Deploy Device Protection with Jamf

Use Jamf Pro to deploy Aikido Device Protection across your managed macOS fleet with the required permissions in place.

Installation

1. 1

   What you'll need

   Before starting, make sure you have the following from the Aikido Device Protection dashboard:

   • The Aikido Device Protection .mobileconfig (downloaded from the Aikido Device Protection dashboard)
   • The Aikido Device Protection installer (.pkg file, downloaded from the dashboard)

   If you're missing any of these, go back to the Aikido Device Protection dashboard, click Connect Device, and complete the pre-flight steps.

2. 2

   Sign the .mobileconfig before uploading

   You must sign the .mobileconfig before uploading it to Jamf Pro. Jamf Pro does not support some of the newer Apple payloads used by Aikido Device Protection, and an unsigned profile will fail to deploy correctly.

   Sign the downloaded .mobileconfig using a signing certificate from Jamf Pro's built-in CA. Follow Jamf's guide: Creating a Signing Certificate Using Jamf Pro's Built-in CA.

3. 3

   Add the Aikido Device Protection configuration profile

   1. In Jamf Pro, use the upload to add it as Configuration Profile for macOS.
   2. Upload the signed .mobileconfig file.
   3. Scope it to the target devices.

   If Jamf Pro shows an error in the VPN payload asking for a Server hostname or IP address, enter 127.0.0.1. This is a known Jamf Pro limitation: it doesn't fully support the proxy payload used by Aikido Device Protection.

   This profile allows the Aikido Device Protection system extension to load silently, enables the network content filter, and stops users from disabling background services in System Settings → Login Items.

4. 4

   Upload the Aikido Device Protection installer

   1. In Jamf Pro, go to Settings → Packages.
   2. Upload the Aikido Device Protection .pkg.
   3. Confirm the package finishes processing before you use it in a policy.
5. 5

   Create the install policy

   1. In Jamf Pro, go to Computers → Policies.
   2. Create a new policy scoped to the same devices.
   3. Add the uploaded Aikido Device Protection package to the policy.
   4. Set the policy's Execution Frequency to Once per computer.

   Leaving the Execution Frequency at Ongoing makes the policy reinstall the package on every recurring check-in, which can redeploy an outdated build. The package should only be installed once per device.

6. 6

   Deploy to your devices

   1. Deploy the Aikido Device Protection configuration profile.
   2. Verify it has reached all target devices. Check profile status in the Jamf Pro console.
   3. Deploy the Aikido Device Protection install policy.
7. 7

   Reboot devices after installation

   1. In Jamf Pro, go to Computers → Policies and create a new policy.
   2. Add a Restart Options payload and set it to Restart.
   3. Scope it to the same target devices and trigger it after the agent package has installed.

   The agent fully activates on the next boot.

8. 8

   Verify the deployment

   On a test device, confirm:

   1. The system extension is activated:

      systemextensionsctl list | grep aikido

      Expect to see the extension marked [activated enabled].

   2. Open System Settings → General → Login Items & Extensions and confirm the Aikido Device Protection entries cannot be toggled off.

Troubleshooting