Jamf Pro

Deploying the device agent with Jamf Pro takes two steps:

1. Deploy the configuration profile.
2. Deploy the installer package.

For the general approach to MDM installations, see the MDM installations page.

Prerequisites

• Download speakeasy-agent_<version>.pkg from Organization Settings → Secure → Device Agent in the dashboard, or from the release bucket at https://storage.googleapis.com/speakeasy-device-agent-releases-prod/v<version>/speakeasy-agent_<version>.pkg. It’s a single Developer ID signed, notarized, universal pkg that installs the daemon, CLI, menu-bar UI, and privileged helper together, and registers its own launchd jobs. No script needed.
• Get the org_slug and org_token values from the Organization values card on the Device Agent page. Copy org_slug, then click Generate token to mint the org_token and copy it. Generating a token requires the org:admin role. The token is shown only once, so copy it immediately. If a token already exists, the button reads Re-generate token. Re-generating creates a new token and leaves existing tokens working. Revoke old tokens under Settings → API Keys.

1. Set up the configuration profile

1. In Jamf Pro, create a Configuration Profile with an Application & Custom Settings payload.
2. Set the preferences domain to com.speakeasy.agent and supply the configuration as a plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>v</key><integer>1</integer>
  <key>email</key><string>$EMAIL</string>
  <key>org_token</key><string>spk_org_…</string>
  <key>org_slug</key><string>example-corp</string>
</dict>
</plist>

3. Use Jamf’s payload variables (like $EMAIL) so one profile serves the whole fleet, and scope it to the target devices.

2. Roll out the package

Upload the installer to Jamf Pro as a Package and scope it to the fleet.

Complete the configuration profile rollout before deploying the installer. The device agent relies on the identity in the profile to bootstrap correctly in the organization.

Audit the policy by package receipt: pkgutil --pkg-info com.speakeasy.agent.pkg. A policy that verifies a /Applications bundle never finds the agent, which installs machine-wide to /Library/Application Support/Speakeasy/ with its launchd jobs in /Library/LaunchAgents/ and /Library/LaunchDaemons/. With auto_update: "automatic" in the managed configuration the agent keeps the daemon, CLI, and app current on its own, so routine releases need no re-push. The package is safe to re-push when one is called for: its postinstall reloads the launchd jobs idempotently.

Connect Jamf to the dashboard

Jamf Cloud tenants only. Outbound requests are restricted to public address space, so on-premises Jamf instances are not supported.

1. In Jamf Pro, go to Settings → System → API roles and clients. Create an API role with only the Read Computers privilege, then an API client bound to that role. Enable the client and copy the client ID and the one-time client secret.
2. In the dashboard, open Device Agent → MDM Integrations, then Connect on the Jamf Pro row.
3. Enter your tenant root URL (https://yourtenant.jamfcloud.com) and the client credentials. Credentials are stored encrypted and are never shown again after saving.
4. Save, then Test connection. The test runs a real request against your tenant using the saved credentials.
5. Enable the connection. New connections start paused so that invalid credentials never generate failed sync attempts: the flow is save, test, then enable.

The integration reads each computer’s User and Location email to attribute devices to people. Coverage can only be attested for devices whose records carry an assigned-user email. If your fleet shows a large “No email in MDM” count, populate the email field on device records (directory-bound enrollment usually does this automatically).

Once enabled, the inventory syncs hourly. Each schedule can be paused, resumed, or run immediately with Sync now from the integration’s detail page, which also shows the coverage breakdown and the searchable device inventory.