> ## Documentation Index
> Fetch the complete documentation index at: https://docs.originhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Silent Fleet Deployment of the Origin Agent via Jamf Pro

> Silently deploy the Origin macOS agent fleet-wide using Jamf Pro — one PPPC profile, a JWT staging script, and a zero-touch install policy.

This guide walks you through a fully silent, fleet-wide deployment of the Origin macOS agent using Jamf Pro. You'll upload one configuration profile that pre-approves the permissions the agent needs, stage a provisioning JWT via a Jamf script, and create an install policy that fires at enrollment — with no user interaction at any step.

<Steps>
  <Step title="Prerequisites">
    Confirm the following before proceeding:

    * **Jamf Pro admin access** with scope permitting configuration profile creation, package upload, policy creation, and script creation.
    * **A valid Origin provisioning JWT** — obtain from the Origin console under **Settings → Provisioning Tokens**.
    * **The Origin macOS installer** — download from the Origin console under **Settings → Installers**. Delivered as `Origin.pkg`.
    * **The PPPC configuration profile and install script** from the deployment package (see Step 3).
    * **Target macOS devices enrolled in Jamf Pro** with User-Approved MDM (UAMDM).

    <Note>
      The installer and the provisioning token live in **two different Settings views** — Installers for the `.pkg`, Provisioning Tokens for the JWT. Tokens carry an expiry and a use limit, so confirm both cover your rollout before you begin.

      **Deployment package download:** [drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF](https://drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF)
    </Note>
  </Step>

  <Step title="Scope of automation">
    Two macOS permissions stand between the installer and a fully registered agent. MDM pre-approves both — no user interaction is required for either.

    | Permission               | Pre-approved by profile? | User action |
    | ------------------------ | ------------------------ | ----------- |
    | Full Disk Access         | Yes                      | None        |
    | Endpoint Security Client | Yes                      | None        |

    Deploying the PPPC profile before the package installs ensures the agent registers silently without any user-facing prompts.
  </Step>

  <Step title="Files">
    Download from [drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF](https://drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF). Both files can be used as-is — no per-tenant customization is needed.

    | File                          | Purpose                                                                               |
    | ----------------------------- | ------------------------------------------------------------------------------------- |
    | `origin-privacy.mobileconfig` | PPPC profile — grants Full Disk Access and Endpoint Security to the Origin agent.     |
    | `jamf-install-origin.sh`      | Pre-install shell script that stages the provisioning JWT for the `.pkg` postinstall. |

    <Note>
      The bundle may also contain a proxy root CA template, a system-extensions policy, and a VPN/transparent-proxy profile from Origin's earlier proxy-based capture architecture. **Do not deploy these — they are no longer required.**
    </Note>

    **Identifiers**

    | Identifier      | Value              |
    | --------------- | ------------------ |
    | Team ID         | `D3C73MWD7Y`       |
    | Agent bundle ID | `com.origin.agent` |
  </Step>

  <Step title="Deployment order">
    The configuration profile must land on the endpoint before the `.pkg` installs — otherwise the agent hits permission prompts during registration and the silent-install chain breaks.

    1. **Privacy preferences (PPPC)** (`origin-privacy.mobileconfig`) — Grants Full Disk Access and Endpoint Security to the Origin agent based on Team ID `D3C73MWD7Y` and bundle ID `com.origin.agent`. Eliminates TCC prompts that would otherwise appear on first run.
    2. **The Origin `.pkg` (via policy)** (`Origin.pkg`) — The installer itself, deployed via a Jamf policy with the install script running **before** the package to stage the provisioning JWT.
  </Step>

  <Step title="Jamf Pro walkthrough">
    ### 01. Upload the configuration profile

    The `.mobileconfig` must be uploaded as a **raw custom profile**. Do not use Jamf's built-in PPPC payload editor — it rewrites the XML and breaks the code requirements.

