Mac OS MDM

TD Endpoint Agent for macOS — MDM Deployment

Deploy the TD Endpoint Agent to macOS devices via any MDM using two configuration profiles and one install script.

Artifacts

Artifact	Delivered via	Purpose
TDAgent-FDA-PPPC.mobileconfig TDAgent-FDA-PPPC.mobileconfig 2KB Open	MDM custom profile	Full Disk Access for the agent
TDAgent-ActivationCode.mobileconfig TDAgent-ActivationCode.mobileconfig 2KB Open	MDM custom profile	Activation code as a managed preference
TD_Endpoint_MacOS_Silicon.dmg	Script / command	Installer app

Order

1. Push the FDA profile.

2. Push the activation-code profile. Important: before uploading, open TDAgent-ActivationCode.mobileconfig in a text editor and replace REPLACE_WITH_ACTIVATION_CODE with the tenant's activation code.

3. Run the install script.

Confirm both profiles landed (sudo profiles show) before installing. No profile

• no code passed to the script = installer exits 2.

Install script

MDM stages the DMG on the device; script mounts, installs, copies the app to /Applications, cleans up. Set DMG to the staged path.

#!/bin/bash
# Run as root.
set -uo pipefail

DMG="/tmp/TD_Endpoint_MacOS_Silicon.dmg"   # match the MDM's file destination
ACTIVATION_CODE=""   # empty -> uses the managed-preference profile
AUTO_UPDATE=""       # "no" to disable auto-update; empty = enabled

if [ -x /opt/TDAgent/tdcli/tdcli.bin ]; then
    /opt/TDAgent/tdcli/tdcli.bin version 2>/dev/null || true
    exit 0
fi

[ -s "$DMG" ] || { echo "ERROR: DMG not found at $DMG" >&2; exit 20; }

MP=$(hdiutil attach -nobrowse -noverify -readonly "$DMG" \
       | awk -F'\t' '/\/Volumes\//{print $NF}' | tail -1)
[ -z "$MP" ] && { echo "ERROR: failed to mount DMG" >&2; exit 21; }
trap 'hdiutil detach "$MP" -quiet 2>/dev/null || true' EXIT

APP=$(find "$MP" -maxdepth 1 -name "*.app" -print -quit)
BIN="$APP/Contents/MacOS/TDAgentInstaller"
[ -x "$BIN" ] || { echo "ERROR: TDAgentInstaller not found at $BIN" >&2; exit 22; }

ARGS=(--headless)
[ -n "$ACTIVATION_CODE" ] && ARGS+=(--activation-code "$ACTIVATION_CODE")
[ -n "$AUTO_UPDATE" ]     && ARGS+=(--auto-update "$AUTO_UPDATE")
"$BIN" "${ARGS[@]}"
RC=$?
echo "TDAgentInstaller exit code: $RC"

if [ "$RC" -eq 0 ]; then
    DEST="/Applications/$(basename "$APP")"
    rm -rf "$DEST"
    ditto "$APP" "$DEST"
fi
exit $RC

Exit codes

Code	Meaning
0	Installed (or already installed)
1	Not root
2	No activation code found
3	Installer payload missing from bundle
4	Install reported success but agent binary absent
20	(script) DMG not found
21	(script) DMG failed to mount
22	(script) installer binary not found
other	From the underlying installer

Verify

sudo /opt/TDAgent/tdcli/tdcli.bin version
sudo launchctl list | grep -E 'com.tdagent|com.threatdefence|com.velocidex'

# Logs should start populating here. If not, check that the Full Disk Access profile has been added.
tail -f /var/log/tdagent/tdagent_events.json

Notes

• Idempotent: re-run exits 0 without reinstalling.

• Auto-update: default on. Disable at install with --auto-update no, or later with tdcli.bin disable-autoupgrade.

• Uninstall: sudo /opt/TDAgent/tdcli/tdcli.bin uninstall.

• Logs: /var/log/tdagent/.

• Test on one Mac before scoping to the fleet.