Whitelisting Zappl

To ensure that Zappl can successfully run in the background and perform app installs/updates, you can use the below configuration profiles in your MDM to give Zappl full permissions to operate.

</aside>

Managed Login Items

As of macOS 13 (Ventura), users can disable launch agents and daemons via the Login Items option in System Settings. Zappl uses launch daemons to run automatically in the background, and these daemons need to be enabled to function.

The following profile ensures the user cannot disable the Zappl launch daemons, which would prevent Zappl from running automatically.

</aside>

Zappl - Managed Login Items.mobileconfig

Alternatively, if you prefer to create the profile manually in your MDM, simply whitelist the following Team ID: JTYACQP7Y5

Full Disk Access (PPPC Profile)

As of macOS 13 (Ventura), full disk access is required in order to update or remove macOS apps. The Zappl agent is responsible for performing all app updates, therefore full disk access (SystemPolicyAllFiles) needs to be granted to the agent via a configuration profile.

</aside>

To ensure Zappl is allowed to perform updates, simply add the below configuration profile to your MDM and scope it out to devices which Zappl will be deployed to.

Zappl - PPPC.mobileconfig

Alternatively, if you prefer to create the profile manually in your MDM, you can specify the following path as the identifier type:

/Library/Application Support/DARE/Zappl/Bin/zappl

Next, specify the following under the code requirement:

anchor apple generic and identifier zappl and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = JTYACQP7Y5)

Finally, allow access for SystemPolicyAllFiles.

Navigation

Frequently Asked Questions

Deploying Zappl

Deploy Using Jamf Pro