    <Note>
      The **Upload** button is on the Configuration Profiles list page (**Computers → Configuration Profiles**), not inside the New Profile editor. Navigate to the list first, then click **Upload** to import a raw `.mobileconfig`.
    </Note>

    1. Jamf Pro → **Computers → Configuration Profiles**.
    2. Click **Upload** on the list page.
    3. Upload `origin-privacy.mobileconfig`.
    4. Under the **Scope** tab, add your target devices or Smart Group.
    5. Click **Save**.

    <Warning>
      Before moving to package installation, confirm the profile is installed using either method:

      **UI:** On the Mac go to **System Settings → Privacy & Security → Profiles** (or search "Device Management"). The Privacy Preferences profile should appear in the managed profiles list.

      **Terminal:**

      ```bash theme={null}
      sudo profiles show -all | grep -i "origin"
      ```

      Do not proceed until it is confirmed.
    </Warning>

    ### 02. Upload the Origin package

    1. Jamf Pro → **Settings → Computer Management → Packages → Upload Package**.
    2. Upload `Origin.pkg`.
    3. Leave defaults (Category, Priority, Fill User Template, etc.) unless you have site-specific conventions.
    4. Click **Save**.

    ### 03. Create the install script

    The script stages the provisioning JWT to `/var/tmp/origin-provisioning-jwt` so the `.pkg` postinstall can read it silently. The file is deleted after use.

    1. Jamf Pro → **Settings → Scripts → New**.
    2. Name the script `Origin Installer`.
    3. On the **Script** tab, paste the contents below, replacing the empty `JWT=""` value with your provisioning token from **Settings → Provisioning Tokens**.
    4. Click **Save**.

    ```bash theme={null}
    #!/bin/bash
    # Origin Agent -- Jamf Silent Install Script
    # Stages the JWT for the .pkg postinstall to read.
    # The postinstall deletes the file after use.
    set -euo pipefail
    ####################################################################
    # EDIT THIS: paste your provisioning JWT between the quotes
    JWT=""
    ####################################################################
    if [[ -z "$JWT" ]]; then
      echo "Error: JWT not configured. Edit the script and set the JWT variable."
      exit 1
    fi
    JWT_FILE="/var/tmp/origin-provisioning-jwt"
    install -m 600 /dev/null "$JWT_FILE"
    echo "$JWT" > "$JWT_FILE"
    echo "JWT staged for Origin installer."
    ```

    <Note>
      **Why the token lives in the script body**

      Jamf script parameters are capped at 255 characters, which is too short for a provisioning JWT. The token goes directly into the script body. Any Jamf admin with script-view permissions will be able to read it — scope admin permissions accordingly.
    </Note>

    ### 04. Create the install policy

    Navigate to Jamf Pro → **Computers → Policies → New** and configure the following tabs:

    **General tab**

    | Field               | Value                                                      |
    | ------------------- | ---------------------------------------------------------- |
    | Display Name        | Install Origin Agent                                       |
    | Trigger             | Custom event: `install-origin` and **Enrollment Complete** |
    | Execution Frequency | Once per computer                                          |

    **Packages tab**

    | Field   | Value        |
    | ------- | ------------ |
    | Package | `Origin.pkg` |
    | Action  | Install      |

    **Scripts tab**

    | Field    | Value            |
    | -------- | ---------------- |
    | Script   | Origin Installer |
    | Priority | **Before**       |

    **Scope tab**

    | Field  | Value                                                                                          |
    | ------ | ---------------------------------------------------------------------------------------------- |
    | Target | Add the same target devices or Smart Group used for the configuration profile. Click **Save**. |

    <Warning>
      **Script priority must be Before.** If the script runs **After** the package, the JWT file won't exist when the postinstall needs it and the installer will fall back to the GUI prompt. Double-check the priority before saving.
    </Warning>

    ### 05. Trigger the policy

    On a target device, run the custom trigger from Terminal:

