> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos/jamf-deployment-tp.md).
# Deploying Collector in Jamf
## Creating a custom package file for deployment
To create a custom package file for large-scale deployment:
{% stepper %}
{% step %}
Download the macOS Collector DMG file directly from the product on the [Collector management](/platform/user-guide/administration/system-configuration/collector-management.md) dashboard under **Administration > Collector management > Downloads**.
{% endstep %}
{% step %}
Extract the following files into a folder:
* `csi.app`
* `Customer Key.txt`
{% endstep %}
{% step %}
Open the folder containing the files in Jamf Composer to create a new package.
{% endstep %}
{% step %}
Set the permissions on the files as follows:
| File | Owner: root | Group: wheel | Everyone |
| ------------------ | ------------- | ------------- | ------------- |
| `csi.app` | read, execute | read, execute | Read, execute |
| `Customer Key.txt` | read | read | — |
| {% endstep %} | | | |
{% step %}
Add a meaningful name for the package.
{% endstep %}
{% step %}
Add a new postinstall shell script to the package and ensure the following:
* The `BASE_PATH` points to the folder that contains the installation files.
* The path and filename in `KEYFILE` points to the `Customer Key.txt` file.
{% endstep %}
{% step %}
Set the installer arguments and the clean-up section.
{% endstep %}
{% step %}
Build and save the package as a PKG file.
{% endstep %}
{% step %}
In Jamf Pro, go to **Settings > Computer management > Packages**.
{% endstep %}
{% step %}
On the **General** tab, create a new package and assign to it the installation package file.
{% endstep %}
{% step %}
On the **Options** tab, set the **Priority** to 2 to ensure the package will be deployed as soon as possible.
{% endstep %}
{% step %}
Save the package.
{% endstep %}
{% step %}
Extract the following files into a folder:
* `csi.app`
* `Customer Key.txt`
{% endstep %}
{% step %}
Open the folder containing the files in Jamf Composer to create a new package.
{% endstep %}
{% step %}
Set the permissions on the files as follows:
| File | Owner: root | Group: wheel | Everyone |
| ------------------ | ------------- | ------------- | ------------- |
| `csi.app` | read, execute | read, execute | Read, execute |
| `Customer Key.txt` | read | read | — |
| {% endstep %} | | | |
{% step %}
Add a meaningful name for the package.
{% endstep %}
{% step %}
Add a new postinstall shell script to the package and ensure the following:
* The `BASE_PATH` points to the folder that contains the installation files.
* The path and filename in `KEYFILE` points to the `Customer Key.txt` file.
{% endstep %}
{% step %}
Set the installer arguments and the clean-up section.
{% endstep %}
{% step %}
Build and save the package as a PKG file.
{% endstep %}
{% step %}
In Jamf Pro, go to **Settings > Computer management > Packages**.
{% endstep %}
{% step %}
On the **General** tab, create a new package and assign to it the installation package file.
{% endstep %}
{% step %}
On the **Options** tab, set the **Priority** to 2 to ensure the package will be deployed as soon as possible.
{% endstep %}
{% step %}
Save the package.
{% endstep %}
{% endstepper %}
## Creating a Collector configuration profile
You can [#installingcollectorprofileinjamfformacos-creatingthecollectorconfigurationprofileinjamf-1](#installingcollectorprofileinjamfformacos-creatingthecollectorconfigurationprofileinjamf-1 "mention") or [#installingcollectorprofileinjamfformacos-downloads](#installingcollectorprofileinjamfformacos-downloads "mention").
{% hint style="info" %}
Create multiple Collector profiles with different configurations for different device groups.
{% endhint %}
#### Download the predefined configuration profile components
Nexthink Collector relies on the Apple Endpoint Security framework and follows Apple’s privacy guidelines. For this reason, certain macOS apps requires full disk access:
* `nxtsvc` is required by Apple Endpoint Security and Apple privacy controls. This permission is mandatory.
