Four steps:

Acquire licenses in Apple Business Manager
Add the app to your MDM
Deliver your deployment key
Enforce the extension in Safari

The examples in this article use Jamf Pro. Steps 1 through 3 work on any MDM with different menu paths. Step 4 depends on your MDM supporting a specific Apple declaration — see that step.

Before you start

An Apple Business Manager account with the Content Manager or Administrator role
Macs enrolled in your MDM
macOS 12 or later, which is what the app requires. Step 4 additionally requires macOS 15 or later
Your Nudge Security deployment key, from Settings → Browser Extension in the console

Step 1 — Acquire licenses in Apple Business Manager

Nudge Security Browser Helper is a free app on the Mac App Store, published by Nudge Security, Inc: apps.apple.com/us/app/nudge-security-browser-helper/id6793208229.

Go to business.apple.com/main/apps/store and sign in. (Or navigate there: Apps & Services → Apps & Books.)
Click View Store and search for Nudge Security Browser Helper.
Select the app, set the Organizational Unit and quantity, then click Get.

Your licenses appear in your MDM once its app catalog syncs.

Not showing up in your MDM? Check that the licenses went to the Organizational Unit tied to the content token your MDM is using. Licenses bought into a different Organizational Unit won't appear.

Step 2 — Add the app to your MDM

Add Nudge Security Browser Helper from the Mac App Store. If your MDM takes an App Store ID instead of a name, it's 6793208229.
Assign the licenses device-based, not user-based. A device-based license installs against the serial number, so nobody signs in or approves anything.
Set the app to install as a managed app. The Managed App Configuration in Step 3 depends on it.
Scope the app to the Macs you're deploying to. Use this same group in Steps 3 and 4.

For exact menu paths in Jamf Pro, see Deploy the Nudge Security browser extension to macOS through Jamf.

Once the app is installed on your devices, proceed to Step 3.

Step 3 — Deliver the deployment key

The app needs your organization's deployment key to register with your Nudge Security tenant. You deliver it in a Managed App Configuration profile (.mobileconfig).

Get your deployment key: In the Nudge Security console, go to Settings → Browser Extension and copy your deployment key. Treat it as a secret — anyone with it can register devices to your tenant.

Build the profile: Copy the file below into a text editor, replace the deployment key placeholder with your own key, and save it as nudge-security-safari-extension-configuration.mobileconfig.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.apple.ManagedClient.preferences</string>
            <key>PayloadIdentifier</key>
            <string>com.nudgesecurity.safari.appconfig</string>
            <key>PayloadUUID</key>
            <string>755EDD97-61D2-43AD-8A50-8CE6DD85A347</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadDisplayName</key>
            <string>Nudge Security — Managed App Config</string>

            <key>PayloadContent</key>
            <dict>
                <key>com.nudgesecurity.app</key>
                <dict>
                    <key>Forced</key>
                    <array>
                        <dict>
                            <key>mcx_preference_settings</key>
                            <dict>
                                <key>nudge-security-deployment-key</key>
                                <string>REPLACE_WITH_DEPLOYMENT_KEY</string>
                                <key>registered-user</key>
                                <string>$EMAIL</string>
                            </dict>
                        </dict>
                    </array>
                </dict>
            </dict>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Nudge Security Browser Extension — Safari App Config</string>
    <key>PayloadDescription</key>
    <string>Delivers the Nudge Security deployment key to the Safari extension app via Managed App Configuration.</string>
    <key>PayloadIdentifier</key>
    <string>com.nudgesecurity.safari.appconfig.profile</string>
    <key>PayloadOrganization</key>
    <string>Nudge Security</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>0F544508-544E-4BE4-9AC3-1DF559E86380</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Replace REPLACE_WITH_DEPLOYMENT_KEY with the key you copied. Your key begins with NUDGE_EXTDK. — paste the whole string, including that prefix.

The registered-user block is optional. If you keep it, substitute your MDM's email variable:

MDM	Variable
Jamf Pro	`$EMAIL`
Kandji	`$EMAIL`
Microsoft Intune	`{{mail}}`
Mosyle	`%Email%`
Workspace ONE / Omnissa	`{EmailAddress}`
Cisco Meraki	`$OWNEREMAIL`

⚠️ Payload variables are case-sensitive. $Email fails silently and ships the literal string instead of the address.

