Deploy the JumpCloud Agent with a Third-Party MDM Solution

This article describes the recommended method of installing the JumpCloud Agent on macOS devices using a third-party MDM solution. This method of unattended installation uses an install script provided on JumpCloud's GitHub. When properly configured, the script installs the JumpCloud Agent and the JumpCloud Service Account that is required to handle password synchronization.

Prerequisites: 

• The Privacy Preferences Policy Control (PPPC) profile must be present on each device on which you intend to deploy the JumpCloud Agent. This will give the agent the permissions required to handle PAM authentication responsibilities. See instructions for installing the PPPC profile in Grant Permissions for a Non-JumpCloud MDM.
• Your MDM solution must be able to either run Bash/zsh commands or create policies that deliver and run Bash/zsh scripts.
• You will need the username and password of an Admin account that has a secure token. Use the dscl utility in Terminal to verify the secure token status of an account:
  1. To find the usernames of user accounts on the device: dscl . -list /Users | grep -v "^_"
  2. To check the secure token status of a user, replacing USERNAME with a target username: dscl . -read /Users/USERNAME AuthenticationAuthority | grep "SecureToken"

Installing the Agent and Service Account Using the Install Script

Follow these steps to install the JumpCloud Agent and Service Account:

1. Copy the install script.
2. Paste the script into a text editor and update the undefined parameters.
3. Upload the install script into the MDM's administrator console.
4. Create and apply a policy to install the agent using the script.

Copying the Install Script

• Copy the install script: https://github.com/TheJumpCloud/support/blob/master/scripts/macos/install_agent_and_serviceaccount.sh.

Updating the Script

After copying the install script in the previous step, paste the contents into a text editor, and make the following changes:

1. At the top of the script, note there are three undefined parameters:
   1. CONNECT_KEY,
   2. SECURETOKEN_ADMIN_USERNAME, and
   3. SECURETOKEN_ADMIN_PASSWORD.
2. Replace the CONNECT_KEY value in the script with the JumpCloud Connect Key.
   1. To find the Connect Key, log in to the JumpCloud Admin Portal and go to DEVICE MANAGEMENT > Devices.
   2. Click ( + ) to add a device.
   3. Scroll to Connect Key and click copy.
   4. Paste the Connect Key into the CONNECT_KEY value field in the script.
3. Replace the SECURETOKEN_ADMIN_USERNAME and SECURETOKEN_ADMIN_PASSWORD values with the username and password of a pre-existing local Admin account that has a secure token.

4. After the three required parameters have been filled, set the SILENT_INSTALL parameter to 0 and the UNATTENDED_INSTALL parameter to 1. This allows the script to run without displaying interactive prompts, and will leverage the parameters defined above to create the JumpCloud Service Account.

Uploading the Script

• In in your MDM solution's administrator console, upload the configured install script. Refer to the vendor's documentation for support.

Applying the Script with a Policy

1. Apply the policy to a test Mac. Allow some time for the Mac to receive and execute the policy.
2. To verify the JumpCloud Agent has been installed successfully on the Mac, check that the device appears in the JumpCloud Admin Portal. See Bind Users to Devices to proceed to bind a user to the device.