There are two phases:

Apple Business Manager (ABM) — acquire licenses and download the location (.vpptoken) file.
Your MDM — upload the token and deploy the app as a required, device-licensed managed app using a DDM declaration. Examples use Jamf Pro; other DDM-aware MDMs follow the same model.

Prerequisites

Your organization is enrolled in Apple Business Manager with a role of Content Manager or Administrator.
Target Macs are supervised — enrolled via Automated Device Enrollment (ADE) from ABM. User-approved (BYOD) enrollment is not supported for silent install.
Target Macs run macOS 14 or later (macOS 15+ recommended for full Safari Extension management support).
Your ABM Location token already uploaded to your MDM (VPP tokens are per Location, not per app — most orgs managing Apple devices already have this in place)

Your MDM is DDM-aware — Jamf Pro 11.x or later, Kandji, Mosyle, Intune (recent versions), or equivalent.

Part 1 — Apple Business Manager

Step 1. Locate the Nudge Security app in ABM

Sign in to Apple Business Manager at business.apple.com.
In the sidebar, select Apps and Books.
In the left-hand filters, choose Custom Apps. The Nudge Security app appears here because it is privately distributed to your organization, not on the public Mac App Store.
Select Nudge Security Extension from the list.

If you don't see the extension under Custom Apps reach out to our support team for assistance.

Step 2. Buy licenses

Under Apps & Services, choose the Apps & Books then click View Store +.
From there got Custom Apps.
Select the Nudge Security extension. Set Assign to to your selected Organizational Unit.
Set your quantity of licenses and click Get to complete the order. Licenses appear in your tenant within a few minutes.

Step 3. Download the Content token (.vpptoken)

(Skip this step if your ABM Location token is already in your MDM)

Click your name in the top-right corner, then choose Preferences.
Open the Payments and Billing section, then select Apps and Books.
Locate your Location under Content Tokens and click Download. This produces a .vpptoken file.

Important

A .vpptoken can only be bound to one MDM at a time. If your token is already in use by another MDM, re-downloading it will invalidate the existing binding. Always re-download the token after revoking or rotating it.

Store the token securely — it grants license-assignment authority for the Location it represents.

Part 2 — MDM Configuration (Jamf Pro example)

The steps below describe Jamf Pro 11.x. Other DDM-aware MDMs (Kandji, Mosyle, Intune, Hexnode) follow the same pattern: upload the token, sync the app catalog, then deploy the app as a device-licensed managed app with Required install behavior.

Step 4. Upload the .vpptoken to your MDM

In Jamf Pro, navigate to Settings → Global → Volume Purchasing.
Click New, give the token a display name (e.g., "Nudge Security — Production"), and upload your .vpptoken file.
Save.
1. Jamf will sync with ABM and pull the purchased license count. Verify the synced count matches what you bought in ABM.

Step 5. Add the Nudge Security app to Jamf

The Nudge Security app is distributed as a Custom App through Apple Business Manager ("Private — Available as a custom app on Apple Business Manager"). Custom Apps use the same Mac App Store delivery path as public apps, so the Jamf workflow is the same — but the app will not appear in a public App Store search. It is surfaced into Jamf through the VPP token sync you completed in Step 4.

Go to Computers → Mac Apps, then click New.
Select Mac App Store and click Next. This is the correct option for Custom Apps.
Search for Nudge Security. The app appears in the results because your VPP token includes licenses for it. Select it and click Add.

If Nudge Security does not appear in search

The VPP token has not yet synced the Custom App into Jamf's catalog. Go to Settings → Global → Volume Purchasing, open the token you uploaded, and trigger a manual sync. Wait a few minutes, then retry the search.

Confirm in Apple Business Manager that licenses were purchased and assigned to the correct Organizational Unit — the one tied to the .vpptoken now in Jamf.

If the Custom App still doesn't appear you may need to add it manually. Reach out to our support team if you need assistance.

Step 6. Configure the app for silent, device-based install

Three panes on the app record control whether this install is silent. Set all three before you save — skipping the Managed Distribution tab is the single most common reason the install prompts users for an Apple Account.

6a. General pane

Setting	Value	Notes
Display Name	`Nudge Security Extension`	Or your own naming convention.
Category	Security (or your equivalent)	Optional, but it keeps the app list navigable.
Distribution Method	Install Automatically/Prompt Users to Install	This is the pop-up menu label in Jamf Pro. Choosing it suppresses the Self Service path and delivers the app automatically.
Free	Cleared	Leave this checkbox unselected. When it's selected, macOS asks the user to sign in with an Apple Account even for a no-cost app.
Make app managed when possible	Selected	Required. An unmanaged app can't receive the Managed App Configuration you'll deliver in Part 3, so the deployment key never reaches the extension.
Remove app when MDM profile is removed	Selected	Recommended. The extension leaves the device when it un-enrolls.

