Deploying UniFi Endpoint for macOS at Scale

MDM solutions, such as Microsoft Intune, Jamf Pro, or Kandji, can be used to deploy UniFi Endpoint across macOS devices at scale. The macOS app is distributed as a Developer ID-signed and notarized .pkg and supports pre-configured settings through a macOS Configuration Profile.

Requirements: UniFi Endpoint for macOS 4.1.0 or later

This article outlines the general deployment process, required macOS MDM payloads, and available configuration keys. For an overview of UniFi Endpoint, see UniFi Endpoint Overview.

Deploying UniFi Endpoint

To deploy UniFi Endpoint at scale:

1. Download the UniFi Endpoint macOS Installer .pkg file here.
2. Add the .pkg to your MDM as a macOS app and assign it to your device groups.
3. Create a macOS Configuration Profile with a Custom Settings / Preferences payload.
4. Set the preferences domain to com.ui.uid.standard-desktop.
5. Configure any optional keys from the table below.
6. If you are using Fabric, set OrgDomain to your workspace slug, such as example or example.ui.com, to ensure users can only sign in to that workspace.
7. Assign the Configuration Profile before, or together with, the app so LAUNCH_AFTER_INSTALL is honored on the first install.
8. If your deployment uses VPN, push the required macOS MDM payloads listed below before, or together with, the app.
9. Deploy through your preferred MDM workflow.

The example below pre-configures the example workspace domain, enables Wi-Fi auto-connect, disables automatic update checks, and suppresses post-install launch for silent deployment.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>OrgDomain</key>
    <string>example</string>
    <key>ConnectWiFiOnStartup</key>
    <true/>
    <key>CheckUpdate</key>
    <false/>
    <key>LAUNCH_AFTER_INSTALL</key>
    <false/>
</dict>
</plist>

Note: On macOS, there are no separate enforcement lock keys like the Windows MSI ENFORCE_CONFIG_* properties. Every key delivered by a Configuration Profile is enforced automatically. The configured value is applied, users cannot override it, and the related control is disabled or hidden in UniFi Endpoint. To leave a setting under user control, omit the key from the profile.

Required macOS MDM Payloads

UniFi Endpoint includes a system extension for VPN and a privileged helper. On managed Macs, these must be approved through MDM so the app can activate without unnecessary user prompts.

Push the following payloads from your MDM before, or together with, the app.

Identifiers:

• Team ID: 4P645293E8
• App bundle ID: com.ui.uid.standard-desktop
• System extension bundle ID: com.ui.uid.standard-desktop.network-extension

System Extensions Required for VPN

The VPN system extension must be pre-approved so it can load without the standard “Allow extension” prompt on supervised Macs.

For Intune:

1. Create a macOS device configuration profile for System Extensions.
2. Add the Allowed Team Identifier 4P645293E8.

Alternatively, allow the specific system extension com.ui.uid.standard-desktop.network-extension for Team ID 4P645293E8.

For Jamf Pro:

1. Go to Configuration Profiles.
2. Add a System Extensions payload.
3. Configure Allowed System Extensions.
4. Allow Team ID 4P645293E8 and system extension com.ui.uid.standard-desktop.network-extension.

For a custom .mobileconfig, use the system extension policy payload:

<key>PayloadType</key>
<string>com.apple.system-extension.policy</string>
<key>AllowedSystemExtensions</key>
<dict>
    <key>4P645293E8</key>
    <array>
        <string>com.ui.uid.standard-desktop.network-extension</string>
    </array>
</dict>

Login Items

This payload is optional and is used when launch at startup should be managed by the organization.

Push a Service Management - Managed Login Items payload that allows Team ID 4P645293E8 or app bundle com.ui.uid.standard-desktop.

In Intune, use a preference file or custom profile with com.apple.servicemanagement.

Privacy Preferences Policy Control

If your environment surfaces privacy prompts for the helper or extension, add a Privacy Preferences Policy Control (PPPC) payload for Team ID 4P645293E8.

Supervised vs. User-Enrolled Macs

On supervised Macs enrolled through Automated Device Enrollment / Apple Business Manager, these payloads can suppress system extension prompts and allow the extension to activate silently.

On user-enrolled or manually enrolled Macs, the system extension allowlist does not auto-approve the extension. The user must approve it once in System Settings > General > Login Items & Extensions.

The “Allow VPN Configuration” prompt shown the first time the user connects to VPN is not suppressed by these payloads. Expect one approval on the first VPN connection.

Configuration Profile Keys

These keys configure application behavior. They are delivered through the com.ui.uid.standard-desktop Configuration Profile and are read when UniFi Endpoint launches. Key names match the Windows registry value names so a single deployment plan can cover both platforms.

Note: When a setting is enforced, the related control is disabled or hidden in UniFi Endpoint. For an enforced organization domain, the Welcome screen workspace field is pre-filled and read-only.

Deploy via Jamf Pro or Other MDMs

Use a Configuration Profile with a Custom Settings payload, preference domain com.ui.uid.standard-desktop, and the same key/value pairs.

This writes a managed plist to:

/Library/Managed Preferences/com.ui.uid.standard-desktop.plist

UniFi Endpoint reads this profile when the app launches.

Notes and Limitations

• Login is still required. The profile pre-configures behavior, but users still authenticate after installation.
• OrgDomain is supplied by the administrator and applies to workspace / organization accounts. Personal or direct-console accounts do not have a workspace domain.
• Sign-in to any other workspace is blocked while OrgDomain is enforced.
• Settings apply at app launch. Quit and relaunch UniFi Endpoint, or sign in again, after pushing or changing the profile.
• UniFi Endpoint has its own update mechanism. If your MDM owns version control, set CheckUpdate to false.
• macOS Configuration Profiles do not provide a soft default. Any key delivered by the profile is enforced. Omit a key to leave it user-controlled.