By using Jamf Pro to revoke the administrator privileges of users, we are now facing a problem. Applications like Cusros have a very high update frequency. However, we don't want to simply and brutally grant the users the administrator privileges and let them complete the automatic update by clicking once in the Self Service. Do you have any suggestions on how to solve this?
Solved
Updates for third-party applications by ordinary users
+6Best answer by sdagley
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>update.mode</key>
<string>none</string>
</dict>
</plist>That setting, and a few other MDM controllable settings for the app, are documented on Cursor’s web site at https://cursor.com/docs/enterprise/deployment-patterns
You can use Installomator (click the Wiki link on that page for full documentation) in a Self Service triggered Policy to do the install, and updates, for Cursor (and many other apps).
A similar approach can be used for other apps that don’t use Privileged Helpers to allow updates when the user isn’t an Admin (e.g. iTerm, BBEdit, VSCode), you’ll just need to find out how to set them not to automatically check for updates, and a Google query like “disable auto updates for cursor app via mdm” can be useful to start that search.
Another option is to use Jamf Pro’s Patch Management capability, which allows you to set up a patch policy to offer updates via Self Service and enforce them after a specific number of days. That does require that you upload installer packages for the apps to be updated to your Jamf Pro DP/JCDS.
+24Do you have a link to the software? No way to tell it to use an updater to stay up to date? If it’s that gated, tmid would have a weekly script to check for the version and reinstall the latest if that’s the case.
+25
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>update.mode</key>
<string>none</string>
</dict>
</plist>That setting, and a few other MDM controllable settings for the app, are documented on Cursor’s web site at https://cursor.com/docs/enterprise/deployment-patterns
You can use Installomator (click the Wiki link on that page for full documentation) in a Self Service triggered Policy to do the install, and updates, for Cursor (and many other apps).
A similar approach can be used for other apps that don’t use Privileged Helpers to allow updates when the user isn’t an Admin (e.g. iTerm, BBEdit, VSCode), you’ll just need to find out how to set them not to automatically check for updates, and a Google query like “disable auto updates for cursor app via mdm” can be useful to start that search.
Another option is to use Jamf Pro’s Patch Management capability, which allows you to set up a patch policy to offer updates via Self Service and enforce them after a specific number of days. That does require that you upload installer packages for the apps to be updated to your Jamf Pro DP/JCDS.
+11When I ran into this, I started using App Auto Patch so I could do most in one swoop. Also check Jamf Apps for anything you may need.
+6
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>update.mode</key>
<string>none</string>
</dict>
</plist>That setting, and a few other MDM controllable settings for the app, are documented on Cursor’s web site at https://cursor.com/docs/enterprise/deployment-patterns
You can use Installomator (click the Wiki link on that page for full documentation) in a Self Service triggered Policy to do the install, and updates, for Cursor (and many other apps).
A similar approach can be used for other apps that don’t use Privileged Helpers to allow updates when the user isn’t an Admin (e.g. iTerm, BBEdit, VSCode), you’ll just need to find out how to set them not to automatically check for updates, and a Google query like “disable auto updates for cursor app via mdm” can be useful to start that search.
Another option is to use Jamf Pro’s Patch Management capability, which allows you to set up a patch policy to offer updates via Self Service and enforce them after a specific number of days. That does require that you upload installer packages for the apps to be updated to your Jamf Pro DP/JCDS.
Thank you for your suggestions. I have now hosted the application update and placed the update installation package in the Jamf policy for unified management.
+24Man I didn’t even know what Cusros was...some specific app or was it a mistype. There are configs out there for Cursor...but not Cusros.
Anywho, plenty of options in this thread to follow 😅
In most Jamf setups I’ve seen, the “no admin rights” vs “apps update constantly” problem usually gets solved by keeping updates fully managed:
- Use Patch Management / policies that run as root (Self Service button is fine — users click, Jamf does the privileged work).
- For apps with frequent updates, tools like Installomator (or a Munki/AutoPkg workflow) can keep things current without ever granting admin.
- If you *want* users to self-serve installs/updates but still avoid admin rights, an internal “app store” model tends to work better than letting each app updater do its own thing.
If it’s helpful, here’s a short guide on that “app store” approach from Swif:
Installing Software from the Swif App Store
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.