Deploy Client on MacOS Using Jamf Pro

Jamf Configuration Profiles manage the core configuration for Client installation. The following sections provide a detailed overview of how to configure these profiles effectively. You can add the following to a New or Existing Configuration Profile.

To create a New Configuration Profile:

1. In the Jamf console, go to Computers > Configuration Profiles > New.

2. Under Options > General.

   1. Enter the display name. For example, Netskope Client Configuration Profile.

   2. Choose the following:

      • Category: None

      • Level: Computer Level

3. Click Scope.

4. Click Targets, then select the specific user(s) or device(s) to assign the configuration profile.

5. Click Save.

Pre-Approve Network Extension

The Netskope Client on macOS installs a network extension that requires administrator approval to function. The following configuration pre-approves the network extension and suppresses end-user notifications requesting approval.

1. In the Jamf console, go to Computers > Configuration Profiles > select required Configuration Profile.

2. Go to Options > System Extension.

3. Click Configure or Edit.

4. Select Allow users to approve system extensions.

5. Under Allowed Team IDs and System Extensions, enter a display name. For example, Netskope System Extension.

6. Choose the following:

   • System Extension Types: Allowed System Extensions

   • Team Identifier: 24W52P9M7W

7. Click Add to add the following System Extension: com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy

8. In the Scope tab, assign the target computers.

9. Click Save.

   

Pre-Approve Full Disk Access Permission For macOS 14 (Sonoma) and Later

The Netskope Client on macOS requires Full Disk Access permissions for various foundational functionalities. The following configuration pre-approves these permissions and suppresses end-user notifications requesting approval.

1. In the Jamf console, go to Computers > Configuration Profiles > select required Configuration Profile

2. Go to Options > Privacy Preferences Policy Control.

3. Click Configure or Edit.

4. Under App Access, enter the following:

   • Identifier: com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy

   • Select Bundle ID for Identifier Type.

   • Code Requirement: anchor apple generic and identifier "com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

5. Click +Add to allow or deny access to a service or app.

6. Select SystemPolicyAllFiles under App or Service and Allow under Access.

   

7. Click Save.

8. Save the configuration profile.

Pre-Approve VPN Popup for App Proxy

The Netskope Client on macOS installs a network extension that triggers updates to the device’s Network settings. The following configuration pre-approves these updates and suppresses end-user notifications requesting approval.

1. In the Jamf console, go to Computers > Configuration Profiles > select required Configuration Profile.

2. Go to Options > VPN.

3. Click Configure or Edit and configure the VPN with following:

   • Connection Name: Any Name

   • VPN Type: Select Per-App VPN

   • Per-App VPN Connection Type: Select Custom SSL

   • Identifier: Enter com.netskope.client.Netskope-Client

   • Server: Enter the Netskope Gateway URL for the tenant: gateway-<tenant_hostname>.goskope.com

   • Provider Bundle Identifier: Enter com.netskope.client.Netskope-Client

   • Provider Type: Select App-Proxy

   • Select Include All Networks

   • For Specify Provider Designated Requirement, enter the following:
     anchor apple generic and identifier"com.netskope.client.Netskope-Client" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

   • Select Prohibit users from disabling on-demand VPN settings.

4. Click Save.

Prevent Disabling of System Extensions in macOS 15 (Sequoia) or Later

Netskope recommends adding two optional deployment parameters Prevent Disabling of System Extensions and Restrict App Proxy Removal to manage user permissions regarding System Extensions in macOS 15 (Sequoia) and above. These controls prevent the removal of the specified system extension by the user.

