> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos/jamf-deployment-tp.md).
# Deploying Collector in Jamf
Deploy Nexthink Collector to macOS devices managed in Jamf Pro. The process involves creating a custom deployment package, configuring full disk access permissions, preventing employees from disabling Collector, and deploying the package.
{% stepper %}
{% step %}
## Create a custom package
1. Extract the following file from the downloaded Collector DMG file into a folder:
* `csi.app`
Add the following file to the same folder:
* `Customer Key.txt`
2. Open the folder in Jamf Composer to create a new package.
3. Set file permissions as follows:
| File | Owner | Group | Everyone |
| ------------------ | ------------- | ------------- | ------------- |
| `csi.app` | Read, execute | Read, execute | Read, execute |
| `Customer Key.txt` | Read | Read | — |
4. Add a meaningful name for the package.
5. Add a postinstall shell script to the package and configure the following:
* Set `BASE_PATH` to the folder containing the installation files.
* Set `KEYFILE` to the path and filename of the `Customer Key.txt` file.
6. Set the installer arguments and the clean-up section.
7. Build and save the package as a PKG file.
8. In Jamf Pro, navigate to **Settings > Computer management > Packages**.
9. On the **General** tab, create a new package and assign the PKG installation file to it.
10. On the **Options** tab, set **Priority** to `2` to ensure the package deploys as soon as possible.
11. Save the package.
{% endstep %}
{% step %}
## Create a Collector configuration profile
Nexthink Collector relies on the Apple Endpoint Security framework and follows Apple privacy guidelines. Some Collector components need full disk access to collect complete data and run Remote actions on devices.
{% hint style="info" %}
When deploying Collector version 26.5 or later, you can postpone granting full disk access. The Collector installs successfully and runs in limited mode. It starts full data collection and can run Remote actions only after you grant full disk access.
Collector versions earlier than 26.5 require full disk access at deployment time and cannot postpone it.
{% endhint %}
The following components require full disk access:
* `nxtsvc`: Collects core device data and binary executions and connections events. Permission for this module is mandatory; required by Apple Endpoint Security and Apple privacy controls.
* `nxtcod`: Executes Remote actions on user devices and sends results back to Nexthink. Permission for this module is optional; grant it only if Remote actions need access to special folders or shared network resources.
Pre-authorize full disk access to these components before deploying Collector by pushing a Privacy Preferences Policy Control (PPPC) configuration profile. Select the applicable method from the following tabs and perform the procedure described in it:
{% tabs %}
{% tab title="Use predefined profile components" %}
Nexthink provides a single configuration profile that grants full disk access to both `nxtsvc.app` and `nxtcod.app`.
{% file src="/files/CD6eLPBCr3UY5lMOHGDw" %}
{% endtab %}
{% tab title="Create a profile manually" %}
Perform the following steps for both `nxtsvc` (mandatory) and `nxtcod` (optional):
1. In Jamf, select **Computers > Configuration Profiles**.
2. Select **Privacy Preferences Policy Control > Configure**.
3. Fill in the **Identifier** and **Code Requirement** fields.
Getting the Identifier and Code Requirement values for nxtsvc
#### Identifier
To obtain the Identifier, run the following command on devices where Collector is installed:
```bash
sudo codesign -dv /Library/Application\ Support/Nexthink/nxtsvc.app
```
This displays a response with the value of the **Identifier**, such as `com.nexthink.nxtsvcapp`.
Insert that output to the **Identifier** field in Jamf.
#### Code Requirement
To obtain the Code Requirement, run the following command on devices where Collector is installed:
```bash
sudo codesign -dr - /Library/Application\ Support/Nexthink/nxtsvc.app
```
Insert the output in the **Code Requirement** field in Jamf.
Getting the Identifier and Code Requirement values for nxtcod
#### Identifier
To obtain the Identifier, run the following command on devices where Collector is installed:
```bash
sudo codesign -dv /Library/Application\ Support/Nexthink/nxtcod.app
```
This displays a response with the value of the Identifier, such as `com.nexthink.nxtcod`.
Insert that output to the **Identifier** field in Jamf.
#### Code Requirement
To obtain the Code Requirement, run the following command on devices where Collector is installed:
```bash
sudo codesign -dr - /Library/Application\ Support/Nexthink/nxtcod.app
```
Insert the output in the **Code Requirement** field in Jamf.
4. Select **Add**.
5. Under **App or service access**, set `SystemPolicyAllFiles` to `Allow`.
6. Select **Scope** to define the scope of the profile.
{% endtab %}
{% endtabs %}
### Approve the Nexthink system extension
Nexthink Collector loads its Apple Endpoint Security component as a system extension. Without prior approval, macOS blocks the extension and prompts the user to approve it manually.
To avoid this prompt, add a System Extensions payload to the same configuration profile, allowing team identifier `PDEKAZ43QL`.
{% hint style="warning" %}
Do not also list `PDEKAZ43QL` under explicit bundle identifiers in the same or another profile. Apple rejects configurations that specify the same team identifier in both the team-identifier and bundle-identifier allow lists.
{% endhint %}
{% endstep %}
{% step %}
## Prevent employees from disabling Collector
By default, macOS allows employees to disable background applications, including Collector. To prevent this:
1. In Jamf, select **Computers > Configuration Profiles**.
2. Select **Privacy Preferences Policy Control > Configure**.
3. Copy the team identifier from the **Code Requirement** field; it is the last value in the string.
4. Select **Managed Login Items**.
5. Set the **Team Identifier** rule to the team identifier obtained in the previous step.
6. Ensure the **Include** toggle is enabled.
{% endstep %}
{% step %}
## Deploy the package
Refer to the official [Jamf documentation](https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/Package_Deployment.html) to learn how to deploy packages with Jamf Pro.
{% endstep %}
{% endstepper %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos/jamf-deployment-tp.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.