Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Deploy the Nightfall Safari Extension with MDM

Deploy the Nightfall Safari extension to managed Macs from the signed package in the macOS agent download.

The Safari extension is a signed package inside the Nightfall macOS download. It is not part of the browser-extension configuration profile, and it is no longer distributed through the Mac App Store or Apple Business Manager. You do not need an Apps and Books token, a VPP sync, or per-device licenses.

Deploy the package with the custom-package flow in your MDM. Then force-enable the extension where your MDM supports Apple's declarative configuration, so users do not have to turn it on manually.

The Nightfall agent updater automatically updates an extension that is already installed. It does not perform first-time installs or reinstall a removed container application. A Mac that misses the package assignment stays uncovered until the package is deployed.

Requirements

Installing the package requires a Mac managed by your MDM.

Force-enabling the extension without user prompts additionally requires:

  • macOS 15.0 or later

  • Supervised enrollment (Automated Device Enrollment)

  • The primary MDM-managed user account

This is an Apple platform constraint. Safari extension management exists only as a declarative configuration (com.apple.configuration.safari.extensions.settings), which Apple introduced in macOS 15 for supervised devices. Legacy configuration profiles (.mobileconfig) cannot force-enable Safari extensions.

Declarations apply to the MDM-managed user account only. Other local accounts on the same Mac must enable the extension manually. Macs on macOS 14, or Macs that are user-enrolled rather than supervised, can still run the extension after a one-time manual enablement in Safari. See Manually Install the Nightfall Safari Extension.

Extension values

Use these values wherever your MDM asks for them. The identifier is the bundle ID, a space, then the team ID in parentheses. The spacing must match. AlwaysOn is one word.

Setting
Value

Extension identifier

ai.nightfall.Nightfall-DLP-for-Browsers.Extension (4QRDR8M75S)

Bundle ID, when asked separately

ai.nightfall.Nightfall-DLP-for-Browsers.Extension

Team ID, when asked separately

4QRDR8M75S

State

AlwaysOn

Private browsing

AlwaysOn

Allowed domains

*

Denied domains

Leave empty

A mismatched identifier matches no extension and will not return an error.

Install the package

Download a current macOS bundle from the Nightfall console. The Safari package is included in downloads for macOS agent 1.2.15.7 and later. It is the .pkg in the safari_extension folder.

The package installs /Applications/Nightfall DLP for Browsers.app. Safari discovers the extension from that app the next time Safari launches.

  1. Go to Apps → macOS and add a macOS app (PKG).

  2. Upload the extension .pkg.

  3. Assign it to the groups that should receive the extension as Required.

This uses the standard Intune macOS PKG app deployment flow.

  1. Go to Settings → Computer Management → Packages and upload the .pkg.

  2. Create a policy (Computers → Policies → New).

  3. On the Packages payload, add the uploaded package with action Install.

  4. Set the trigger to Recurring Check-in and the execution frequency to Once per computer.

  5. Scope the policy to the computers that should receive the extension, then save it.

  1. In SimpleMDM, go to Apps → Native Apps.

  2. Click Add App → Custom App (macOS).

  3. Upload the .pkg from the safari_extension directory.

  4. Assign the app to the appropriate device groups.

  1. In Kandji, go to Library and add a Custom App library item.

  2. Select Installer Package (.pkg) and upload the .pkg from the safari_extension directory.

  3. Add that library item to the blueprint used for the Nightfall agent, or to the blueprint that should receive the extension.

  1. In JumpCloud Admin Portal, go to Device Management → Software Apps → macOS.

  2. Click the + icon and upload the .pkg.

  3. Scope the software package to the device groups that should receive the extension.

  1. In Rippling, go to IT Cloud → Custom Software → Add Custom App.

  2. Upload the .pkg from the safari_extension directory.

  3. Deploy it to the devices or users that should receive the extension.

If you previously deployed this extension through Rippling's Apps and Books integration, that setup is no longer required.

Mosyle custom package deployment requires a publicly accessible download URL rather than a direct package file upload.

