> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/additional-methods-to-install-nightfall-ai-extension/deploy-the-nightfall-safari-extension-with-mdm.md).

# Deploy the Nightfall Safari Extension with MDM

Deploy the Nightfall Safari extension to managed Macs from the signed package in the macOS agent download.

The Safari extension is a signed package inside the Nightfall macOS download. It is not part of the browser-extension configuration profile, and it is no longer distributed through the Mac App Store or Apple Business Manager. You do not need an Apps and Books token, a VPP sync, or per-device licenses.

Deploy the package with the custom-package flow in your MDM. Then force-enable the extension where your MDM supports Apple's declarative configuration, so users do not have to turn it on manually.

{% hint style="info" %}
The Nightfall agent updater automatically updates an extension that is already installed. It does not perform first-time installs or reinstall a removed container application. A Mac that misses the package assignment stays uncovered until the package is deployed.
{% endhint %}

## Requirements

Installing the package requires a Mac managed by your MDM.

Force-enabling the extension without user prompts additionally requires:

* macOS 15.0 or later
* Supervised enrollment (Automated Device Enrollment)
* The primary MDM-managed user account

This is an Apple platform constraint. Safari extension management exists only as a declarative configuration (`com.apple.configuration.safari.extensions.settings`), which Apple introduced in macOS 15 for supervised devices. Legacy configuration profiles (`.mobileconfig`) cannot force-enable Safari extensions.

Declarations apply to the MDM-managed user account only. Other local accounts on the same Mac must enable the extension manually. Macs on macOS 14, or Macs that are user-enrolled rather than supervised, can still run the extension after a one-time manual enablement in Safari. See Manually Install the Nightfall Safari Extension.

## Extension values

Use these values wherever your MDM asks for them. The identifier is the bundle ID, a space, then the team ID in parentheses. The spacing must match. `AlwaysOn` is one word.

| Setting                          | Value                                                            |
| -------------------------------- | ---------------------------------------------------------------- |
| Extension identifier             | `ai.nightfall.Nightfall-DLP-for-Browsers.Extension (4QRDR8M75S)` |
| Bundle ID, when asked separately | `ai.nightfall.Nightfall-DLP-for-Browsers.Extension`              |
| Team ID, when asked separately   | `4QRDR8M75S`                                                     |
| State                            | `AlwaysOn`                                                       |
| Private browsing                 | `AlwaysOn`                                                       |
| Allowed domains                  | `*`                                                              |
| Denied domains                   | Leave empty                                                      |

A mismatched identifier matches no extension and will not return an error.

## Install the package

Download a current macOS bundle from the Nightfall console. The Safari package is included in downloads for macOS agent 1.2.15.7 and later. It is the `.pkg` in the `safari_extension` folder.

The package installs `/Applications/Nightfall DLP for Browsers.app`. Safari discovers the extension from that app the next time Safari launches.

{% tabs %}
{% tab title="Microsoft Intune" %}

1. Go to **Apps → macOS** and add a **macOS app (PKG)**.
2. Upload the extension `.pkg`.
3. Assign it to the groups that should receive the extension as **Required**.

This uses the standard Intune macOS PKG app deployment flow.
{% endtab %}

{% tab title="Jamf Pro" %}

1. Go to **Settings → Computer Management → Packages** and upload the `.pkg`.
2. Create a policy (**Computers → Policies → New**).
3. On the **Packages** payload, add the uploaded package with action **Install**.
4. Set the trigger to **Recurring Check-in** and the execution frequency to **Once per computer**.
5. Scope the policy to the computers that should receive the extension, then save it.
   {% endtab %}

{% tab title="SimpleMDM" %}

1. In SimpleMDM, go to **Apps → Native Apps**.
2. Click **Add App → Custom App (macOS)**.
3. Upload the `.pkg` from the `safari_extension` directory.
4. Assign the app to the appropriate device groups.
   {% endtab %}

{% tab title="Kandji" %}

1. In Kandji, go to **Library** and add a **Custom App** library item.
2. Select **Installer Package (.pkg)** and upload the `.pkg` from the `safari_extension` directory.
3. Add that library item to the blueprint used for the Nightfall agent, or to the blueprint that should receive the extension.
   {% endtab %}

{% tab title="JumpCloud" %}

1. In JumpCloud Admin Portal, go to **Device Management → Software Apps → macOS**.
2. Click the **+** icon and upload the `.pkg`.
3. Scope the software package to the device groups that should receive the extension.
   {% endtab %}

{% tab title="Rippling" %}

1. In Rippling, go to **IT Cloud → Custom Software → Add Custom App**.
2. Upload the `.pkg` from the `safari_extension` directory.
3. Deploy it to the devices or users that should receive the extension.

If you previously deployed this extension through Rippling's Apps and Books integration, that setup is no longer required.
{% endtab %}

{% tab title="Mosyle" %}
Mosyle custom package deployment requires a publicly accessible download URL rather than a direct package file upload.

