Deploy Client on iOS Using Jamf School

Jamf Configuration Profiles manage the core configuration for Client installation. The following sections provide a detailed overview of how to configure these profiles effectively.

Create Profile

Creating profiles is useful as it can help define and configure the system settings such as VPN, Restrictions, and so on for your device. Always create a profile before you start configuring the profile settings. For more information, view Profiles.

1. Log into JAMF School.

   

2. Go to Profiles.

3. Click +Create Profile.

4. In Platform, select the following:

   1. Select the Platform as iOS

   2. Select the Enrollment Type.

   3. Click Next.

5. In Details, perform the following:

   1. Enter the profile name.

   2. Enter the description for the profile.

6. Click Next.

7. In Time Filter, select the checkbox to configure the time at which you want to apply the profile to the devices.

8. Click Finish.

   After creating the profile, it navigates to the page where you can set up the profile details such as Certificates, System Extensions, and so on. Refer to the following sections to learn more about adding different attributes in your profile.

   Pre-Approve VPN Popup for App Proxy

   The Netskope Client on macOS installs a network extension that triggers updates to the device’s Network settings. The following configuration pre-approves these updates and suppresses end-user notifications requesting approval.

   1. In the Jamf School console, go to Profiles.

   2. Select and open the required Profile.

   3. Click Scope.

      1. Click + to add the desired group.

      2. Click Save.

   4. Go to iOS Payload > VPN.

   5. The Netskope Client updates this definition, pre-creating it to prevent prompting the user to add a new VPN configuration.

      Refer to the following table to understand the VPN configuration attributes:

      Attribute Name	Value
      Connection Name	Anything
      Connection Type	Custom SSL
      Identifier	com.netskope.Netskope (case sensitive)
      Provider Type	Packet Tunnel
      Server	gateway-[tenantname].goskope.com
      User Authentication	Password
      Enable VPN on-demand Note: This document goes with the On-demand VPN. You can choose to use Per-App VPN config	enable option
      On demand rules configuration XML	Action Connect InterfaceTypeMatch WiFi Action Connect InterfaceTypeMatch Cellular
      Prohibit users from disabling on-demand VPN settings	enable option

   6. Click Save.

      To add zero-touch configuration, use the Custom Data field in VPN. Adding zero-touch configurations allow automated deployment of the Client thereby removing the user interaction for enrollment. To add zero-touch, use the following Key-Value pair:

      • OrgKey: Use the tenant organizational key

      • AddonHost: Use the addon URL for the tenant: addon-<tenant-URL>

      • UserEmail: Use the variable that contains the user identity for the enrolment. Most likely %Email%

      Do not use Managed Configuration if you are planning to automate the deployment process of the NS Client.

Restrict App Proxy Removal

Netskope recommends adding two optional deployment parameters Prevent Disabling of System Extensions and Restrict App Proxy Removal to manage user permissions regarding System Extensions in macOS 15 (Sequoia) and above. These controls prevent the removal of the specified system extension by the user.

1. In the Jamf School console, go to Profiles.

2. Select and open the required Profile.

3. Click Scope.

   1. Click + to add the desired group.

   2. Click Save.

4. Go to iOS Payload > Restrictions.

5. Disable Allow creation of VPN configurations in the Connectivity settings.

   

Setup Notifications

This step is optional.

Perform the following steps to configure Notifications:

1. In the Jamf School console, go to Profiles.

2. Select and open the required Profile.

3. Click Scope.

   1. Click + to add the desired group.

   2. Click Save.

4. Go to General Payload > Notifications.

5. Configure this part to prevent the Netskope Client from prompting the user to enable its notifications.

6. Click Save.

   

Push Netskope Root and Tenant Certificates Through Jamf School

Provide additional trust to end users by pushing Netskope certificates during Client installation. Before pushing the root and tenant certificates, ensure that you do the following:

1. Download root and tenant certificates from Netskope Certificates page.

   1. Login to Netskope tenant admin console with admin credentials.

   2. Go to Settings > Manage > Certificates > SIGNING CA. The certificate download options are displayed in the Certificate Setup section.

2. Convert the downloaded certificates to .cer format by renaming the .pem files to .cer.

Perform the following steps to add certificates to Jamf School:

1. In the Jamf School console, go to Profiles.

2. Select and open the required Profile.

3. Click Scope.

   1. Click + to add the desired group.

   2. Click Save.

4. Go to General Payload > Certificates.

   1. In Select your file, click Choose File and upload the root certificate.

   2. Click Upload Certificate.

   3. Repeat the same steps to upload the Netskope Intermediate certificate.

5. Click Save.

To create an app:

1. Next, click Apps > Inventory.

2. Click + Add App to add the Netskope application and select Add iOS App from the dropdown menu.

3. Add Netskope Client application.

4. Edit the installed application and ensure to select Apply Managed Configuration.

5. Go to the Managed Configuration section and provide the configuration details.

   <plist version="1.0">
   <dict>
   <key>OrgKey</key>
   <string>xxxxxxxxxxxxxx</string>
   <key>UserEmail</key>
   <string>%Email%</string>
   <key>AddonHost</key>
   <string>addon-<tenant-URL>/string>
   <key>EnrollAuthToken</key>
   <string>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</string>
   <key>EnrollEncryptionToken</key>
   <string>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</string>
   </dict>
   </plist>

   – You must replace OrgKey and Addon Host with tenant values.
   – Ensure that the managed configuration is applied to the user/device before deploying. Failure to do so prevents the Netskope client from downloading its configuration.
   – Zero-touch deployment: Do not use the managed configuration as it conflicts with the VPN profile.

Check the installation logs on the user’s machine in the /var/log/install.log folder. If the user configuration download script fails and the Netskope client installer is executed, the installer will exit and display the “Configuration file missing, aborting installation! error” message.

Check Netskope Client Installation Status

1. To verify the status of each device, go to Computer > Policies and click on the policy you created.

2. Click the Logs button at the bottom to view the log files for each device and then click the Show button.

Confirming the Netskope Client Extension Approval

To confirm that the Netskope Client extension has been approved and the client is running, run the following command in your macOS terminal window:

systemextensionsctl list

The output should look like this:

% systemextensionsctl list  
1 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
* * 24W52P9M7W com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy (85.2.0.269/1) 
NetskopeClientMacAppProxy [activated enabled]

Additionally, inspect the system preferences and Network UI to confirm that Netskope Client extension is active.

See Uninstalling the Netskope Client for instructions on uninstalling the Netskope Client.