    ```bash theme={null}
    sudo jamf policy -event install-origin
    ```

    <Note>
      Running `sudo jamf policy -event install-origin` manually will prompt for interactive password authentication on the endpoint. If you prefer the install to run without any user interaction, wait for the device to check in naturally — on enrollment complete or the next recurring check-in — rather than forcing it.
    </Note>

    The script stages the JWT → Jamf installs the `.pkg` → the postinstall reads the staged JWT and registers silently → the JWT file is deleted. The MDM profile handles the permission grants with no user interaction required.
  </Step>

  <Step title="Verification">
    Run these on a target endpoint after the policy completes.

    **Profile installed**

    ```bash theme={null}
    sudo profiles show -all | grep -i "origin"
    ```

    Should return the Origin Privacy Preferences profile.

    **Agent process running**

    ```bash theme={null}
    pgrep -x origin
    ```

    Returns a PID when the agent is running.

    **Agent log tail**

    ```bash theme={null}
    cat /Library/Origin/logs/agent.log.$(date -u +%Y-%m-%d)
    ```

    Prints today's agent log — useful for confirming the agent started cleanly, registration succeeded, and there are no errors after install.

    ### Origin menu bar icon

    Once the agent is running, the Origin menu bar icon appears. Click it to confirm the agent is active and to access two operator-friendly checks without dropping to Terminal:

    * **Generate diagnostic report** — bundles agent state, recent logs, and registration status into a single file you can hand to Origin support.
    * **View logs** — opens the local log directory directly.

    <Note>
      **Origin console verification**

      In the Origin console, go to **Settings → Endpoint Inventory** and search for the target hostname. A successfully registered endpoint appears with a recent last-seen time and its detected AI agents populated.
    </Note>
  </Step>

  <Step title="Troubleshooting">
    ### Profile shows "Failed" in Jamf

    Check the error in the device's Management History. The two most common causes:

    * **Profile recreated in Jamf's payload editor** — re-upload the raw `.mobileconfig` from the deployment package instead.
    * **Profile stuck pending** — run `sudo jamf policy` on the device to force a check-in.

    ### Full Disk Access not granted despite profile

    * Verify the profile actually installed:
      ```bash theme={null}
      sudo profiles show -all | grep -i "origin"
      ```
    * The PPPC profile's code requirement matches Developer ID signed builds with Team ID `D3C73MWD7Y`. Ad-hoc signed or internal development builds won't match and Full Disk Access will not pre-grant.

    ### JWT prompt still appears on install

    * Verify the script ran successfully — check the policy logs in Jamf Pro.
    * Confirm script priority is **Before**, not **After**.
    * On the endpoint, confirm the file existed before the `.pkg` ran: `/var/tmp/origin-provisioning-jwt`.
    * Confirm the token hasn't expired or exhausted its use limit — check **Settings → Provisioning Tokens**.
  </Step>

  <Step title="Alternative deployment paths">
    ### Kandji

    1. **Library → Add New → Custom Profile** for `origin-privacy.mobileconfig`.
    2. Assign to device blueprints.
    3. Add the `.pkg` as a **Custom App**.
    4. Use a pre-install script to stage the JWT (same pattern as the Jamf script above).

    ### Headless CLI install

    For scripted deployments outside of any MDM — useful for lab environments, golden-image prep, or emergency reinstalls:

    ```bash theme={null}
    echo "eyJ..." > /var/tmp/origin-provisioning-jwt
    chmod 600 /var/tmp/origin-provisioning-jwt
    installer -pkg Origin.pkg -target /
    ```

    The postinstall reads the JWT from the staged file and skips the GUI prompt. The file is deleted after use.

    <Note>
      Without the PPPC profile, the end user will see permission prompts on first run. This path is best reserved for managed endpoints that already have the profile, or lab machines where the prompts are acceptable.
    </Note>
  </Step>
</Steps>