> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.4-eol/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-with-a-unified-configuration-profile-for-mdms.md). # Install with a unified configuration profile for MDMs You install the Cortex XDR agent by deploying an installation package on the endpoint. When you install the Cortex XDR agent for macOS, the operating system requires the user to approve system extensions, notifications, content filter configuration, login items, and to grant full disk access permissions. For a seamless installation that does not require end user interaction, Palo Alto Networks provides a unified configuration profile that you can upload to any third-party deployment software of your choice. This unified configuration profile is compatible with all supported macOS versions and all supported Cortex XDR agent versions. If you prefer to manually create the configuration profile in JAMF, refer to [Install the Cortex XDR Agent Using JAMF](/cortex-xdr-agent/8.4-eol/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-using-jamf.md). These instructions are supplied by Palo Alto Networks to assist our customers. Support with third party vendor tools (with the exception of JAMF) is out of the scope of Palo Alto Networks. Unified configuration profile payloads The following payloads are included in the unified configuration profile: * **Managed Login Items** Payload type: `com.apple.servicemanagement` Required for: macOS 13 and later * **System Extensions** Payload type: `com.apple.system-extension-policy` Required for: macOS 10.15.4 and later * **Content Filter** Payload type: `com.apple.webcontent-filter` Required for: macOS 10.15.4 and later * **Privacy Preferences Policy Control** Payload type: `com.apple.TCC.configuration-profile-policy` Required for: macOS 10.15.0 and later * **Notifications** Payload type: `com.apple.notificationsettings` Required for: macOS 10.15.0 and later {% hint style="info" %} ### Note There is a new signed profile that is valid until June 2027. Any previous signed configuration profiles may have expired, and should be replaced with the updated profiles attached in this section. While using an expired profile is not recommended, no functional impact is expected. There may be future functional impact if using an expired profile. It is very important that you first upload the new profiles before replacing expired profiles. To ensure there are no disruptions to your endpoint profiles, make sure to: 1. Upload the profiles following the steps described below. 2. Ensure all endpoints have both the expired profiles and new profiles. It is recommended to keep both new and old profiles side by side for a month, as ample time to ensure that all deployed agents connect and receive the new profile. 3. Only after all endpoints in your environment have the new profiles can you delete the expired profiles. 4. When all endpoints have the new profiles, and the expired profiles are removed, there may be a short time (up to of 15 minutes) where an agent could appear as disabled. Any potential affected functionality is network related (event collection, host firewall, isolation). This is resolved automatically, and the agent remains functional during this time period. {% endhint %} This flow details how to deploy the Cortex XDR agent on Mac endpoints using the Palo Alto Networks unified configuration profile file. You must perform the steps consecutively as described below. If you change the order, the configuration profiles may not be available at the time the agent requires them, which could cause unexpected behavior. 1. Upload the unified configuration profile to your MDM tool. If you prefer, or are required to sign the configuration file using your own signing certificate, use the unsigned configuration profile provided here. 1. Download the signed or unsigned configuration profile. * [Download the signed configuration profile](https://docs-cortex.paloaltonetworks.com/v/u/CortexXDR-Unified-Config-Profile-V5-Signed). (CortexXDR\_UnifiedConfigProfile\_V5\_SignedPANW\.mobileconfig) SHA256: 61b41f7395fee559394648602341ab3b8e703940a251102c8d832870403bdbd6 MD5: ec8e1bd188aba606e843c146d1a51722 * [Download the unsigned configuration profile](https://docs-cortex.paloaltonetworks.com/v/u/CortexXDR-Unified-Config-Profile-V5-Unsigned) and sign it. (CortexXDR\_UnifiedConfigProfile\_V5\_Unsigned.mobileconfig) SHA256: 9dd42f3a50016b9f81b60934d756638c9f91d39a122e9924a37dc8e69adc20ee MD5: 5ef440126d5489f316c708f7768f076c

Note

Palo Alto Networks recommends you upload only a signed configuration profile file to your MDM, avoid uploading an unsigned file directly to your MDM.

2. Upload the profile to your MDM. 3. In the **Scope** tab of the MDM, add to the **targets list** set to All Computers. 4. Save the configuration profile. If your MDM solution allows .zip files (such as JAMF) to be uploaded, continue with Step 2. If your MDM solution allows only a .pkg file to be uploaded continue with Step 3. 2. Upload the Cortex XDR agent installation package (.zip) to your MDM tool. 1. Create a new agent installation package in the Cortex XDR management console. 2. Upload the ZIP package you downloaded from Cortex XDR to your MDM. Do not extract it. 3. Proceed to distribute the Cortex XDR agent package across your endpoints. 3. Use this step if your MDM solution allows only a .pkg installation file. 1. Extract the zip package downloaded from the Cortex XDR. Using the standalone install package without the config.xml and the included script will set the distribution ID. This is a simple bash that calls Cytool and sets the distribution ID accordingly after the installation (the same can be done with proxy). 2. Upload only the .pkg file. 3. Run the script, which will set the distribution ID and connect the agent to the given tenant. This action can be run directly after the installation, however an optional delay may be found necessary. `#!/bin/bash` `sleep 120` `echo Password1|/Library/Application\ Support/PaloAltoNetworks/Traps/bin/cytool reconnect force ; sleep 5; /Library/Application\ Support/PaloAltoNetworks/Traps/bin/cytool checkin` 4. There is no connection to any tenant at this point in time, so there is no policy, the initial password will always be the default \. After this, the Cortex XDRagent will register with the given tenant and get its policy. This is supported by all MDM solutions, either as a single action/policy, where you can define a package to install and a script to run after the install, or as a separate action. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.4-eol/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-with-a-unified-configuration-profile-for-mdms.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.