1. Unpack the Nightfall macOS bundle and locate the `.pkg` in the `safari_extension` folder.
2. Host the `.pkg` file on secure cloud storage accessible by your endpoints (such as an Amazon S3 HTTPS URL or Azure Blob Storage).
3. In Mosyle, navigate to **Management → Custom PKG**.
4. Create a new profile, enter the HTTPS URL pointing to the hosted `.pkg`, and assign it to the target macOS devices.
   {% endtab %}
   {% endtabs %}

## Force-enable the extension

Microsoft Intune, Jamf Pro, and SimpleMDM can configure Apple's declarative Safari extensions configuration directly.

For MDMs that do not currently apply Apple's declarative extension settings on macOS (such as Kandji, JumpCloud, Rippling, and Mosyle), the package installs cleanly, but users must turn the extension on once in Safari settings.

{% tabs %}
{% tab title="Microsoft Intune" %}

1. Open the [macOS configuration profiles](https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMacOsMenu/~/configuration) page.
2. Create a profile and choose **Settings catalog**.
3. Click **Add settings**, search for `safari`, and select the Safari extensions settings.
4. Set the extension identifier, state, private browsing, and allowed domains from [Extension values](#extension-values). Remove any denied-domain entries.
5. Assign the profile to the users or groups that should receive it, then create it.
   {% endtab %}

{% tab title="Jamf Pro" %}
Jamf Pro delivers declarative configurations through Blueprints.

1. Open **Blueprints**. Update an existing blueprint or create one. The Safari extensions quick start pre-selects the component.
2. Name the blueprint and set its scope.
3. Add the **Safari extensions** component if it is not already there.
4. Set the extension identifier, state, private browsing, and allowed domains from [Extension values](#extension-values). Leave denied domains empty.
5. Save, then click **Deploy**.
   {% endtab %}

{% tab title="SimpleMDM" %}
SimpleMDM supports declarative management configurations.

1. Go to **Configs → Declarative Management**.
2. Create a configuration referencing `com.apple.configuration.safari.extensions.settings`.
3. Provide the identifier `ai.nightfall.Nightfall-DLP-for-Browsers.Extension (4QRDR8M75S)`.
4. Set **State** to `AlwaysOn`, **Private browsing** to `AlwaysOn`, and **Allowed domains** to `*`.
5. Assign the configuration to your supervised macOS 15+ devices.
   {% endtab %}

{% tab title="Other MDMs (Kandji, JumpCloud, Rippling, Mosyle)" %}

* If your MDM provider adds declarative Safari extension settings for macOS, configure the values listed under [Extension values](#extension-values).
* Uploading a custom `.mobileconfig` profile does not force-enable the extension, even on MDMs that accept custom profiles. Safari extension states can only be set declaratively.
* When automated force-enablement is not available through your MDM on macOS, deploy the package and instruct users to perform the one-time enablement steps in Manually Install the Nightfall Safari Extension.
  {% endtab %}
  {% endtabs %}

## Verify

On a target Mac, signed in as the MDM-managed user:

```bash
ls -d "/Applications/Nightfall DLP for Browsers.app"
defaults read "/Applications/Nightfall DLP for Browsers.app/Contents/Info.plist" CFBundleShortVersionString
```

Open **Safari → Settings → Extensions**. The Nightfall extension should be listed and enabled.

When force-enable has applied, its controls are locked and greyed out with the notice: `"This extension's state has been configured by device management."`

If the user can still toggle the extension, the declaration has not reached that Mac. Check that the Mac is supervised, on macOS 15 or later, in scope, and that you are signed in as the MDM-managed user.

## Platform and Tamper Protection Notes

* **Extension state vs. app presence**: Apple's declarative configuration locks the extension enabled state inside Safari, but Apple does not prevent local users from removing application files. Users with file permissions can drag `/Applications/Nightfall DLP for Browsers.app` to the Trash or click Uninstall in Safari settings. Maintain compliance by monitoring the presence of the container app.
* **First installs and updates**: Once installed, the extension updates automatically through the Nightfall agent updater. The updater will not perform initial installs or recover deleted container apps.

## Troubleshooting

**The extension is enabled, but nothing is happening.** The extension needs the Nightfall agent. Confirm the agent is installed and running on the Mac.

**The package is installed, but Safari does not list the extension.** Quit and reopen Safari.

**The extension is listed, but the user can still turn it off.** Force-enable has not applied. Confirm macOS 15 or later, supervised enrollment, scope, and that the identifier matches exactly.

**It works for one user on the Mac and not another.** Only the MDM-managed user account is covered. Other local accounts enable the extension manually.

**The Mac is on macOS 14, or it is user-enrolled rather than supervised.** Declarative force-enable is unavailable. The user enables the extension once by hand.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/additional-methods-to-install-nightfall-ai-extension/deploy-the-nightfall-safari-extension-with-mdm.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.