6b. Managed Distribution pane → Device Assignments tab

This is the step that makes the install device-licensed rather than user-licensed.

Open the Managed Distribution tab, then the Device Assignments tab.
Select Assign Volume Content.
From the Location menu, choose the Apple Business Manager location whose .vpptoken you uploaded in Step 4 — the one holding your Nudge Security Extension licenses.
Confirm the available license count is greater than the number of Macs in your scope.

6c. Scope pane

Covered in Step 7. Set it before you save.

Click Save when all three panes are set.

Why these settings matter

A device-based license installs the app against the device's serial number, so nobody has to sign in with an Apple Account or approve anything. Together with Install Automatically, this is what gives you a genuinely silent install. Behind the scenes, Jamf delivers the app as a Declarative Device Management configuration (com.apple.configuration.app.managed) with InstallBehavior = Required, which is what enforces the install on supervised devices.

If the app appears in Self Service instead of installing

Jamf falls back to Self Service when it can't deliver an automatic install. Check that the Mac is supervised, that Assign Volume Content is selected with the right Location, and that licenses are still available.

Step 7. Scope to your supervised devices

Switch to the Scope tab.
Add a Smart Group or static group that contains only supervised, ADE-enrolled Macs. A typical Smart Group criterion: Enrollment Method like "PreStage enrollment".
Save. Jamf will assign a device-based license to each in-scope Mac and deliver the install command at the next check-in.

What you have so far — and what's still missing

At this point the Nudge Security app installs itself silently on every in-scope Mac. That's the binary on disk, and nothing more. Two things still have to happen before the extension reports anything to your tenant:

What's left	Where it happens	What breaks without it
Deliver the deployment key	Part 3 (Managed App Configuration profile)	The extension installs but can't register with your tenant. You'll see nothing in the admin console.
Turn the extension on in Safari	Part 4 (Safari extensions Blueprint)	Each user has to find the extension in Safari settings and toggle it on manually. Most never will.

Both are required for a hands-off deployment. Continue to Part 3.

Verification

On a target Mac, confirm the install was delivered via DDM and the app is managed. Open Terminal and run:

# Verify the device is supervised and ADE-enrolled

sudo profiles status -type enrollment

# Inspect active DDM declarations

sudo profiles status -type=management

Look for a declaration with a type of com.apple.configuration.app.managed referencing Nudge Security. Its status should be active: true and valid: valid. The app itself should appear in /Applications, and in System Settings → General → Device Management the app should be listed as a managed app.

Troubleshooting

Symptom	Likely cause
User is prompted to sign in with an Apple Account before install.	License was assigned as user-based instead of device-based. Re-check the app's Distribution settings in your MDM.
App downloads but is marked unmanaged.	Make app managed when possible is disabled, or the Mac is not supervised.
App never appears on the device.	Device is out of scope, has no license available, or has not checked in. Force a check-in (sudo profiles renew -type enrollment) and confirm license counts in your MDM.
Install Automatically option is greyed out.	Token is missing or the app catalog has not synced. Re-sync from your MDM's Volume Purchasing settings.
Declaration shows valid: unknown in profiles status.	MDM uploaded the configuration via the legacy profile channel rather than DDM. Upgrade your MDM (Jamf 11.5+) or re-create the app definition with DDM delivery enabled.

Part 3 — Deliver the Deployment Key

Installing the Nudge Security app from Parts 1 and 2 places the binary on the device, but the app needs an organization-specific deployment key to register with your Nudge Security tenant. The key is delivered as a Managed App Configuration profile, which the Nudge Security team provides as a .mobileconfig file (typically named safari-app-config-prod.mobileconfig).

Payload type: com.apple.app.managed

Target app bundle ID: com.nudgesecurity.extension

Step 8. Retrieve your deployment key

Sign in to the Nudge Security admin console at https://www.nudgesecurity.io.
Navigate to Settings → Extension (https://www.nudgesecurity.io/settings#extension).
Copy your deployment key. Treat this value as a secret — it authenticates devices into your tenant.

Step 9. Edit the configuration file

Open the .mobileconfig file from Nudge Security in any text editor and update the placeholder values:

<key>nudge-security-deployment-key</key> <string>REPLACE_WITH_DEPLOYMENT_KEY</string>

<!-- Optional device metadata. Remove any line you don't need. --> <key>nudge-security-device-identifier</key>
<string>$SERIALNUMBER</string>
<key>nudge-security-hostname</key>
<string>$COMPUTERNAME</string>
<key>nudge-security-device-type</key>
<string>laptop</string>
<key>nudge-security-device-os</key>
<string>macOS</string>

<!-- Optional: pre-register a specific user email. -->
<!-- Remove these two lines if you do not need this. -->
<key>registered-user</key>
<string>$EMAIL</string>

