Install with a Unified Configuration Profile for MDMs
Use the Palo Alto Networks unified configuration profile
for MDMs to seamlessly install the Cortex® XDR™ agent on macOS endpoints.
You install the Cortex XDR agent by deploying
an installation package on the endpoint. When you install the Cortex
XDR agent for macOS, the operating system requires the user to approve
extensions and notifications and to grant full disk access permissions.
For a seamless installation that does not require end user interaction,
Palo Alto Networks provides a unified configuration profile that
you can upload to any third-party deployment software of your choice.
This unified configuration profile is compatible with all supported
macOS versions and all supported Cortex XDR agent versions. If you
prefer to use individual configuration profiles, refer to Install the Cortex® XDR™ Agent Using JAMF.
- This unified configuration profile is not supported on JAMF Pro 10.27 - 10.29. JAMF Pro introduced native support for the notifications payload in their UI in version 10.27, however an issue in the Jamf parser prevents configuration profiles that include the notifications payload to successfully import into JAMF. On these versions, you must create the configuration for the notifications payload manually in the JAMF UI. You can still use the Palo Alto Networks signed individual configuration profiles to import the other configurations.
- Following the changes Apple introduced in macOS 11.3 for MDMs, when you remove an MDM configuration profile that includes permissions for system extensions (for Cortex XDR agents or Global Protect), the system extensions will be instantly unloaded from all endpoints. As a result, the Cortex XDR protection status will be disabled. For the suggested workaround, refer to the Cortex XDR 7.4 agent list of known issues.
The
following payloads are included in the unified configuration profile:
- Kernel ExtensionsPayload type:com.apple.syspolicy.kernel-extension-policyRequired for: macOS 10.15.3 and earlier
- System ExtensionsPayload type:com.apple.system-extension-policyRequired for: macOS 10.15.4 and later for Cortex XDR agent 7.0 or later
- Content FilterPayload type:com.apple.webcontent-filterRequired for: macOS 10.15.4 and later for Cortex XDR agent 7.0 or later
- Privacy Preferences Policy ControlPayload type:com.apple.TCC.configuration-profile-policyRequired for: macOS 10.15.0 and later
- NotificationsPayload type:com.apple.notificationsettingsRequired for: macOS 10.15.0 and later
Due to changes
of certification, signed profiles need to be renewed every year.
The existing signed Configuration Profiles have expired and we recommend you
replace them with the updated profiles attached here. While using
an expired profile is not recommended, no functional impact is expected
at this point.
It is very important that you first upload
the new profiles before replacing the expired profiles. To ensure
there are no disruptions to your endpoint profiles, make sure to:
- Upload the profiles following the steps described below ensuring you add the profiles to the same scope as the expired profiles. For example, same groups and dynamic groups.
- Ensure all endpoints have both the expired profiles and new profiles.
- Only after all endpoints in your environment have the new profiles can you delete the expired profiles.
This
flow details how to deploy the Cortex XDR agent on Mac endpoints
using the Palo Alto Networks unified configuration profile file.
You must perform the steps consecutively as described below and
you must not change the order. If you change the order, you risk
that the required configuration profiles will not be available at
the time the agent requires them, which could cause the agent to
display unexpected behavior.
- Create a new smart group in Jamf.In your Jamf smart group, setDisplay Name—Apple M1, and add two criteria with the following values:
- First criteria:Criteria—Processor Type,Operator—is,Value—Apple M1
- Second criteria:AND/OR—or,Criteria—Architecture Type,Operator—is,Value—arm64
In other MDM solutions, smart groups could be referred to as dynamic groups or a similar name. If the processor type criteria is not available in your MDM solution, use only the architecture type. This will cover the M1 chip and future chips using the arm64 architecture. - Upload the signed unified configuration profile to your MDM tool.
- For Apple Silicon (M1) endpoints—
- Download the signed configuration fileCortexXDR_UnifiedConfigProfile_ARM64_V3_SignedPANW.mobileconfig(MD5=d5f30b9a33ff8068fae2252a1e64b1b6). If you prefer or are required to sign the configuration file using your own signing certificate, download the unsigned configuration fileCortexXDR_UnifiedConfigProfile_ARM64_V3_Unsigned(MD5=6daf863f647c4a99a9e66a5f017d4832) and sign it.
- Upload the file to your MDM.
- In theScopetab, add to thetargets listthe Apple M1 smart group you created in the previous step.
- Save the configuration profile.
- For all other non-M1 endpoints—
- Download the signed configuration fileCortexXDR_UnifiedConfigProfile_Intel_V3_SignedPANW(MD5=7b1c8a63d888bae56a47a681c174fa09). If you prefer or are required to sign the configuration file using your own signing certificate, download the unsigned configuration fileCortexXDR_UnifiedConfigProfile_Intel_V3_Unsigned(MD5=50a4e179eec78f6d8b35f794333cd206) and sign it.
- Upload the file to your MDM.
- In theScopetab, add to theexclusions listthe Apple M1 smart group you created in the previous step. Then, proceed to specify your target group - either all computers or a smart group you have predefined.
- Then, still under theScopetab, proceed to add yourTarget group- either all computers or a smart group you have predefined.
- Save the configuration profile.
Palo Alto Networks recommends you upload only a signed configuration profile file to your MDM, and avoid uploading the unsigned file directly to your MDM. - Upload the Cortex XDR agent installation package to your MDM tool.
- Create a new agent installation package in the Cortex XDR management console.
- Upload the ZIP package you downloaded from Cortex XDR to your MDM. Do not extract it.
- Proceed to distribute the Cortex XDR agent package across your endpoints.
