Skip to main content
Jamf Pro cover — two pushes, one result. Jamf deploys AgenShield with the same two objects as every other MDM: the campaign’s configuration profile and the signed installer package. Jamf Pro and Jamf Now differ only in how those are grouped and scoped. Get both artifacts from your install campaign first.

​
Jamf Pro

​
1. Upload the configuration profile

Computers → Configuration Profiles → Upload, and select agenshield.mobileconfig.
  • Level: Computer Level.
  • Jamf re-signs uploaded profiles. That is expected and fine.
  • Scope it to the smart or static group you are rolling out to.
Upload the file as-is — it already carries all six payloads, correctly paired to the extension identifiers, so there is nothing to rebuild in Jamf-native payload editors. If your organization manages privacy preferences and extension policy in dedicated blueprints, push the campaign’s split profiles instead — one variant or the other, never both.
If you do recreate the enrollment half natively, it is an Application & Custom Settings payload with preference domain com.frontegg.AgenShield and two string keys: CampaignToken and CloudUrl. Both values come from your campaign.

​
2. Deploy the package

  1. Settings → Computer Management → Packages — upload the campaign’s .pkg.
  2. Computers → Policies → New:
    • Triggers: Enrollment Complete and Recurring Check-in.
    • Execution Frequency: Once per computer.
    • Packages payload: add the AgenShield package, action Install.
    • Scope: the same group as the profile.
Push order does not matter — see what happens on the device.

​
3. Scope with a smart group

A smart group keyed on the AgenShield application makes both the rollout and the reporting self-maintaining: Invert it (is not) to get “managed Macs still missing AgenShield” — a useful scope for the install policy and a useful dashboard for the rollout.

​
Jamf Now

Jamf Now groups everything into a Blueprint.
1

Add the installer

Apps → Add App → Custom App — upload the campaign’s .pkg and enable automatic installation.
2

Add the profile

In the Blueprint, add a Custom Profile and upload agenshield.mobileconfig.
3

Assign the Blueprint

Assign it to the Macs you are enrolling. Jamf Now applies both objects on the next check-in.
Jamf Now reports Settings applied on the device row once the Blueprint has landed.

​
Verify

On a managed Mac:
You should also see:
  • System Settings → General → Device Management lists the AgenShield profile.
  • AgenShield.app in /Applications.
  • The device under Devices in the Frontegg Portal (https://portal.frontegg.com/<environment>/agen/shielded/devices), within a minute of the package installing — before anyone logs in.

​
Troubleshooting

Everything else is on the MDM enrollment reference.

​
Next

Enrolled devices

Reading fleet health once devices land.

Rollout playbook

Monitor first, then promote rules one at a time.