Replace REPLACE_WITH_DEPLOYMENT_KEY with the value from Step 8.
If you do not need to pre-register a specific user, delete both the registered-user key and its <string> value.
- Otherwise, replace REPLACE_WITH_MDM_EMAIL_VARIABLE with your MDM's variable for the assigned user's email address. Your MDM substitutes the variable for the user's actual email before the profile is delivered to each device, so a single template serves your whole fleet. The syntax depends on which MDM you use:
  - MDMReplace withJamf Pro$EMAILMicrosoft Intune{{mail}}Kandji$EMAILMosyle%Email%Workspace ONE / Omnissa{EmailAddress}Cisco Meraki Systems Manager$OWNEREMAIL
- For example, a Jamf Pro–targeted file would read:
  - <key>registered-user</key>
    <string>$EMAIL</string>
- And for Microsoft Intune:
  - <key>registered-user</key> <string>{{mail}}</string>
You can also hardcode a specific address (e.g. <string>jane.doe@example.com</string>) if you only need to register one user.
Save the file. Do not modify the PayloadUUID values unless you are creating a unique copy per environment.

Optional: attach device metadata

You can attach device metadata to every submission the extension sends to Nudge Security. All fields are optional. Add them to the same <dict> as your deployment key.

One of these maps to Jamf payload variables, so each device reports its own value automatically:

nudge-security-device-identifier: use $SERIALNUMBER so each device reports its serial. Jamf also supports $UDID; for an asset tag, use the extension attribute variable ($EXTENSIONATTRIBUTE_#) for your asset-tag attribute.

The other two have no native Jamf variable. Hardcode them, since they are constant for a given policy:

nudge-security-device-type: hardcode laptop, desktop, or tablet. (If you want this dynamic, source it from a custom extension attribute with $EXTENSIONATTRIBUTE_#.)
nudge-security-device-os: hardcode macOS.

Other MDMs: use your MDM's equivalent serial variable in that field, the same way you set the user email variable above. See your MDM's documentation for its variable syntax.

Two things that will trip you up:

Payload variables are case-sensitive. $SerialNumber fails silently and ships the literal string.
Signed configuration profiles do not substitute Jamf variables. If you sign the profile, hardcode the values or leave the profile unsigned.

Step 10. Upload the profile to Jamf Pro

In Jamf Pro, navigate to Computers → Configuration Profiles.
Click Upload in the top-right corner and select the edited .mobileconfig file.
Jamf parses the profile and pre-fills the General and Application & Custom Settings panes. Review and adjust:

Name: Nudge Security — App Configuration (Prod) (or your preferred convention)
Category: assign to an existing category (e.g., Security)
Distribution Method: Install Automatically
Level: Computer Level (matches the PayloadScope: System in the file)

Open the Scope tab. Add the same Smart Group used in Part 2, Step 7 — the supervised, ADE-enrolled Macs that received the app install.
Click Save. Jamf delivers the profile at each in-scope device's next check-in.

Important — the host app must launch once

Managed App Configuration values are passed from macOS to the Safari Web Extension via the host app. The extension only picks up the deployment key the first time the Nudge Security host app is launched after the profile is installed.

Most users will not open the app on their own. To force this without user action, deploy a small Jamf policy scoped to the same Smart Group that runs once at the next check-in:

open -gj "/Applications/Nudge Security.app"

The -g flag launches the app without bringing it to the foreground; -j launches it hidden. The app self-terminates after propagating the configuration.

Verify on a target Mac

After the profile reaches a target device and the host app has launched once, confirm the configuration was applied:

# Confirm the configuration profile is installed

sudo profiles list -type configuration | grep -i nudge 

# Inspect the values delivered to the app

defaults read com.nudgesecurity.extension

The output should include nudge-security-deployment-key and, if configured, registered-user. The Safari extension is now able to register with your tenant on first activation.

Part 4 — Safari Configuration Options

Once the app is installed and the deployment key is delivered, you have two Safari-specific configuration options: auto-enabling the extension so users don't have to toggle it on manually, and locking its state via DDM so it can't be disabled or uninstalled. Both are optional but recommended for managed fleets.

Auto-enable the Safari Extension

By default, Safari requires the user to enable a newly installed extension manually in Safari Settings → Extensions. To skip that user step entirely, deploy the Safari Extension Settings declaration provided separately by Nudge Security (typically named safari-extension-settings-prod.mobileconfig).

Payload type: com.apple.configuration.safari.extensions.settings

Requires: macOS 15 or later on a supervised device.

How it works: Jamf Pro Blueprints (DDM)

Apple introduced granular Safari extension management in macOS 15, allowing administrators to define the state of an extension — effectively preventing users from disabling or uninstalling it. This is the mechanism the safari-extension-settings-prod.mobileconfig file configures under the hood.

