> ## Documentation Index > Fetch the complete documentation index at: https://docs.originhq.com/llms.txt > Use this file to discover all available pages before exploring further. # Deploy the Origin macOS Agent Silently via Tanium MDM > Use Tanium Device Management and Tanium Deploy to push the Origin macOS agent fleet-wide with fully automated, zero-touch installation. This guide walks you through a fully zero-touch deployment of the Origin macOS agent using Tanium. Tanium Device Management pushes the PPPC configuration profile that pre-approves the permissions the agent needs. Tanium Deploy then stages the provisioning JWT and installs the agent — but only on endpoints where the profile has been confirmed installed. Together they create a self-healing, ongoing pipeline: new Macs enroll, receive the profile, and automatically receive the agent with no manual intervention. ## Overview Deploying the Origin agent on macOS requires two Tanium products working in sequence: * **Tanium Device Management** pushes the MDM configuration profile that pre-approves the permissions the agent needs. Without it, the agent hits interactive permission dialogs during registration and silent install fails. * **Tanium Deploy** stages the provisioning JWT and executes the installer, but only on endpoints where the profile has successfully installed. The two products are independent — Device Management uses Apple's MDM/APNs channel, Deploy uses the Tanium Client. Both must be in place before the agent install runs. ## Prerequisites * Tanium Cloud admin access with permissions to configure Device Management (`Shared Services → Device Management`) and Deploy (`Modules → Deploy`). * A Tanium licence that includes **Tanium Enforce** (required by Device Management). * An Apple Push Notification Service (APNs) certificate configured in Device Management — `Shared Services → Device Management → Settings → Push Certificate`. * Target Macs enrolled in Tanium Device Management (see Step 1). * A valid Origin **provisioning JWT** — obtain from the Origin console under `Settings → Provisioning Tokens`. * The Origin **macOS installer** (`Origin.pkg`) — download from the Origin console under `Settings → Installers`. * The `origin-privacy.mobileconfig` profile from the deployment package. The installer and the provisioning token live in two different Settings views — Installers for the `.pkg`, Provisioning Tokens for the JWT. Tokens carry an expiry and a use limit, so confirm both cover your rollout. **Deployment package download:** [drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF](https://drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF) ## Files | File | Purpose | | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `origin-privacy.mobileconfig` | PPPC profile — grants Full Disk Access and Endpoint Security to the Origin agent (Team ID `D3C73MWD7Y`, bundle ID `com.origin.agent`). | | `Origin.pkg` | The macOS agent installer. | | `jwt.txt` | A plain text file containing your provisioning JWT. Created by you — see Step 5. | The bundle may also contain a proxy root CA template, a system-extensions policy, and a VPN/transparent-proxy profile from Origin's earlier proxy-based capture architecture. **Do not deploy these — they are no longer required.** **Identifiers** | | | | --------------- | -------------------------- | | Team ID | `D3C73MWD7Y` | | Agent bundle ID | `com.origin.agent` | | App bundle | `/Applications/Origin.app` | | CFBundleName | `Origin` | ## Deployment order The configuration profile must reach **Installed** status on the endpoint before the Deploy package runs. The Deploy deployment is gated on this via a computer group (Step 4) — it will not run on a Mac until the profile is confirmed installed. | Order | What | How | | ----- | ---------------------------- | -------------------------------- | | 1 | Privacy (PPPC) profile | Device Management custom setting | | 2 | `Origin.pkg` via JWT staging | Tanium Deploy package | Macs must be enrolled in Tanium Device Management before profiles can be pushed. Enrollment also automatically installs the Tanium Client, which Deploy requires. ### Automated enrollment (recommended) If your Macs are purchased through Apple Business Manager (ABM) or Apple School Manager (ASM), configure automated device enrollment so Macs enroll at setup time with no user interaction. 1. Go to `Shared Services → Device Management → Settings (GEAR icon, not the side menu) → Automated Enrollment`. 2. Follow the prompts to link your ABM/ASM token and configure the enrollment experience. ### Manual enrollment (testing / pilot) For individual Macs not in ABM, download and install the enrollment profile manually: 1. Go to `Shared Services → Device Management → Settings (GEAR icon, not the side menu) → Device Enrollment`. 2. In the **Manual Enrollment** section, click **Download** and select the macOS enrollment file. 3. Copy the profile to the target Mac and install it. 4. On the Mac, open the profile in System Settings and confirm installation. Once enrolled, the Tanium Client installs automatically. Verify enrollment by checking that the Mac appears in `Shared Services → Device Management` with a recent check-in time. Alternatively, ask the following question in Tanium Interact to verify enrollment: ```text theme={null} Get Computer Name and Device Management - Last Check-In Time and Device Management - Device ID from all entities with ( Is Mac equals true and Device Management - Device ID matches "^[\da-f]{8}-.