MDM deployment on macOS

Deploy the scanner on Macs through Jamf, Kandji, Mosyle, or Intune with a configuration profile.

On macOS, the enrollment token is delivered as a configuration profile. macOS writes the profile’s settings to a file the scanner reads.

Before you begin

An enrollment token.
The macOS .pkg from the console’s Downloads page, or the pre-filled install.sh.

Create the configuration profile

Preference domain: com.superalign.surface

Key	Type	Required
`EnrollmentToken`	String	Yes
`UserEmail`	String	No
`UserFullName`	String	No

<dict>
  <key>EnrollmentToken</key>
  <string>sae_xxxxxxxx.yyyyyyyyyyyyyyyy</string>
  <key>UserEmail</key>
  <string>$EMAIL</string>
  <key>UserFullName</key>
  <string>$FULLNAME</string>
</dict>

Configuration Profiles, then Application & Custom Settings. Upload the plist or use the schema editor. Jamf substitutes $EMAIL and $FULLNAME per device.

Add a custom profile with the plist above. Kandji substitutes $EMAIL.

Add a custom profile. Use %email% for the user email.

Add a preference file (.plist) with the domain com.superalign.surface.

Deploy the package

Assign the .pkg to the same device group. Your MDM runs:

sudo installer -pkg SuperAlign-surface-{version}-darwin-{arch}.pkg -target /

The package is signed and notarized, so macOS does not ask for permissions again after updates.

Verify

On a Mac, confirm the profile landed:

defaults read /Library/Managed\ Preferences/com.superalign.surface
sudo surface status

The laptop appears on Endpoints within one scan interval.

Uninstall through MDM

The package bundles an uninstaller. Run it from a policy:

sudo /opt/surface/bin/uninstall.sh --force

It deregisters the laptop from the console, removes the service and files, and deletes the managed profile’s settings so a reinstall cannot reuse a revoked token.

Next steps

Browser extension if you plan to record AI websites
Troubleshooting if a laptop does not appear
Update and uninstall for upgrades through the same policy