Automating PPPC & System Extensions

@bhardawa You're overthinking. We just apply them to all since the overhead is pretty minimal.

I agree with @sdagley - making more things to look over and troubleshoot seems like a waste of time as indeed, profiles are pretty minimal in taxing the system. I've not had any issues with this so far, but then again, I have maybe a dozen or so such profiles for the average customer, not 100's...

Thanks for the feedback, everyone. I will apply the config profiles to everything as a short term solution and build the smart group solution over the next few weeks. There are some other uses for infrastructure I would need to configure to make work. I like having fine control over what's on my endpoints.

one other thing to consider. if you have smart groups to look for an app and then apply the profile, the profile won't be there for some time after that app is installed. depending on your inventory schedule any such software requiring the profile will error out the first couple times its run. or simply fail to install altogether. I scope the PPPC profiles to all devices and have the smart group to make sure the profile is there before installing the software.

@jchurch has a good point. That's another benefit to scoping "all" when making profiles. The, if you have an exception such as level of macOS, you can put those smart groups in there (exceptions tab) to not deliver the Profile to those Macs. Some likely won't harm anything, others might cause trouble.

@jchurch and @scottb, my app policies are structured like this:

AppName - Deploy
- Files and Processes option that executes: "/usr/local/bin/jamf policy -trigger [custom trigger]

AppName - Install
- General configured with a custom trigger
- Packages option with the installation payload
- Scripts option if needed
- Maintenance option with only "Update Inventory" selected

AppName - Self Service
- Files and Processes option that executes: "/usr/local/bin/jamf policy -trigger [custom trigger]

This setup gives me a lot of flexibility in scoping and I actually built out the smart groups this morning. It went faster than I was thinking because I forgot I can use "App Title" as a criteria instead of creating an Extension Attribute for each application. The actual installation package is in "AppName - Install" and triggers an inventory update after its contents install. This way, I always have current inventory of the applications installed on my endpoints, which means if use smart groups that look for an application title or some other similar criteria and scope the smart group to the respective configuration profile, the profile gets applied right away. In testing so far, the whole thing is actually pretty elegant.