macOS MDM Deployment

macOS MDM Deployment

This guide explains how to deploy Lumia across macOS machines using your MDM solution to enable inspection and governance of AI traffic on the endpoint.
Deploying Lumia via an MDM solution (such as Kandji, Jamf, or Microsoft Intune) allows you to install the configuration across all organizational endpoints silently in the background. This process requires distributing both the Lumia Certificate and the PKG installer.
Before running the installation, consider the following:

Certificate Trust (Required)

macOS requires certificates to be trusted via an MDM profile for non-interactive (silent) deployments. Ensure the Lumia Certificate is deployed and trusted on the target endpoints before deploying the PKG. If you are not sure how to trust certificates using your MDM, please contact us.

Setting the Endpoint’s Email / Identity

Lumia registers each endpoint to identify which user is associated with it. This identity is used for reporting and to enable direct communication in case of policy violations (e.g., via email or Slack).
  • Automatic Setting: By default, the installer registers the endpoint using the Username@HostName convention.
    (Note: In macOS, this mode does not provide a valid email address, meaning direct user notifications will not work).
  • Custom Setting (Recommended): To enable user notifications and link endpoints to specific user emails, run a pre-install script before deploying the PKG. Use the following command:
    • #!/bin/sh
defaults write /Library/Preferences/com.lumiasecurity.installer email {{email_address}}
    (Note: Replace {email_address}} with your MDM's dynamic variable, such as {{user.email}}).

Installation Steps

  1. Ensure the Lumia Certificate profile is active and trusted on the target machines.
  2. Add the Lumia.pkg file to your MDM as a new macOS App.
  3. If you chose the custom identity setting, add the script from the section above to your MDM's pre-install script field.
  4. Deploy the app to your selected groups or devices.
  5. Restart any AI-related applications that were open during the installation (e.g., Web Browsers, Desktop AI apps like ChatGPT or Cursor, or CLI tools). This ensures the new network configuration (PAC) is active, as some applications load proxy definitions only on startup.
  6. Return to our Getting Started guide and proceed to Step 1.2: Verify Integration. Follow the instructions there to confirm that the endpoint is successfully forwarding AI interactions and that logs are appearing in your Lumia Portal.
💡

Uninstallation

To stop Lumia from monitoring the endpoint, use your MDM to deploy the Lumia_Uninstall.pkg provided by Lumia, or issue an uninstall command.
Â