Silent Fleet Deployment of the Origin Agent via Jamf Pro

This guide walks you through a fully silent, fleet-wide deployment of the Origin macOS agent using Jamf Pro. You’ll upload one configuration profile that pre-approves the permissions the agent needs, stage a provisioning JWT via a Jamf script, and create an install policy that fires at enrollment — with no user interaction at any step.

Prerequisites

Confirm the following before proceeding:

Jamf Pro admin access with scope permitting configuration profile creation, package upload, policy creation, and script creation.
A valid Origin provisioning JWT — obtain from the Origin console under Settings → Provisioning Tokens.
The Origin macOS installer — download from the Origin console under Settings → Installers. Delivered as Origin.pkg.
The PPPC configuration profile and install script from the deployment package (see Step 3).
Target macOS devices enrolled in Jamf Pro with User-Approved MDM (UAMDM).

The installer and the provisioning token live in two different Settings views — Installers for the .pkg, Provisioning Tokens for the JWT. Tokens carry an expiry and a use limit, so confirm both cover your rollout before you begin.Deployment package download: drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF

Scope of automation

Two macOS permissions stand between the installer and a fully registered agent. MDM pre-approves both — no user interaction is required for either.

Permission	Pre-approved by profile?	User action
Full Disk Access	Yes	None
Endpoint Security Client	Yes	None

Deploying the PPPC profile before the package installs ensures the agent registers silently without any user-facing prompts.

Files

Download from drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF. Both files can be used as-is — no per-tenant customization is needed.

File	Purpose
`origin-privacy.mobileconfig`	PPPC profile — grants Full Disk Access and Endpoint Security to the Origin agent.
`jamf-install-origin.sh`	Pre-install shell script that stages the provisioning JWT for the `.pkg` postinstall.

The bundle may also contain a proxy root CA template, a system-extensions policy, and a VPN/transparent-proxy profile from Origin’s earlier proxy-based capture architecture. Do not deploy these — they are no longer required.

Identifiers

Identifier	Value
Team ID	`D3C73MWD7Y`
Agent bundle ID	`com.origin.agent`

Deployment order

The configuration profile must land on the endpoint before the .pkg installs — otherwise the agent hits permission prompts during registration and the silent-install chain breaks.

Privacy preferences (PPPC) (origin-privacy.mobileconfig) — Grants Full Disk Access and Endpoint Security to the Origin agent based on Team ID D3C73MWD7Y and bundle ID com.origin.agent. Eliminates TCC prompts that would otherwise appear on first run.
The Origin .pkg (via policy) (Origin.pkg) — The installer itself, deployed via a Jamf policy with the install script running before the package to stage the provisioning JWT.

Jamf Pro walkthrough

01. Upload the configuration profile

The .mobileconfig must be uploaded as a raw custom profile. Do not use Jamf’s built-in PPPC payload editor — it rewrites the XML and breaks the code requirements.

The Upload button is on the Configuration Profiles list page (Computers → Configuration Profiles), not inside the New Profile editor. Navigate to the list first, then click Upload to import a raw .mobileconfig.

Jamf Pro → Computers → Configuration Profiles.
Click Upload on the list page.
Upload origin-privacy.mobileconfig.
Under the Scope tab, add your target devices or Smart Group.
Click Save.

Before moving to package installation, confirm the profile is installed using either method:UI: On the Mac go to System Settings → Privacy & Security → Profiles (or search “Device Management”). The Privacy Preferences profile should appear in the managed profiles list.Terminal:

sudo profiles show -all | grep -i "origin"

Do not proceed until it is confirmed.

02. Upload the Origin package

Jamf Pro → Settings → Computer Management → Packages → Upload Package.
Upload Origin.pkg.
Leave defaults (Category, Priority, Fill User Template, etc.) unless you have site-specific conventions.
Click Save.

03. Create the install script

The script stages the provisioning JWT to /var/tmp/origin-provisioning-jwt so the .pkg postinstall can read it silently. The file is deleted after use.

Jamf Pro → Settings → Scripts → New.
Name the script Origin Installer.
On the Script tab, paste the contents below, replacing the empty JWT="" value with your provisioning token from Settings → Provisioning Tokens.
Click Save.

#!/bin/bash
# Origin Agent -- Jamf Silent Install Script
# Stages the JWT for the .pkg postinstall to read.
# The postinstall deletes the file after use.
set -euo pipefail
####################################################################
# EDIT THIS: paste your provisioning JWT between the quotes
JWT=""
####################################################################
if [[ -z "$JWT" ]]; then
  echo "Error: JWT not configured. Edit the script and set the JWT variable."
  exit 1
fi
JWT_FILE="/var/tmp/origin-provisioning-jwt"
install -m 600 /dev/null "$JWT_FILE"
echo "$JWT" > "$JWT_FILE"
echo "JWT staged for Origin installer."

Why the token lives in the script bodyJamf script parameters are capped at 255 characters, which is too short for a provisioning JWT. The token goes directly into the script body. Any Jamf admin with script-view permissions will be able to read it — scope admin permissions accordingly.