* `nxtcod` is the remote action process. Grant this permission only if remote actions need access to special folders or network shares.
Administrators can manually enable it using the System Preferences application utility or use the mobile device management (MDM) capabilities to configure and update settings remotely. Nexthink provides sample files you can use to create the configuration files you need for both `nxtsvc.app` and `nxtcod.app`.
| Component | File |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `nxtsvc` |
|
| `nxtcod` | [.mobileconfig file](https://download.nexthink.com/doc/Nexthink-Configuration.mobileconfig) |
#### Create a new profile and grant full disk access permission
For both `nxtsvc` (full disk access) and `nxtcod` (remote action process), perform the following steps:
{% stepper %}
{% step %}
In Jamf, select **Computers > Configuration Profiles**.
{% endstep %}
{% step %}
Select **Privacy Preferences Policy Control > Configure**.
{% endstep %}
{% step %}
Fill in the **Identifier** and **Code Requirement** fields in the **App Access** section.
Getting the Identifier and Code Requirement values for nxtsvc
To obtain the **Identifier**, run the following command on devices where Nexthink Collector is installed:
```bash
sudo codesign -dv /Library/Application\ Support/Nexthink/nxtsvc.app
```
This displays a response with the value of the **Identifier**, such as `com.nexthink.nxtsvcapp`. Copy that value to the **Identifier** input in Jamf.
To obtain the **Code Requirement**, run the following command on devices where Nexthink Collector is installed:
```bash
sudo codesign -dr - /Library/Application\ Support/Nexthink/nxtsvc.app
```
Copy the result of the designated output to the **Code Requirement** field in Jamf.
Getting the Identifier and Code Requirement values for nxtcod (optional)
The `nxtcod` binary also requires full disk access when remote actions need to access special folders or network shares.
To obtain the **Identifier**, run the following command on devices where Nexthink Collector is installed:
```bash
sudo codesign -dv /Library/Application\ Support/Nexthink/nxtcod.app
```
This displays a response with the value of the **Identifier**, such as `com.nexthink.nxtcod`. Copy that value to the **Identifier** input in Jamf.
To obtain the **Code Requirement** run the following command on devices where Nexthink Collector is installed:
```bash
sudo codesign -dr - /Library/Application\ Support/Nexthink/nxtcod.app
```
Copy the result of the designated output to the **Code Requirement** field in Jamf.
{% endstep %}
{% step %}
Select **Add**.
{% endstep %}
{% step %}
Set the following values:
| APP OR SERVICE | ACCESS |
| -------------------- | ------ |
| SystemPolicyAllFiles | Allow |
| {% endstep %} | |
{% step %}
Select **Scope** to define the scope of the profile.
{% endstep %}
{% endstepper %}
| Component | Description | File |
| --------- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `nxtsvc` |
Required by Apple Endpoint Security framework and Apple’s privacy guidelines.
Use it if remote actions need to access special folders or network shares.
This component is optional.
| [.mobileconfig file](https://download.nexthink.com/doc/Nexthink-Configuration.mobileconfig) |
## Preventing users from disabling Collector
By default, macOS offers users the ability to turn off background applications, including Collector. Perform the following steps to avoid this:
{% stepper %}
{% step %}
In Jamf, select **Computers > Configuration Profiles**.
{% endstep %}
{% step %}
Select **Privacy Preferences Policy Control > Configure**.
{% endstep %}
{% step %}
Copy the team identifier from the Code Requirement field, which is the last value in the string:
{% endstep %}
{% step %}
Select **Managed Login Items**.
{% endstep %}
{% step %}
Set the following values:
| Rule type | Rule value |
| --------------- | ---------------------------- |
| Team Identifier | The value obtained in Step 3 |
| {% endstep %} | |
{% step %}
Ensure the **Include** toggle is enabled.
{% endstep %}
{% endstepper %}
## Deploying the package
Refer to the official [Jamf documentation](https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/Package_Deployment.html) to learn how to deploy packages with Jamf.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos/jamf-deployment-tp.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.