Skip to content

Deploy Resilio Agents using MDM

Feature availability

Available in Resilio 6.0.5 and newer.

macOS - Jamf Now

Set up Resilio Agent on macOS devices enrolled in Jamf Now MDM

Prerequisites

  • Jamf Now Plus plan (required for custom package upload).
  • A signed distribution package Resilio-Connect-Agent.pkg.
  • Target Macs enrolled in Jamf Now with each Mac belonging to exactly one Blueprint.

Note

A package assigned to a Blueprint with the Install Automatically option enabled is installed on every Mac in that Blueprint, including devices added later.

  1. Upload the package.

    1. Select Apps > + Add an App > Upload Your App.
    2. Drag and drop your signed .pkg file or click Browse to search for it on your computer.

    3. Enter a name for your app, for example, Resilio Agent 6.0.5 and click Done.

      Note

      The Version reported by Jamf may differ from the actual package revision. Make sure to include the correct version in the app name for future reference.

  2. Assign to Mac devices via Blueprints.

    1. Select Blueprints.
    2. For each Blueprint, select Apps and click Add an App/Edit Apps.

    3. Locate the Resilio Agent app, select the Install Automatically option, then click Save Changes.

      Note

      Make sure to keep your Blueprints as they will be required for updates.

  3. Verify installation procedure.

    1. Select Devices > Mac > Sync to force a check-in.

    2. Select Devices > Mac > Mac Apps to view the status.

      Note

      It confirms the command was delivered, not that installation finished.

    3. On the Mac, run the following command:

      ls -ld "/Applications/Resilio Connect Agent.app"

Updating to a new version

Jamf Now does not replace a previously uploaded package - each version is a separate library entry.

Warning

  • Updating the Resilio Agent requires closing the Agent UI and stopping the Agent service on the target Mac, which involves unmounting the job folder and may interrupt file transfers. Make sure to notify end users about the update.
  • Do not enable the Install Automatically option for two versions in the same Blueprint.
  1. Upload the new package as a new custom app instance, make sure to include the new version in the app name.
  2. For each Blueprint containing the old version, select Apps > Edit Apps > disable Install Automatically for the old entry and enable it for the new entry > Save Changes.
  3. Once the new version is installed, select Apps, then locate the old entry, click and select Remove.

Set up Resilio Agent app profile

The Agent profile delivers settings and permissions required for the Resilio Agent to connect to the Management Console.

Warning

Do not modify any values other than those described in the procedure below.

Prerequisites

  1. Prepare the .mobileconfig profile.

    Note

    Every setting in the template is commented out. A commented-out setting is not delivered to the target Mac device, and the Resilio Agent uses its default value.

    1. Download the .mobileconfig profile template and open it in a plain-text editor.
    2. For each setting, remove the <!-- and --> comment markers around its <key> and value elements. Leave the descriptive comment above the setting in place.

    3. Enter the value for the parameter.

      Note

      Place strings values between <string> and </string> tags. Use <true/> or <false/> tags for boolean values.

      • use_gui – Controls availability of the Agent UI.
      • management_server.host – The hostname or IP address of the Management Console along with the Management Console's control traffic port number (default: 8444).
      • management_server.bootstrap_token – Bootstrap token for authenticating Agent connections to the Management Console.
      • management_server.spn – Management Console's SPN for Agent connections authentication via Active Directory or Entra.
      • management_server.cert_authority_fingerprint – The fingerprint of the Management Console's certificate authority.
      • management_server.disable_cert_check – Whether to disable certificate checking (default: false).
      • local_policy.allowed_jobs – The types of jobs that the Agent is allowed to participate in.
      • local_policy.allowed_hybrid_job_cache_path – Cache folder location for Hybrid Work Jobs.
      • local_policy.allow_fs_browsing – Whether to allow Resilio administrators to browse the file system when setting up Jobs.

    4. Fill in both PayloadUUID fields with different values.

      Tip

      You can use uuidgen to generate UUIDs.

    5. (Optional) Enter your organization name in PayloadOrganization, which will show in Device Management on the Mac.