*$" ) ``` The profile is uploaded as a Custom Setting in Tanium Device Management, which pushes it via the MDM/APNs channel. Do not recreate this profile using Tanium Enforce's built-in payload editors. The editors rewrite the XML and could break the code requirement in the PPPC profile. Upload the raw `.mobileconfig` only. 1. Go to `Shared Services → Device Management → Settings`. 2. In the **Custom Setting** section, click **+**. 3. Name the setting `Origin - Privacy`. 4. In **Choose a platform**, select **macOS**. 5. In **Upload your profile**, drag and drop `origin-privacy.mobileconfig`. 6. Click **Open**, then **Save**. Use this exact setting name. The computer group created in Step 4 matches against it in sensor output. If the name differs, the condition will not match and the Deploy package will never fire. A Device Management collection groups the setting and targets it to the appropriate devices. 1. Go to `Shared Services → Device Management → Collections`. 2. Click **Add Collection**. 3. Name the collection `Origin Agent - Profiles`. 4. Click **Add** for the `Origin - Privacy` setting and click **Next**. 5. Skip the Applications step and click **Next**. 6. Configure targeting — select the computer group containing your target Macs. 7. Click **Preview Targeted Endpoints** to verify scope, then **Save**. Allow a few minutes for the profile to push via MDM. Monitor progress on the collection's **Overview** tab — the setting should reach **Installed** before proceeding to Step 4. ### Verify on the endpoint Before building the Deploy package, confirm the profile is installed on a test endpoint: ```bash theme={null} sudo profiles show -all | grep -i "origin" ``` **In Tanium Interact**, confirm the sensor output — run this question against your test Mac: ```text theme={null} Get Device Management - Settings Installation Status from all machines with Computer Name equals ``` You should see output like: ```text theme={null} Origin - Privacy | Installed | Installation successful | ``` The Deploy deployment is scoped to this computer group. A Mac joins it only when the Origin profile is confirmed installed — this is the gate that prevents the Deploy package from running on unprepared endpoints. 1. Go to **Administration → Computer Groups**. 2. Click **New Computer Group**. 3. Name it `Origin Profiles Installed`. 4. Set the filter expression to: ```text theme={null} ( Is Mac equals true and Device Management - Settings Installation Status matches "^Origin - Privacy\s*\|\s*Installed.*$" ) ``` 5. Click **Preview** to confirm your test Mac appears in the group. 6. Click **Save**. **How the regex works:** the condition matches a row in the sensor output that begins with the profile name, followed by a pipe delimiter (with optional whitespace), followed by `Installed`. This confirms both the profile name AND its status together — a condition like `contains "Installed"` alone would match any profile that happens to be installed, not the specific one named. A single Deploy software package with three sequential commands handles JWT staging, installation, and cleanup. ### Package details 1. Go to `Modules → Deploy → Software → Software Packages`. 2. Click **Create Package**. 3. Fill in the package details: | Field | Value | | -------- | -------------------------------------- | | Name | `Origin Agent - Install (macOS)` | | Vendor | Your Origin signing vendor | | Version | Match the agent version you downloaded | | Platform | `macOS` | ### Package files In the **Package Files** section, upload both files: * `Origin.pkg` * `jwt.txt` — a plain text file containing your provisioning JWT (just the token string, no newline) `jwt.txt` is uploaded as a package file so Deploy distributes it to the endpoint before any commands run. The JWT never appears in the command body and is therefore not visible to admins browsing package details. ### System requirements * **Architecture:** Universal * **Minimum OS:** Origin's supported macOS floor — see [Agent Overview](/getting-started/agent-overview) ### Install operation Enable the **Install** operation and ensure **Require Source Files** is selected. Add three sequential Run Commands: **Command 1 — Stage the JWT** ```bash theme={null} install -m 400 jwt.txt /var/tmp/origin-provisioning-jwt ``` Copies `jwt.txt` to the path the postinstall expects, read-only by owner. Success code: `0`. **Command 2 — Install Origin** ```bash theme={null} installer -pkg Origin.pkg -target / ``` Success code: `0`. **Command 3 — Clean up the JWT** ```bash theme={null} rm -f /var/tmp/origin-provisioning-jwt ``` Success code: `0`. If Command 1 or 2 fails, Deploy will not proceed to the next command. Note that the staged file has mode 400 (root read-only), so it is not readable by other processes even if the installer fails and leaves it behind. ### Installation requirements Ensures the package only runs on Macs that do **not** already have Origin installed: | Attribute | Operator | Value | | --------- | -------------- | -------------------------- | | File Path | does not exist | `/Applications/Origin.app` | ### Install verification Confirms Origin installed successfully: | Attribute | Operator | Value | | --------- | -------- | -------------------------- | | File Path | exists | `/Applications/Origin.app` | ### Save the package Click **Create Package** and wait for **Status** to reach **100%** before deploying. 