Requirement: Devices must be on macOS 15.1+ and managed via Jamf Pro Blueprints (DDM profiles). Legacy Configuration Profiles cannot enforce extension state.
Extension states:
- AlwaysOn — permanently enabled; the toggle in Safari is grayed out
- Allowed — user can toggle on/off (default behavior)
- AlwaysOff — permanently disabled

The provided .mobileconfig sets the Nudge Security extension to AlwaysOn.

Steps 11–14. Deploy the Safari Extension Settings profile

Deployment in Jamf follows the same flow as Part 3:

In Jamf Pro, go to Computers → Configuration Profiles and click Upload.
Select the safari-extension-settings-prod.mobileconfig file. No editing is required — the file ships with the production extension's bundle and team identifiers pre-populated.
Set Distribution Method to Install Automatically and Level to User Level. Safari extension enablement is per-user on macOS, so this profile must target the user channel — not the device channel.
Scope to the same Smart Group used in Parts 2 and 3, then Save.

Common pitfall — User Level vs. Computer Level

If this profile is saved at Computer Level, the device will accept it without error but Safari will ignore the extension state portion. The user must still toggle the extension on manually. Always set Level: User for the Safari Extension Settings profile.

Force the extension on with a Jamf Pro Blueprint

Blueprints are how Jamf Pro delivers Declarative Device Management declarations, and DDM is the only way to lock a Safari extension's state. A legacy configuration profile can install an extension but can't stop a user from switching it off.

Before you start

Jamf Pro 11.15 or later.
OIDC-based single sign-on configured in Jamf Account. Blueprints won't appear in your Jamf Pro instance without it.
Target Macs on macOS 15.0 or later, supervised and ADE-enrolled.

Step 1. Create the blueprint

In Jamf Pro, select Blueprints in the sidebar.
Click Create blueprint.
Name it something self-describing — Force Nudge Extension On in Safari works — and click Create.

Step 2. Add the Safari extensions component

In the Components library panel, search for safari extension.
Select Safari extensions (com.apple.configuration.safari.extensions.settings). It's tagged Configuration, which means Jamf delivers it as a native DDM declaration rather than a wrapped legacy profile.
Drag it into the components area on the right, then hover over it and click Configure.

Step 3. Configure the extension

Enter these values exactly.

Field	Value
Extension identifier	`com.nudgesecurity.extension.Extension (6S68727U45)`
Extension state	Selected → `Always on`
Private browsing state	Selected → `Always on`
Allowed domains	Selected → `*`
Denied domains	Cleared

Click Save.

A few notes on those values:

Extension identifier is the extension's bundle ID followed by our Team ID in parentheses. Type it exactly as shown, including the space and the parentheses. This is the production extension — if you're configuring a different Nudge Security environment, ask our support team for the matching identifier rather than guessing.
Extension state: Always on enables the extension and grays out the toggle in Safari settings, so users can't turn it off or remove it. Allowed would let them toggle it freely, which defeats the purpose.
Private browsing state: Always on keeps the extension working in private windows. If your policy is to exclude private browsing from discovery, set this to Always off instead — just know you'll have a blind spot there.
Allowed domains: * grants the extension access to every domain. The extension needs this to discover SaaS usage across your fleet. Narrowing it means losing visibility into whatever you leave out.
Denied domains stays cleared. Denied domains override allowed domains, so anything you add here becomes a permanent gap.

Step 4. Scope and deploy

Open the blueprint's Scope and add the same smart group you used in Parts 2 and 3 — your supervised, ADE-enrolled Macs.
Click Deploy.
Watch Deployment progress on the blueprint page. Devices move through Pending to Deployed as they check in. A handful of Errors on a first deployment usually means those Macs are below macOS 15.0 or aren't supervised.

What users see

Nothing they have to act on. The next time Safari launches, a banner confirms the change and then disappears:

Extension Turned On — "Nudge Security Browser Extension" was turned on by device management.

Applying this to a different extension

The same component manages any Safari extension. To get another extension's identifier, run this on a Mac where it's already installed:

codesign -dv --verbose=4 "/Applications/ExtensionName.app/Contents/PlugIns/ExtensionName Extension.appex" 2>&1 | grep -E "Identifier|TeamIdentifier"

Combine the results into the BundleID (TeamID) format the Extension identifier field expects.

End-to-end verification

On a target Mac running macOS 15 or later, after all four parts are deployed:

The Nudge Security app appears in /Applications and is listed as a managed app in System Settings → General → Device Management.
Opening Safari → Settings → Extensions shows the Nudge Security extension with a managed badge and an enabled state that the user cannot toggle off.
Within a few minutes of the first Safari launch, the device appears in your Nudge Security admin console under Browser Extensions, registered to the email in registered-user (if configured) or to the user who first opened Safari.

Deploy the Nudge Security Browser Extension to Safari