Prepare the pilot
Have administrator access, an enrolled Mac running macOS 14 or later, and the vendor management agent where required. Download the Stable 0.3.46 (1144) Guardian Disabled PKG and complete the required configuration before upload. The completedSilmaril-Managed.mobileconfig has passed validation, and the package is the Stable PKG.
Complete the shared profile preparation before creating the Jamf profile or package policy.
Install the profile
In Computers > Configuration Profiles, uploadSilmaril-Managed.mobileconfig as a Computer Level profile with Install Automatically. Scope it to a dedicated Silmaril smart or static group within the existing device configuration. Keep baseline profiles on their existing scopes.
Export the stored payload and compare it with your completed file. Preserve every supplied identifier, UUID, and permission payload. Signed profiles are read-only. For an existing dev.silmaril.mdm.managed identity, use Jamf’s supported replacement workflow. If a signed profile requires removal and reimport, pause the Silmaril app policy, restore that profile identity, and verify policy on pilot Macs before resuming installation.
In the target computer’s Management and History views, confirm the profile is installed and its install command completed. Keep the package policy disabled until then.
Install the package
Upload the 0.3.46 (1144) PKG in Settings > Computer management > Packages. Create a build-specific policy with Recurring check-in, Once per computer, package action Install, no restart, and the same Silmaril rollout group as the profile. Run the verify-and-launch script after the package. It checks bundle IDdev.silmaril.SilmarilMacOS, build 1144, and Guardian Disabled, then opens Silmaril for the console user or relies on login launch when nobody is signed in.
Expect the policy to install the intended Guardian Disabled PKG once, with restart disabled. Script exit 0 opens Silmaril when a console user above UID 500 is signed in. With no signed-in user, the profile launches Silmaril at the next login.
The script’s failure message names the mismatch. It can report a missing app, an unreadable bundle ID or build, an unexpected bundle ID, a build older than 1144, or a Guardian variant that does not match this policy. Correct that result before treating the policy as successful. Package success alone does not mean protection is active.
Verify the pilot
Open Silmaril and verify its identity, managed connection, and fresh Protection activity. Resolve Restart required by fully quitting and reopening the affected agent, then starting a new session.Expand the rollout
For each later cohort, keep the app policy disabled until those Macs show the profile installed. Adding Macs to a group whose app policy is already enabled can deliver both at once. Repeat the profile-first staging and pilot verification for every cohort.Update or replace policy
Deploy the intended Guardian Disabled version and update the app/package metadata together. Create a new version-specific Once per computer policy and script with the new minimum build. Disable old installer policies before enabling the new policy. Editing a completed policy leaves earlier Macs on their existing install. When replacing the profile, preserve its supplied identity and permission payloads. Removing managed keys restores saved local preferences. Profile removal and app removal are separate operations.Uninstall
Disable every Silmaril package policy for the target Macs and preserve baseline scopes. Run the shared MDM uninstall script as root with the affected user signed in. Retain its JSON receipt and exit code. Review exit 2 for the specific remaining items before taking further action. Upload the script in Settings > Computer management > Scripts and add it to a scoped script-only policy under Computers > Policies. Use Once per computer with restart disabled. Follow the shared receipt instructions, then remove only the Silmaril profile when policy should stop applying.Verify-and-launch script
MIN_BUILD is the numeric Stable build 1144. EXPECTED_GUARDIAN is false for this Guardian Disabled policy. The script opens Silmaril only after the bundle ID, build, and Guardian variant match.