1. Go to `Modules → Deploy → Deployments` and click **New Deployment**. 2. Select **Software Package** and choose `Origin Agent - Install (macOS)`. 3. Select **Install** as the operation. 4. In **Endpoints to Target**, select the `Origin Profiles Installed` computer group. 5. Set **Deployment Type** to **Ongoing** — this ensures newly enrolled Macs automatically receive the agent once their profile reaches Installed status. 6. Configure a maintenance window if required by your change management policy. 7. Click **Deploy**. The ongoing deployment combined with the dynamic computer group makes this fully zero-touch for new Macs: a Mac enrolls in Device Management → the profile pushes via MDM → it reaches Installed → the Mac joins the `Origin Profiles Installed` group → Deploy fires automatically. ### Deploy job status Open the deployment in `Modules → Deploy → Deployments` and confirm the endpoint shows **Installed** status. ### Profile installed ```bash theme={null} sudo profiles show -all | grep -i "origin" ``` ### Agent process running ```bash theme={null} pgrep -x origin ``` Returns a PID when the agent is running. ### JWT cleaned up ```bash theme={null} ls /var/tmp/origin-provisioning-jwt ``` Expected: `No such file or directory` ### Agent log ```bash theme={null} cat /Library/Origin/logs/agent.log.$(date -u +%Y-%m-%d) ``` Confirms the agent started cleanly and registration succeeded. ### Origin console In the Origin console, go to **Settings → Endpoint Inventory** and search for the target hostname. A successfully registered endpoint appears with a recent last-seen time and its detected AI agents populated. ### Profile shows Failed or Pending in Device Management Check the setting status on the collection's Devices tab. * **Profile XML was modified or recreated using a payload editor** — re-upload the raw `.mobileconfig` from the deployment package. * **Profile stuck Pending** — trigger an MDM check-in from the device's Endpoint Details page using **Deploy Action → Refresh Device Data**, or wait for the next scheduled check-in. ### Mac not appearing in the `Origin Profiles Installed` computer group Run the sensor question manually in Interact to confirm the output format matches the regex: ```text theme={null} Get Device Management - Settings Installation Status from all machines with Computer Name equals ``` If the profile name in the output differs from `Origin - Privacy`, update the computer group regex to match the actual name. ### Full Disk Access not granted despite profile The PPPC profile's code requirement matches Developer ID signed builds with Team ID `D3C73MWD7Y`. Ad-hoc signed or internal development builds won't match and Full Disk Access will not pre-grant. ### JWT prompt appears during install (non-silent install) The installer postinstall did not find the staged JWT. Check: 1. Command 1 (`install -m 400 jwt.txt /var/tmp/origin-provisioning-jwt`) completed with exit code 0 — check the Deploy job log. 2. `jwt.txt` was uploaded to the package files and **Require Source Files** is enabled on the Install operation. 3. `jwt.txt` contains only the JWT string with no trailing newline or whitespace. 4. The token has not expired or exhausted its use limit — check **Settings → Provisioning Tokens**. ### Deploy package shows Not Applicable The Installation Requirements rule (`/Applications/Origin.app` does not exist) is evaluating as not met — meaning Origin is already installed on the endpoint. Check the endpoint in the Origin console to confirm whether it is already registered. ### Origin not appearing in Origin console after install * Confirm outbound HTTPS (port 443) from the endpoint to the Origin cloud backend is not blocked by proxy or firewall. See [Network Connectivity](/kb/network-connectivity). * Check the agent log: `cat /Library/Origin/logs/agent.log.$(date -u +%Y-%m-%d)` * Confirm the JWT in `jwt.txt` was valid and had not expired at install time. ### Updating the Origin agent 1. Download the new `Origin.pkg` from the Origin console. 2. Edit the `Origin Agent - Install (macOS)` package in Deploy — replace `Origin.pkg` in Package Files and increment the version. 3. Update the **Install Verification** if the app version changes. 4. The ongoing deployment automatically pushes the update to enrolled endpoints. ### Rotating the provisioning JWT 1. Create a new token in the Origin console under `Settings → Provisioning Tokens`. 2. Create a new `jwt.txt` containing the new token. 3. Edit the Deploy package — replace `jwt.txt` in Package Files and increment the version. 4. Existing registered agents are not affected — they maintain their own session credentials after initial registration. Only endpoints receiving a fresh install will use the updated token. ### Removing the agent An `uninstall.sh` script is bundled inside the app: ```bash theme={null} /Applications/Origin.app/Contents/Resources/uninstall.sh ``` Add a **Remove** operation to the Deploy package using this command and deploy to the target computer group. ### Mac Device Enrollment deprecation Tanium Mac Device Enrollment is deprecated as of December 2025 and sunsets September 2026. If your environment currently uses Mac Device Enrollment, migrate to Tanium Device Management before implementing this guide. See the *Tanium Endpoint Management for Mobile User Guide* for migration steps.