  1. Unpack the Nightfall macOS bundle and locate the .pkg in the safari_extension folder.

  2. Host the .pkg file on secure cloud storage accessible by your endpoints (such as an Amazon S3 HTTPS URL or Azure Blob Storage).

  3. In Mosyle, navigate to Management → Custom PKG.

  4. Create a new profile, enter the HTTPS URL pointing to the hosted .pkg, and assign it to the target macOS devices.

Force-enable the extension

Microsoft Intune, Jamf Pro, and SimpleMDM can configure Apple's declarative Safari extensions configuration directly.

For MDMs that do not currently apply Apple's declarative extension settings on macOS (such as Kandji, JumpCloud, Rippling, and Mosyle), the package installs cleanly, but users must turn the extension on once in Safari settings.

  1. Open the macOS configuration profiles page.

  2. Create a profile and choose Settings catalog.

  3. Click Add settings, search for safari, and select the Safari extensions settings.

  4. Set the extension identifier, state, private browsing, and allowed domains from Extension values. Remove any denied-domain entries.

  5. Assign the profile to the users or groups that should receive it, then create it.

Jamf Pro delivers declarative configurations through Blueprints.

  1. Open Blueprints. Update an existing blueprint or create one. The Safari extensions quick start pre-selects the component.

  2. Name the blueprint and set its scope.

  3. Add the Safari extensions component if it is not already there.

  4. Set the extension identifier, state, private browsing, and allowed domains from Extension values. Leave denied domains empty.

  5. Save, then click Deploy.

SimpleMDM supports declarative management configurations.

  1. Go to Configs → Declarative Management.

  2. Create a configuration referencing com.apple.configuration.safari.extensions.settings.

  3. Provide the identifier ai.nightfall.Nightfall-DLP-for-Browsers.Extension (4QRDR8M75S).

  4. Set State to AlwaysOn, Private browsing to AlwaysOn, and Allowed domains to *.

  5. Assign the configuration to your supervised macOS 15+ devices.

  • If your MDM provider adds declarative Safari extension settings for macOS, configure the values listed under Extension values.

  • Uploading a custom .mobileconfig profile does not force-enable the extension, even on MDMs that accept custom profiles. Safari extension states can only be set declaratively.

  • When automated force-enablement is not available through your MDM on macOS, deploy the package and instruct users to perform the one-time enablement steps in Manually Install the Nightfall Safari Extension.

Verify

On a target Mac, signed in as the MDM-managed user:

Open Safari → Settings → Extensions. The Nightfall extension should be listed and enabled.

When force-enable has applied, its controls are locked and greyed out with the notice: "This extension's state has been configured by device management."

If the user can still toggle the extension, the declaration has not reached that Mac. Check that the Mac is supervised, on macOS 15 or later, in scope, and that you are signed in as the MDM-managed user.

Platform and Tamper Protection Notes

  • Extension state vs. app presence: Apple's declarative configuration locks the extension enabled state inside Safari, but Apple does not prevent local users from removing application files. Users with file permissions can drag /Applications/Nightfall DLP for Browsers.app to the Trash or click Uninstall in Safari settings. Maintain compliance by monitoring the presence of the container app.

  • First installs and updates: Once installed, the extension updates automatically through the Nightfall agent updater. The updater will not perform initial installs or recover deleted container apps.

Troubleshooting

The extension is enabled, but nothing is happening. The extension needs the Nightfall agent. Confirm the agent is installed and running on the Mac.

The package is installed, but Safari does not list the extension. Quit and reopen Safari.

The extension is listed, but the user can still turn it off. Force-enable has not applied. Confirm macOS 15 or later, supervised enrollment, scope, and that the identifier matches exactly.

It works for one user on the Mac and not another. Only the MDM-managed user account is covered. Other local accounts enable the extension manually.

The Mac is on macOS 14, or it is user-enrolled rather than supervised. Declarative force-enable is unavailable. The user enables the extension once by hand.

PreviousManually Install the Nightfall Safari Extension
NextInstall Nightfall AI Agent for Mac

Was this helpful?