1. In the Jamf console, go to Computers > Configuration Profiles > select required Configuration Profile.

2. Go to Options > System Extensions.

3. Click Configure or Edit.

4. Select Allow users to approve system extensions.

5. Under Allowed Team IDs and System Extensions, enter a display name. For example, Netskope System Extension.

6. Choose the following:

   • System Extension Types: Non-removable system extensions from UI

   • Team Identifier: 24W52P9M7W

7. Click Add to add the following System Extension: com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy

   

8. In the Scope tab, assign the target computers.

9. Click Save.

Restrict App Proxy Removal

Netskope recommends adding two optional deployment parameters Prevent Disabling of System Extensions and Restrict App Proxy Removal to manage user permissions regarding System Extensions in macOS 15 (Sequoia) and above. These controls prevent the removal of the specified system extension by the user.

1. In the Jamf console, go to Computers > Configuration Profiles > select required Configuration Profile.

2. Go to Options > Restrictions.

3. Click Configure or Edit.

4. Under Preferences, select Restrict items in System Preferences.

5. Select items (Network in this case).

6. Add the scope (machine) and push the profile.

7. Click Save.

Push Netskope Root and Tenant Certificates via Jamf

Provide additional trust to end users by pushing certificates during client installation. Before you can push the root and tenant certificates, ensure that you do the following:

Perform the following steps to add certificates to Jamf:

1. In the Jamf console, go to Computers > Configuration Profiles > select required Configuration Profile

2. Go to Options > Certificate.

3. Click Configure or Edit.

4. Enter a name for the certificates.

5. Select Upload to upload the converted root and tenant certificates.

   To add a certificate click the “+” icon.

6. In the Scope tab, select the target computers.

7. Click Save.

Additional core configuration for Client installation is carried out using Jamf policies. The following sections provide a detailed explanation of how these policies are configured.

Add Installation Script to Jamf

Perform the following steps to add the Netskope Client installation script to Jamf using the script editor:

1. In Jamf, go to Settings > Computer management.

2. Click Scripts.

   

3. Click +New.

4. In the General tab, add the Display Name and other basic settings for the script.

5. In the Script tab, copy and paste the script contents in the script editor.

   Copy and paste the shell script from the file: nsclientconfig.sh downloaded from the Netskope Support portal. For more information, view Prerequisites.

6. In the Options tab, provide the additional settings for the script, including the priority and parameter labels (Optional).

   For Priority, select Before. The script must be executed before the installation process, so Priority must be Before.

7. (Optional)In the Limitations tab, provide the operating system requirements for the script.

8. Click Save.

For more information on adding a script, view Add Script.

Upload Client Package to Jamf

Perform the following steps to upload the Netskope Client macOS package to Jamf.

To upload a package:

1. In Jamf, go to Settings > Computer management.

2. Click Packages.

3. Click +New.

4. In the General tab:

   1. Add the Display Name and other basic settings for the package.

   2. In Filename, drag and drop the Netskope Client installer package for macOS or click browse for a file to select and upload the package.

      

5. (Optional) If you are uploading an enrollment package, you can upload a custom manifest file by dragging and dropping or clicking browse for a file in the Manifest file field.

6. In the Options tab, add the additional settings for the package, including the priority.

7. (Optional) In the Limitations tab, provide the operating system and architecture type requirements.

8. Click Save.

Configuring the Jamf Policy

Perform the following steps to build the Jamf Policy.

The following can be added to a New or Existing Jamf Policy. If using an existing Policy navigate to the Policy and skip to step 5:

1. In the Jamf console, go to Computer > Policies.

2. Click + New.

3. Under Options > General.

4. Enter a Display Name, for example: Netskope Client Policy.

5. For Trigger, select Login.

   Run Scripts using other options such as Logout and Network State Change; according to the administrator requirements.

6. For Execution Frequency, select Once per computer.

7. Select Options > Packages.

8. Click Configure.

9. Click Add to include the Client installer package that you uploaded in this section.

10. After you click Add, the Package UI displays the selected package. 

11. On the Package screen, select Install from the dropdown options in Action.

12. Select Options > Scripts.

13. Click Configure.

14. Click Add to include the .sh script configured in this section.

    • For Priority, select Before. The script must be executed before the installation process, so Priority must be Before.

