ensure smooth operation vary:

• If you are using JumpCloud’s MDM with your macOS Devices - JumpCloud will automatically prepare the JumpCloud Agent for this macOS 13 feature.
• If you are using JumpCloud in addition to another MDM - JumpCloud provides a Managed Login Items policy that, once configured, prevents users from disabling persistent software. See below. 
• If you are using JumpCloud with no MDM - It is incumbent on you as the systems admin to counsel your users to not disable the JumpCloud items in the Login Items section of macOS 13 Ventura’s System Settings. JumpCloud recommends that you use an MDM to manage your macOS devices as it allows you to securely and remotely configure your organization’s devices and update software and device settings. For more information, see Get Started: MDM.  

Understand the Managed Login Items Policy 

To prevent your macOS users from turning off persistent software such as the JumpCloud Agent, you must configure the Managed Login Items Policy. This policy allows Admins to allowlist login items for macOS devices based on RuleTypes defined by Apple:

• Bundle Identifier - Unique identifier for a given application, often written in reverse domain notation, such as com.jumpcloud.darwin-agent. If a Bundle Identifier Prefix rule type is selected, a rule value of com.jumpcloud would allow any package with a Bundle Identifier that starts with com.jumpcloud, such as com.jumpcloud.assist-app or com.jumpcloud.pwm.desktop.live.
• Launchd plist label - Unique identifier for a given launchd automated process. If a Launchd Label Prefix rule type is selected, a rule value of com.jumpcloud will allow any launched item with a label prefix of com.jumpcloud to operate, including com.jumpcloud.jcagent-tray or com.jumpcloud.user-agent.
• Apple Codesigning Team Identifier

Login items managed by this policy installed on macOS 13 systems or later will always be activated and the end user of the device cannot deactivate these items, even if they are administrators of their device.  All items are evaluated against all RuleTypes and when matched it will be locked in the UI  and automatically approved.

Creating the Policy

To create a Managed Login Items policy for Mac computers, do the following:

Selecting the Policy Template

1. Log in to the JumpCloud Admin portal.

2. Go to Device Management > Policy Management. The Policy Management page is displayed.
3. On the Policy Management page, click +Add New.
4. Select Device Policy to assign the policy to devices and device groups. On the New Device Policy page:
   • Select the macOS tab.
   • Search and select the required policy and click Configure. The Details tab of the policy is displayed.
   • On the Details tab, configure the required policy configuration settings.
   • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
   • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy

• Select a Rule Type:
  • Bundle Identifier - The bundle identifier of the app to match, which must be an exact match.
  • Bundle Identifier Prefix - The prefix of the bundle identifier of the app to match.
  • Label - The value of the launchd plist Label parameter to match, which must be an exact match.
  • Label Prefix - The prefix of the launchd plist Label parameter to match.
  • Team Identifier - The team identifier from the code signing attributes, which must be an exact match.

• Enter a Rule Value. For example, the rule value for BundleIdentifier is the unique identifier for the application, generally in reverse domain notation, such as com.jumpcloud.darwin-agent.

Applying the Policy

• (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy. 
• Select the Device Groups tab. Select one or more device groups where you want to apply this policy. For device groups with multiple OS member types, the policy only applies when a user logs into a supported Mac computer that is enrolled in Apple MDM.
• Or, select the Devices tab. Select one or more devices whom you want to add this policy to.
• Click Create Policy. A success message is displayed indicating the completion of policy creation.

Viewing Policy Status

1. Select the Status tab.
2. To see the last Result Log for a device where this policy is applied, click view.