04. Create the install policy

Navigate to Jamf Pro → Computers → Policies → New and configure the following tabs:General tab

Field	Value
Display Name	Install Origin Agent
Trigger	Custom event: `install-origin` and Enrollment Complete
Execution Frequency	Once per computer

Packages tab

Field	Value
Package	`Origin.pkg`
Action	Install

Scripts tab

Field	Value
Script	Origin Installer
Priority	Before

Scope tab

Field	Value
Target	Add the same target devices or Smart Group used for the configuration profile. Click Save.

Script priority must be Before. If the script runs After the package, the JWT file won’t exist when the postinstall needs it and the installer will fall back to the GUI prompt. Double-check the priority before saving.

05. Trigger the policy

On a target device, run the custom trigger from Terminal:

sudo jamf policy -event install-origin

Running sudo jamf policy -event install-origin manually will prompt for interactive password authentication on the endpoint. If you prefer the install to run without any user interaction, wait for the device to check in naturally — on enrollment complete or the next recurring check-in — rather than forcing it.

The script stages the JWT → Jamf installs the .pkg → the postinstall reads the staged JWT and registers silently → the JWT file is deleted. The MDM profile handles the permission grants with no user interaction required.

Verification

Run these on a target endpoint after the policy completes.Profile installed

sudo profiles show -all | grep -i "origin"

Should return the Origin Privacy Preferences profile.Agent process running

pgrep -x origin

Returns a PID when the agent is running.Agent log tail

cat /Library/Origin/logs/agent.log.$(date -u +%Y-%m-%d)

Prints today’s agent log — useful for confirming the agent started cleanly, registration succeeded, and there are no errors after install.Once the agent is running, the Origin menu bar icon appears. Click it to confirm the agent is active and to access two operator-friendly checks without dropping to Terminal:

Generate diagnostic report — bundles agent state, recent logs, and registration status into a single file you can hand to Origin support.
View logs — opens the local log directory directly.

Origin console verificationIn the Origin console, go to Settings → Endpoint Inventory and search for the target hostname. A successfully registered endpoint appears with a recent last-seen time and its detected AI agents populated.

Troubleshooting

Profile shows “Failed” in Jamf

Check the error in the device’s Management History. The two most common causes:

Profile recreated in Jamf’s payload editor — re-upload the raw .mobileconfig from the deployment package instead.
Profile stuck pending — run sudo jamf policy on the device to force a check-in.

Full Disk Access not granted despite profile

Verify the profile actually installed:

sudo profiles show -all | grep -i "origin"

The PPPC profile’s code requirement matches Developer ID signed builds with Team ID D3C73MWD7Y. Ad-hoc signed or internal development builds won’t match and Full Disk Access will not pre-grant.

JWT prompt still appears on install

Verify the script ran successfully — check the policy logs in Jamf Pro.
Confirm script priority is Before, not After.
On the endpoint, confirm the file existed before the .pkg ran: /var/tmp/origin-provisioning-jwt.
Confirm the token hasn’t expired or exhausted its use limit — check Settings → Provisioning Tokens.

Alternative deployment paths

Kandji

Library → Add New → Custom Profile for origin-privacy.mobileconfig.
Assign to device blueprints.
Add the .pkg as a Custom App.
Use a pre-install script to stage the JWT (same pattern as the Jamf script above).

Headless CLI install

For scripted deployments outside of any MDM — useful for lab environments, golden-image prep, or emergency reinstalls:

echo "eyJ..." > /var/tmp/origin-provisioning-jwt
chmod 600 /var/tmp/origin-provisioning-jwt
installer -pkg Origin.pkg -target /

The postinstall reads the JWT from the staged file and skips the GUI prompt. The file is deleted after use.

Without the PPPC profile, the end user will see permission prompts on first run. This path is best reserved for managed endpoints that already have the profile, or lab machines where the prompts are acceptable.

Overview

Console Setup

AI Provider Integration

Agent Installation

MDM Deployment

Silent Fleet Deployment of the Origin Agent via Jamf Pro

01. Upload the configuration profile

02. Upload the Origin package

03. Create the install script

04. Create the install policy

05. Trigger the policy

Origin menu bar icon

Profile shows “Failed” in Jamf

Full Disk Access not granted despite profile

JWT prompt still appears on install

Kandji

Headless CLI install

​01. Upload the configuration profile

​02. Upload the Origin package

​03. Create the install script

​04. Create the install policy

​05. Trigger the policy

​Origin menu bar icon

​Profile shows “Failed” in Jamf

​Full Disk Access not granted despite profile

​JWT prompt still appears on install

​Kandji

​Headless CLI install

01. Upload the configuration profile

02. Upload the Origin package

03. Create the install script

04. Create the install policy

05. Trigger the policy

Origin menu bar icon

Profile shows “Failed” in Jamf

Full Disk Access not granted despite profile

JWT prompt still appears on install

Kandji

Headless CLI install