# Deploy with Jamf Pro

Ship the signed Straza pkg to Macs with one Jamf Pro policy that installs it and runs the managed install for your Straza server, and keep the service switched on with a Managed Login Items profile.

- Who: You, as the Jamf Pro administrator of the Macs whose agents you govern
- Where: Jamf Pro, and a Mac or a Linux machine for the download and its check
- Profile: Standalone and enterprise

In short: One Jamf Pro policy installs the signed Straza pkg on each Mac and then runs the managed install for your Straza server as a script. A configuration profile with a Managed Login Items rule for team WMPWM57KYK keeps the Straza background service switched on, because while it is off every governed tool call is refused.


JamfProcanput`strazaservice`oneveryMacofafleet.ThispageinstallstheStrazapackageformacOSandrunsthemanagedinstallforyourStrazaserverinonepolicy,andaconfigurationprofilekeepstheserviceswitchedon.Thosearethestepsthat[InstalltheserviceonmacOS](https://docs.straza.ai/guides/operate/install/index.md#install-the-service-on-macos)takesbyhand.Eachpersonthenenrollsonce,as[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md#a-macos-machine)shows.##Beforeyoustart{.nostep}-TheStrazapkg,`straza_<version>_darwin_universal.pkg`,from2.0.0oralaterrelease,checkedwithcosignanditschecksumas[Install](https://docs.straza.ai/guides/operate/install/index.md#download-a-release-and-verify-it)shows.ThereleasejobsignsitwiththeDeveloperIDofSynapTechs.r.o.,teamWMPWM57KYK,andApplenotarizesit,soJamfProinstallsitasitis.-MacsonmacOS13orlater,enrolledinJamfProthroughAutomatedDeviceEnrollmentorwithanenrollmentthepersonapproved,whichtheprofileofthelaststepneeds.-TheaddressofyourStrazaserver,andtheharnessestheMacsrun:`claude-code`,`codex`or`gemini`.##UploadthepkgInJamfPro,openSettings,thenComputermanagement,thenPackages,andaddanewpackage.Uploadthepkgunderitsownfilename,whichcarriestheversion,soeveryreleaseyouuploadstaysapartfromtheothers.Leavetheoptionsofthepackageattheirdefaults,becausethepkgneedsnorestart.##AddthemanagedinstallscriptOpenSettings,thenComputermanagement,thenScripts,andaddascriptnamed`Strazamanagedinstall`withthetextbelow.OnitsOptionstab,settheprioritytoAfter,andlabelparameter4`Strazaserver`andparameter5`Harnesses`.```sh#!/bin/sh#JamfProrunsthisasrootafterthepolicyinstallsthepkg.#Parameter4istheStrazaserver'saddress,parameter5theharnesses.server=$4harnesses=$5bin=/opt/straza/bin/strazaif[-z"$server"]||[-z"$harnesses"];thenecho"TheStrazamanagedinstallneedstheserver'saddressinparameter4andtheharnessesinparameter5,suchasclaude-codecodex,andoneofthemisempty,sonothingwaschanged.Fillinbothinthepolicy'sScriptspayload,thenrunthepolicyagain.">&2exit1fiif[!-x"$bin"];thenecho"TheStrazamanagedinstallfoundno$bin,whichtheStrazapkginstalls,sonothingwaschanged.Addthepkgtothispolicy'sPackagespayload,keepthisscriptatthepriorityAfter,thenrunthepolicyagain.">&2exit1fi#Eachharnessbecomesoneargument,so$harnessesstaysunquoted.set-fexec"$bin"install--managed--server"$server"$harnesses```Thescriptchangesnothingwhenaparameterisemptyorthepkg'sbinaryismissing,anditsayswhichoneinthepolicy'slog.Itrunsasrootoutsidesudo,soforcodexthemanagedinstallwritesnoStrazaMCPregistrationintoanyperson's`config.toml`andsaysso.Themanagedcodexhooksstillgoverneverycodextoolcall.ClaudeCodeusesonlyitshighestmanagedsettingssource,soonaMacwithaClaudeCodeprofilefromJamfProorserver-managedsettingsthatlackStraza'shooks,ClaudeCodeskipsthemwithnowarning,as[ClaudeCodeskipsStraza'shooksunderahighermanagedsource](https://docs.straza.ai/security/known-limits/index.md)inKnownlimitssays.##CreatethepolicyOpenComputers,thenPolicies,andaddapolicynamed`Straza`.GiveitthePackagespayloadwiththepkgandtheScriptspayloadwiththescript,fillinthefieldsasthetableshows,andscopeittotheMacswhoseagentsyougovern.