If you don't want to pre-register an email, delete both lines rather than leaving an unreplaced variable in the file.

Upload the profile: Deploy it at Computer Level, set to install automatically, scoped to the same group as Step 2.

Then launch the app. The extension reads the deployment key only on the first launch of the host app after the profile installs. To trigger that without user action in Jamf Pro, create a script containing the command below, then create a policy that runs that script, scoped to the same group:

open -gj "/Applications/Nudge Security Browser Extension.app"

At this point the extension should be functional and reporting to your tenant. If you want to enforce that it stays enabled, proceed to Step 4.

Step 4 — Enforce the extension in Safari

Optional but recommended for managed fleets. Without this step the extension installs correctly and works, but each user has to enable it themselves in Safari, and any of them can turn it back off.

This step can't be done with a configuration profile. Safari extension settings aren't a profile payload. They're delivered through Declarative Device Management (DDM) as the com.apple.configuration.safari.extensions.settings declaration, which means your MDM has to support that declaration specifically — supporting DDM in general isn't enough, since a platform can implement some declarations and not others. Jamf Pro exposes it through Blueprints; other platforms call it something else, and some don't support it yet. Check your MDM's documentation for Safari extension management.

Requires macOS 15 or later.

Jamf Pro example

Go to Blueprints and click Create blueprint. Name it, then click Create.
In the Components library, search safari extension and drag Safari extensions into Components in this blueprint. Click it to open the configuration panel.
Fill in the Safari extension panel:

Field	What to set	Why
Extension identifier	`com.nudgesecurity.app.Extension (6S68727U45)`	The bundle identifier plus our Team ID. Enter it exactly, parentheses included
Extension state	Check the box, choose Always on	Turns the extension on and takes the toggle away from the user
Private browsing state	Check the box, choose Always on	Keeps the extension active in Private Browsing windows
Allowed domains	Check the box, enter `*`	Grants the extension access to all sites
Denied domains	Leave the box unchecked	Denied domains take precedence over allowed domains

Click Save.

Open the blueprint's Scope, add the same group as Step 2, then click Deploy.

⚠️ Choose Always on, not Allowed. Allowed only permits the extension — the user can still switch it off. Always on is what enforces it.

What your users will see

A dismissible banner the first time the setting applies: "Extension Turned On — 'Nudge Security Browser Extension' was turned on by device management."

In Safari → Settings → Extensions, the extension appears enabled, with the toggle unavailable and "This extension's state has been configured by device management" below it.

Under Permissions, Safari shows its standard notice for extensions with all-sites access: the extension can read and alter the webpages they visit and see their browsing history on all websites. That notice is Safari's, and it appears for any extension configured this way. It's worth mentioning in your rollout comms so it doesn't catch anyone off guard.

Verify the deployment

On the device

/Applications/Nudge Security Browser Extension.app is present
Safari → Settings → Extensions shows Nudge Security Browser Extension, enabled, with "This extension's state has been configured by device management" below it
Under Private Browsing, Allow in Private Browsing is checked, with "This setting has been configured by device management"
The device appears in the Nudge Security console under Browser Extensions within minutes of the first Safari launch

From the command line

Run this in Terminal on a target Mac:

sudo profiles show -type configuration -output stdout-xml | grep NUDGE_EXTDK

This dumps every installed configuration profile as XML and filters for the deployment key. A match means the Step 3 profile arrived with your key intact.

It confirms delivery, not consumption. The host app still has to launch once after the profile lands before the extension registers with your tenant.

DDM declarations

The Step 4 settings arrive as a DDM declaration, not a configuration profile. macOS stores declarations separately from profiles, so they don't appear in profiles output and there's no supported command line way to list them.

Check them in System Settings → General → Device Management: double-click the MDM enrollment profile and scroll to Device Declarations.

Your MDM console is the other place to look. In Jamf Pro, the blueprint's Status panel shows each device as Deployed, Pending, or Error.

Deploy the Nudge Security Browser Extension to Safari