Screenproof Admin KB

Deploy Screenproof with Addigy

Custom Software for the PKG, a custom MDM profile for the app.screenproof managed preferences. Deploy the PKG first.

Validation status Addigy is the console we have the least first-hand detail on. The steps below follow Addigy's standard Custom Software and custom-profile flows; the profile payload and PKG are the same validated artifacts used on other MDMs. Run a one-device trial before rolling fleet-wide.

1. Deploy the PKG

  1. Create a Custom Software item and upload Screenproof-<version>.pkg (download the current build from https://updates.screenproof.app/Screenproof-latest.pkg) as the installation package.
  2. Assign it to the target policy so it installs on the covered devices.

No install script is needed — the PKG is a single flat component package. It installs /Applications/Screenproof.app and /Library/LaunchAgents/app.screenproof.agent.plist (per-user agent, RunAtLoad — starts at each user's next login, not at boot). The installer is signed Developer ID Installer, team S65X5KY399, and notarized.

2. Deploy the managed-preferences profile

  1. Build your profile: start from examples/managed-preferences.mobileconfig or the Profile Creator.
  2. Under MDM Profiles, create a custom profile from the .mobileconfig and assign it to the same policy. The payload must reach the device unmodified (payload type com.apple.ManagedClient.preferences).

Deploy the optional restrictions and PPPC profiles the same way.

3. Verify on a target Mac

  1. Open Screenproof → Settings → Managed: the managed banner appears with your org's enforced values.
  2. In the Privacy / Export / License tabs, rows forced by the profile show lock icons and read "Managed by your organization".
  3. Open Policy Diagnostics: each forced key lists a MANAGED source.
sudo /usr/libexec/mdmclient QueryInstalledProfiles   # profile present
defaults read /Library/Managed\ Preferences/app.screenproof
Policy changes Screenproof reads managed keys at policy-resolution time — no daemon restart required in principle. Confirm in your trial deploy: change one key, re-push the profile, and check Policy Diagnostics picks up the new value without a relaunch.

Next steps