Screenproof Admin KB

Deploy Screenproof with Kandji

A Custom App Library item for the PKG, and a Custom Profile for the app.screenproof managed preferences. Deploy the PKG first.

1. Deploy the PKG

  1. Library → add a Custom App (or Auto App if you host the PKG yourself) → upload Screenproof-<version>.pkg (download the current build from https://updates.screenproof.app/Screenproof-latest.pkg).
  2. Assignment: assign to the Blueprint covering the target Macs.
  3. Kandji verifies notarization automatically; installs run as root.

The PKG installs /Applications/Screenproof.app and /Library/LaunchAgents/app.screenproof.agent.plist (per-user agent, RunAtLoad — starts at each user's next login, not at boot). The installer is signed Developer ID Installer, team S65X5KY399, and notarized.

2. Deploy the managed-preferences profile

  1. Build your profile: start from examples/managed-preferences.mobileconfig or the Profile Creator.
  2. Library → Custom Profile → upload the .mobileconfig. Kandji passes mcx_preference_settings payloads through unmodified.
  3. Assign to the same Blueprint.

Deploy the optional restrictions profile as another Custom Profile. For the PPPC denylist, Kandji also has a native editor: Library → Privacy Preferences Policy Control.

3. Verify on a target Mac

  1. Open Screenproof → Settings → Managed: the managed banner appears with your org's enforced values.
  2. In the Privacy / Export / License tabs, rows forced by the profile show lock icons and read "Managed by your organization".
  3. Open Policy Diagnostics: each forced key lists a MANAGED source.
sudo /usr/libexec/mdmclient QueryInstalledProfiles   # profile present
defaults read /Library/Managed\ Preferences/app.screenproof
Live-reload under Kandji push: not yet re-validated Screenproof reads managed keys at policy-resolution time — no daemon restart required in principle — but live-reload behavior under Kandji push updates has not been re-validated. Confirm in your trial deploy: push the profile, change one key, re-push, and check Policy Diagnostics picks up the new value without a relaunch.

Next steps