|Payload|Field|Value||---|---|---||General|Trigger|RecurringCheck-in,andEnrollmentCompleteforMacsthatenrolllater||General|ExecutionFrequency|Oncepercomputer||Packages|Action|Install||Scripts|Priority|After||Scripts|Strazaserver|Yourserver'saddress,suchas`https://straza.example.com`||Scripts|Harnesses|`claude-code`,orseveralseparatedbyspaces,suchas`claude-codecodex`|Youshouldsee:Inthepolicy'slogs,eachMacinscopeshowstheinstallofthepkg,thenthescript'soutputwitha`managedconfig`linethatnames`/etc/straza/config.yaml`,a`managedbinary`linethatnames`/opt/straza/bin/straza`,andthe`managedwiring`and`managedmcp`linesofeachharness.ThepriorityAfterrunsthescriptoncethepkgisinstalled,sothemanagedinstallalwaysfindsthebinary.AMacwherethepkgrefusedtoinstall,suchasonewhereaccountsotherthanrootcanchange`/opt`,getsthescript'ssentenceaboutthemissingbinaryinthelog,and`/var/log/install.log`onthatMacsayswhythepkgstopped,as[Install](https://docs.straza.ai/guides/operate/install/index.md#install-the-service-on-macos)shows.##KeeptheserviceswitchedonWithoutaManagedLoginItemsprofile,theservicecanbeswitchedoffunderLoginItems&ExtensionsinSystemSettings,andwhileitisoffeverygovernedtoolcallontheMacisrefused.OpenComputers,thenConfigurationProfiles,andaddaprofileatthecomputerlevelthatinstallsautomatically.AdditsManagedLoginItemspayloadwithonerule.ScopetheprofiletothesameMacs.|Field|Value||---|---||RuleType|TeamIdentifier||RuleValue|`WMPWM57KYK`||Comment|`Strazaservice`,orleaveitempty|TherulematcheseveryloginitemwhosecodeissignedbyteamWMPWM57KYK,whichistheStrazaserviceofthereleasepkg.macOSturnssuchanitemonandkeepsiton,andonmacOS26italsoskipsitspromptaboutbackgrounditemsforit.Apackagebuiltfromsourcewithoutthatteam'sDeveloperIDdoesnotmatchtherule.##Upgradeandremove{.nostep}Foralaterrelease,uploaditspkg,andaddasecondpolicywithonlythatpkg,atthefrequencyOncepercomputerandwiththesamescope.ItupgradeseachMacinplacewhileharnesswindowsstayopen,as[Backupandupgrade](https://docs.straza.ai/guides/operate/backup-and-upgrade/index.md)describes.Themanagedinstallneedsnonewrun,becausetheupgradekeepsitsconfigurationandwiring.Thenputthenewpkginthefirstpolicyinplaceoftheoldone,soaMacthatenrollslaterstartsonthenewrelease.TotakeStrazaoffaMac,removeitfromthescopeofthefirstpolicyandtheprofile.Thenrunapolicyonit,atthefrequencyOncepercomputer,withascriptthatrunstheuninstallofthebinaryitself.```sh#!/bin/shexec/opt/straza/bin/strazainstalleruninstall```Theuninstallstopstheserviceandremovesthemanagedwiring,thepackage'sfilesanditsreceipt,andkeepsthekeysin`/var/db/straza-service`forareinstall.OnaMacyouretire,add`--purge`attheendofthatline,whichalsodeletesthekeysandthe_straza-serviceaccount,andthenrevoketheMac'sdevicesattheStrazaserver,as[Backupandupgrade](https://docs.straza.ai/guides/operate/backup-and-upgrade/index.md#remove-straza-from-a-client-machine)shows.##Whatwastested{.nostep}ThisrecipehasnotrunonaJamfProinstance,andnoMacenrolledinJamfProhastakenthepkg,thescriptortheprofile.TheaccountthatrunsapolicyscriptandtheparameterslotsareasJamf'sdocumentationdescribesthem,andtheyhavenotbeenseenonaMac.Thepageiswrittenfromthereleaseworkflowandthepkg'ssources,beforeanyreleasecarriedapkg.Anunsignedpackagebuiltfromthesourcetree,andon2026-10-27apackagesignedwiththeDeveloperIDandnotarizedbyApple,raninamacOS26.6.2virtualmachinethatnodevicemanagementtoolmanages.


Walked on v1.0.0-1614-g5e1d90de-dirty on 2026-10-26, except every Jamf Pro step, which has not run on a Jamf Pro instance or a Mac it manages. Not walked. Written on 2026-10-26 from the working tree of the release workflow that adds the pkg, before any release carried one, and from Jamf's documentation on packages, policy scripts and the Managed Login Items payload, read the same day. No Jamf Pro instance and no Mac enrolled in one has run this recipe. Outside Jamf Pro, on 2026-10-27, a pkg built at v1.0.0-1615-g272946e5, signed with the Developer ID and notarized by Apple, passed spctl on a Mac, and a test script installed, upgraded, uninstalled and purged it in a macOS 26.6.2 virtual machine that no device management tool manages.