    6. Run the following command to validate your profile: 
      plutil -lint Connect-Agent-MDM-Profile.mobileconfig
    Example profile 
    <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.resilio.ConnectAgent</string>
            <key>PayloadIdentifier</key>
            <string>com.resilio.connectagent.settings.payload</string>

            <!-- UUID. Example 4BC4FBF6-C3C9-4E2C-861E-0D3CC8C02AB8 -->
            <key>PayloadUUID</key>
            <string>4BC4FBF6-C3C9-4E2C-861E-0D3CC8C02AB8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadDisplayName</key>
            <string>Connect agent settings</string>

            <!-- Fill in values, or delete a key entirely to use the agent default. An empty string is not the same as the default. -->

            <!-- Enable or disable the GUI for the agent, defaults to true -->
            <key>use_gui</key>
            <true/>

            <!-- host[:port], port defaults to 8444. Example: mc.example.com:8444 -->
            <key>management_server.host</key>
            <string>mc.example.com:8444</string>

            <key>management_server.bootstrap_token</key>
            <string>R2D2C3POSV72MBLX22I7X7SZMB7AQNWRPUFNNLGMYLBZ4HUP2MYA</string>

            <key>management_server.spn</key>
            <string>rslmc/resilio-server.corp.example.com</string>

            <!-- SHA-256 certificate digest, hex, even length (64 hex characters). -->
            <key>management_server.cert_authority_fingerprint</key>
            <string>c3d03024e15a10cecc8a05b2fc8021e7ebfa1b80d1f6484525a530aa79b59bf2</string>

            <!-- true disables certificate checking. -->
            <key>management_server.disable_cert_check</key>
            <false/>

            <!-- "all", or a list of: sync;storage;cache;hybrid;transfer;archival;script -->
            <key>local_policy.allowed_jobs</key>
            <string>hybrid</string>

            <key>local_policy.allowed_hybrid_job_cache_path</key>
            <string></string>

            <key>local_policy.allow_fs_browsing</key>
            <true/>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Connect agent settings</string>
    <key>PayloadIdentifier</key>
    <string>com.resilio.connectagent.settings</string>
    <!-- Optional. Organization name shown in Device Management. -->
    <key>PayloadOrganization</key>
    <string>Example Organization</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <!-- UUID. Example 4BC4FBF6-C3C9-4E2C-861E-0D3CC8C02AB8. Should be different from PayloadContent UUID -->
    <key>PayloadUUID</key>
    <string>ABCDEFBF6-C3C9-4E2C-861E-0D3CC8C02AB8</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

  2. Upload the profile.

    1. Select Blueprints.
    2. Locate and select the Blueprint with the Resilio Agent app, then select Custom Profiles > Add a Custom Profile.
    3. Upload the .mobileconfig file, then click Add Profile.
    4. Repeat for every Blueprint with the Resilio Agent app.
    5. (Optional) Select Devices > Mac > Sync to force a check-in.

  3. Verify custom profile deployment.

    • System Settings
      On the Mac device, select System Settings > General > Device Management and make sure the Resilio Agent profile is listed there.

    • Terminal
      Run the following commands:

      sudo profiles show -type configuration | grep -i -A5 resilio
defaults read "/Library/Managed Preferences/com.resilio.ConnectAgent"

      The first command confirms the profile is installed. The second prints the values delivered to the Agent, which must match the file.

    Note

    If the profile is missing several minutes after initiating Sync, make sure the Mac is online and belongs to a Blueprint that the profile is uploaded to.

Changing the profile

Note

  • You can change the profile without having to reinstall your app.
  • The new profile replaces the old one if PayloadIdentifier remains unchanged.
  • Removing the profile from a Blueprint without uploading a replacement removes it and its settings from devices assigned to that Blueprint.

To change the profile:

  1. Obtain the updated .mobileconfig or edit the values in your file.
  2. In each Blueprint, select Custom Profiles, remove the old profile, upload the new one, then select Save.
  3. Select Devices > Mac > Sync to force a check-in.

  4. Verify the new profile is installed:

    • System Settings
      On the Mac device, select System Settings > General > Device Management and make sure the Resilio Agent profile is listed there.

    • Terminal
      Run the following commands:

      sudo profiles show -type configuration | grep -i -A5 resilio
defaults read "/Library/Managed Preferences/com.resilio.ConnectAgent"