You could use the dock payload. That's what we do to make obvious shortcuts for certain classes.

Hi @Randydid,
Once your file is in the desired location, you can lock down it's setting using:

#Change owner to root 
sudo chown root:wheel <file>

#Adjust permissions to read only for all users
sudo chmod 444 <file>

#Lock the Alias file to prevent future changes
sudo chflags uchg <file>

ln -s /path/to/original /path/to/destination still works (even on that most recent developer release). Use outset or similar to run at login.

Thank you for this thread and for the suggestion pete_c

That script works like a charm run directly in Terminal when entering this:
ln -s /Applications/Self Service.app /private/var/$USER/Desktop
Adding this as a script in the JSS and trying to push it via Jamf Remote (or login hook) initially succeeds according to the log, but doesn't display an alias.
Trying to push it a second time results in an exit error:
ln: /private/var/root/Desktop/Self Service.app: File exists
It looks like the alias is being created but on the desktop of Root instead of the currently logged in user. Is there a way to have $USER not recognize that root is being used in order to run the script (if I'm reading right, Jamf always runs scripts as root)?

(I'm a bit new to scripting so I might be missing something super obvious or just misunderstanding everything entirely.)

(Edit - I was a goof and didn't think the script through carefully - this addition seems to have gotten the desired result for Self Service at least:

!/bin/sh

loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )
ln -s /Applications/Self Service.app /Users/$loggedInUser/Desktop

Seems like it should be adaptable for other applications and could even be used as a post install script for something installed with a login trigger. )