    • Update the script options for the parameters depending on the deployment mode below. Refer to the table below the instructions to understand the available enrollment methods and associated parameters required for the script.

15. Click the + button to add another script.

16. When finished, click Save.

External Browser-based Authentication

The Netskope Client supports FIDO authentication on macOS devices via external browser integration with our SAML forward proxy. When you enable external browser support during the deployment of the Netskope Client, the authentication flow transitions from the client’s built‑in browser to the operating system’s default browser. This adjustment enables the use of more advanced and robust web authentication mechanisms.

External browser support is available for Safari, MS Edge, and Google Chrome when set as the default browser (Firefox is not supported).  

Configure the following additional parameters in the needed Jamf Policy when deploying the Client in IdP mode (single user and multi-user):

The following parameters are to be appended to the Jamf Policy as the next available:

• Mode: Mode is a string value used to enable external browser support

  • Embedded: Default value and opens the existing mini-browser.

  • Scheme:  Opens the external browser (system default browser).

• preferEphemeral:

  • True: An ephemeral (private) browser window will be launched from the default browser.

  • False: A regular (non-private) browser window will be launched from the default browser.

• httpmethod: httpmethod alters the web authentication flow in efforts to alleviate issues with the Safari browser and redundant WebAuth.html notification pop-ups. If Safari is not the default browser, this parameter (httpmethod) is not needed.

  httpmethod=get

  These parameters require the latest JAMFScript_v20_Jan2023 available in Netskope Support portal.

  For example,

  sudo ./nsclientconfig.sh 1 2 3 idp goskope.com corp 0 mode=scheme preferephemeral=true httpmethod=get

Create .plist File for PLIST User Enrollment

This section contains the steps to install the Netskope Client using PLIST user enrollment.

Step 1: Save PLIST File

Save the following com.netskope.client.plist file and use it with your MDM for Netskope Client PLIST deployments.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
	<dict>
		<key>email</key>
		<string>$EMAIL</string>
	</dict>
</plist>

Step 2: Configure Jamf to Push the PLIST File to the macOS Machine

The following can be added to a New or Existing Configuration Profile. If using an existing Configuration Profile navigate to the Profile and skip to step 3:

1. In the Jamf console, go to Computers > Configuration Profiles > New.

2. Under Options > General.

   1. Enter the display name. For example, PLIST File Deployment.

   2. Choose the following:

      • Category: None

      • Level: Computer Level

      • Distribution Method: Install Automatically

3. Go to Application and Custom Settings.

4. Click Upload. 

5. Click Add to enter the details of the previously created plist file.

   1. The Preference Domain should be the name of the plist file you generated without .plist. For example, if using the instructions above, the preference name should be com.netskope.client.

   2. Click Upload to upload the previously created plist file and see the contents displayed under Property List.

      

      
      

6. Click Scope and assign the plist payload you created to the appropriate user or machine groups. 

7. Click Save.

Check the installation logs on the user’s machine in the /var/log/install.log folder. If the user configuration download script fails and the Netskope client installer is executed, the installer will exit and display the Configuration file missing, aborting installation! error message.

Check Netskope Client Installation Status

1. To verify the status of each device, go to Computer > Policies and click on the policy you created.

2. Click the Logs button at the bottom to view the log files for each device and then click the Show button.

   Confirming the Netskope Client Extension Approval

   To confirm that the Netskope Client extension has been approved and the client is running, run the following command in your macOS terminal window:

   systemextensionsctl list

   The output should look like this:

   % systemextensionsctl list  
   1 extension(s)
   --- com.apple.system_extension.network_extension
   enabled active teamID bundleID (version) name [state]
   * * 24W52P9M7W com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy (85.2.0.269/1) 
   NetskopeClientMacAppProxy [activated enabled]

   Additionally, inspect the system preferences and Network UI to confirm that Netskope Client extension is active.

See Uninstalling the Netskope Client for instructions on uninstalling the Netskope Client.