---
title: MDM deployment on macOS
sidebar:
  label: macOS
description: Deploy the scanner on Macs through Jamf, Kandji, Mosyle, or Intune with a configuration profile.
---

On macOS, the enrollment token is delivered as a **configuration profile**. macOS writes the profile's settings to a file the scanner reads.

## Before you begin

- An [enrollment token](/surface/admin/enrollment-tokens).
- The macOS `.pkg` from the console's **Downloads** page, or the pre-filled `install.sh`.

1. **Create the configuration profile**

    Preference domain: `com.superalign.surface`

    | Key | Type | Required |
    | --- | --- | --- |
    | `EnrollmentToken` | String | Yes |
    | `UserEmail` | String | No |
    | `UserFullName` | String | No |

    ```xml
    <dict>
      <key>EnrollmentToken</key>
      <string>sae_xxxxxxxx.yyyyyyyyyyyyyyyy</string>
      <key>UserEmail</key>
      <string>$EMAIL</string>
      <key>UserFullName</key>
      <string>$FULLNAME</string>
    </dict>
    ```

    **Jamf Pro**

    Configuration Profiles, then **Application & Custom Settings**. Upload the plist or use the schema editor. Jamf substitutes `$EMAIL` and `$FULLNAME` per device.

    **Kandji**

    Add a custom profile with the plist above. Kandji substitutes `$EMAIL`.

    **Mosyle**

    Add a custom profile. Use `%email%` for the user email.

    **Intune**

    Add a preference file (`.plist`) with the domain `com.superalign.surface`.

2. **Deploy the package**

    Assign the `.pkg` to the same device group. Your MDM runs:

    ```bash
    sudo installer -pkg SuperAlign-surface-{version}-darwin-{arch}.pkg -target /
    ```

    The package is signed and notarized, so macOS does not ask for permissions again after updates.

3. **Verify**

    On a Mac, confirm the profile landed:

    ```bash
    defaults read /Library/Managed\ Preferences/com.superalign.surface
    sudo surface status
    ```

    The laptop appears on **Endpoints** within one scan interval.

## Uninstall through MDM

The package bundles an uninstaller. Run it from a policy:

```bash
sudo /opt/surface/bin/uninstall.sh --force
```

It deregisters the laptop from the console, removes the service and files, and deletes the managed profile's settings so a reinstall cannot reuse a revoked token.

## Next steps

- [Browser extension](/surface/deploy/mdm/browser-extension) if you plan to record AI websites
- [Troubleshooting](/surface/scanner/troubleshooting) if a laptop does not appear
- [Update and uninstall](/surface/scanner/update-and-uninstall) for upgrades through the same policy