We have a mix of Config Profiles that are deployed directly from Jamf Pro over Apple's MDM framework, and some that are deployed and installed locally with a package or script, bypassing APNs.
What I found, like others posted here, is that there are some reliability issues with Profiles randomly getting removed or vanishing from machines and then being redeployed again when done over APNs. Where the issue comes in is if using an important profile, like one that adds an 802.1x Wi-FI profile, or, in our case, that adds an important Intermediate SSL Decryption Authority certificate, this creates big problems for us. We can't have those profiles disappearing from our Macs for no apparent reason or it creates problems for the end users, so for the most important ones, we deploy them with a script or a package/script combo. They tend to stick around much more reliably when done this way.
I wanted to just add though, that I found its pretty easy to deploy the Profile entirely in a script and bypass a package altogether. Here are the steps you can take to do this.
- Create the Configuration Profile .mobileconfig however you want, for example, in Jamf Pro, or in Apple's Profile Manager. As long as you can get a physical .mobileconfig file in the end, or access the direct xml of the profile.
- If you created it in Jamf Pro, access it in the GUI and use the Download button in the Profile details.
- Use the following command on the downloaded file. This is necessary with any downloaded from Jamf Pro, since they end up as signed Config Profiles:
security cms -D -i /path/to/profilename.mobileconfig | xmllint --format -
- Take the output from the above command in Terminal and copy it. You will paste this into a script.
- Create a script with the following information in it. You will need to edit some of this to correspond to whatever it is that you're deploying, like a name for the profile for example.
#!/bin/bash
## Create the .mobileconfig file in /private/tmp/
cat << EOF > /private/tmp/profile.mobileconfig
*<paste the entire xml code for the configuration profile from step 3 and 4 here, unaltered>*
EOF
## Install the .mobileconfig with the profiles command
/usr/bin/profiles -I -F /private/tmp/profile.mobileconfig
if [ $? == 0 ]; then
echo "Successfully installed. Deleting local file..."
rm -f /private/tmp/profile.mobileconfig
exit 0
else
echo "Installation of profile failed. Deleting local file..."
rm -f /private/tmp/profile.mobileconfig
exit 1
fi
In this way, the profile can be contained in the script and deployed and installed without needing to create a separate package for it, which can sometimes work better. I've been using the above process for deploying some of our profiles and its working well.
Be sure also to create an Extension Attribute that captures the installed profile names or identifiers, so you can build Smart Groups for machines that should get it or not. This may be necessary even if just pushing the profile in a regular package install.
